Every CompTIA Security+ Acronym Explained: The Complete SY0-701 Glossary

AAA — Authentication, Authorization, and Accounting. AES — Advanced Encryption Standard (symmetric block cipher, 128/192/256-bit keys). CIA — Confidentiality, Integrity, Availability (the foundational security triad). DES — Data Encryption Standard (outdated symmetric cipher, 56-bit key). ECC — Elliptic Curve Cryptography (asymmetric encryption, smaller keys than RSA). HMAC — Hash-based Message Authentication Code (uses hash + shared secret). PKI — Public Key Infrastructure (manages digital certificates and keys). RSA — Rivest-Shamir-Adleman (asymmetric encryption algorithm). SHA — Secure Hash Algorithm (SHA-1 deprecated, SHA-2/SHA-3 current). TLS — Transport Layer Security (encrypts data in transit, successor to SSL). TOTP — Time-based One-Time Password (MFA code that changes every 30 seconds).

APT — Advanced Persistent Threat (long-term targeted attack by skilled adversaries). CVE — Common Vulnerabilities and Exposures (public database of known vulnerabilities). CVSS — Common Vulnerability Scoring System (rates severity 0-10). DDoS — Distributed Denial of Service (overwhelms systems with traffic from many sources). DoS — Denial of Service (single-source attack). IoC — Indicator of Compromise (evidence of a breach). OSINT — Open Source Intelligence (publicly available information gathering). SQLi — SQL Injection (database attack via unsanitized input). XSS — Cross-Site Scripting (injects malicious scripts into web pages). CSRF — Cross-Site Request Forgery (forces authenticated user to perform unintended actions).

DMZ — Demilitarized Zone (network segment between internal and external networks). ESP — Encapsulating Security Payload (IPSec protocol providing encryption and authentication). IaaS — Infrastructure as a Service (cloud computing model with most customer control). IDS — Intrusion Detection System (monitors and alerts on threats). IPS — Intrusion Prevention System (monitors and blocks threats in real-time). IPSec — Internet Protocol Security (suite of protocols for secure IP communications). NGFW — Next-Generation Firewall (application-aware firewall with IPS). PaaS — Platform as a Service (cloud model for application development). SaaS — Software as a Service (fully managed cloud applications). UTM — Unified Threat Management (multifunction security appliance). WAF — Web Application Firewall (protects web applications). VPN — Virtual Private Network (encrypted tunnel over public networks).

DAC — Discretionary Access Control (owner sets permissions). EDR — Endpoint Detection and Response (advanced endpoint threat detection). IAM — Identity and Access Management (manages identities and permissions). IdP — Identity Provider (authenticates users for SSO). KDC — Key Distribution Center (Kerberos authentication server). MAC — Mandatory Access Control (central authority sets labels). MFA — Multi-Factor Authentication (requires 2+ authentication factors). NAC — Network Access Control (enforces policy on devices before network access). OAuth — Open Authorization (token-based authorization framework). PAM — Privileged Access Management (manages admin accounts). RADIUS — Remote Authentication Dial-In User Service (centralized AAA protocol). RBAC — Role-Based Access Control (permissions based on job role). SAML — Security Assertion Markup Language (XML-based SSO protocol). SIEM — Security Information and Event Management (log aggregation and alerting). SOAR — Security Orchestration, Automation and Response (automated incident response). SSO — Single Sign-On (one authentication for multiple applications). TACACS+ — Terminal Access Controller Access-Control System Plus (Cisco AAA protocol). TGT — Ticket Granting Ticket (Kerberos initial authentication token). XDR — Extended Detection and Response (multi-source threat detection).

ALE — Annualized Loss Expectancy (SLE × ARO). ARO — Annualized Rate of Occurrence (frequency per year). BIA — Business Impact Analysis (identifies critical functions and recovery requirements). BCP — Business Continuity Plan (ensures operations during disruptions). DRP — Disaster Recovery Plan (restores IT systems after disaster). GDPR — General Data Protection Regulation (EU data privacy law). HIPAA — Health Insurance Portability and Accountability Act (US healthcare privacy). PCI DSS — Payment Card Industry Data Security Standard (cardholder data protection). PII — Personally Identifiable Information (data identifying an individual). RPO — Recovery Point Objective (maximum acceptable data loss). RTO — Recovery Time Objective (maximum acceptable downtime). SLE — Single Loss Expectancy (AV × EF). SOC — Service Organization Control (audit report for service providers). SLA — Service Level Agreement (contractual service commitments). NDA — Non-Disclosure Agreement (confidentiality contract). MOU — Memorandum of Understanding (non-binding agreement).