## IT-Sec terms explained

**threat actor** = someone who wants to punch you in the face

* **threat** = the punch being thrown
* **vulnerability** = your inability to defend against the punch
* **risk** = the likelihood of getting punched in the face
* **acceptable risk** = your willingness to be punched in the face
* **attack surface** = every part of you that can be hit, plus every place you hang out where someone could take a swing
* **attack vector** = the route the fist takes to reach you: from the front, from behind, or via your buddy who holds you still
* **exploit** = the specific technique that takes advantage of the gap in your guard, like the hook that lands right when you drop your hands
* **zero-day** = a punch you didn't know existed, so you never trained against it
* **social engineering** = someone kindly asks you to lower your hands for a sec, and you do
* **control / mitigation** = keeping your guard up, keeping your distance, learning to box
* **defense in depth** = guard, helmet, mouthguard, and a friend who steps in
* **residual risk** = it still hurts despite the helmet and the guard
* **risk transfer** = health insurance paying for your new teeth
* **risk avoidance** = staying out of the bar where fights break out every night
* **reducing the attack surface** = not going to every bar, not arguing with everyone, not getting into every fight
* **threat intelligence** = knowing who in town likes to punch people, where he hangs out, and that he's left-handed
* **detection** = seeing the punch coming before it lands
* **dwell time** = the time between the first punch and the moment you realize you're being beaten up
* **lateral movement** = after the face, he goes for the liver
* **persistence** = he's waiting outside your front door again tomorrow
* **incident response** = stopping the bleeding, getting away, calling the police, looking for your tooth
* **red team** = a friend who attacks you with permission so you can find your gaps
* **false positive** = ducking because someone just wanted to wave
* **security awareness** = you've finally realized that "could you lower your hands for a sec?" is not an innocent request


inspired by: https://danielmiessler.com/blog/explaining-threats-threat-actors-vulnerabilities-and-risk-using-a-real-world-scenario/