RESOURCES

Terminology & Definitions

Words and acronyms (some of which are overloaded) that we want you to know and understand within the cross-disciplines of data engineering, data science, cybersecurity, and intelligence / counterintelligence.

A-C D-F G-I J-L M-O P-R S-U V-X Y-Z

A-C

Agent

In data, an application that employs automation for specific tasks. In HUMINT, a person who engages in clandestine activities under the direction of an intelligence organization, but is not an officer, employee, or co-opted worker of that organization.

AI (Artificial Intelligence)

A term coined by emeritus Stanford Professor John McCarthy, defined as the "science and engineering of making intelligent machines." Today, the theory and development of computer systems able to perform tasks that normally require human intelligence.

Algorithm

A finite sequence of mathematical instructions used as specifications for performing calculations and data processing.

Analysis

The process in the production step of the intelligence cycle in which information is interpreted for meaning, facts are derived, and conclusions are drawn.

Asymmetric Cryptography

A modern branch of cryptography in which the algorithms employ a pair of keys (a public key and a private key) and use a different component of the pair for different steps of the algorithm.

Availability

The assurance that authorized users can access and use information in a timely and reliable manner.

Bias

The result of systematic errors in ML models that favor certain groups and skew predictions, often due to flawed assumptions in the model training process.

Biographical Intelligence

The aggregate views, traits, habits, skills, relationships, and things of importance to an entity that are of interest to a potential or actual threat actor.

Bit

A contraction of binary digit, the smallest unit of information storage.

Byte

A fundamental unit of computer storage equal to 8 bits; the smallest addressable unit in a computer’s architecture.

Cipher

A cryptographic algorithm for encryption and decryption.

Cipher Text

The encrypted form of a message being sent.

CI (Counterintelligence)

The information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments, organizations, or persons, or international terrorist activities.

Compromise

The exposure of classified or sensitive information and/or activities to an unauthorized entity.

Confidentiality

In cybersecurity, the need to ensure that information is disclosed only to those who are authorized to view it.

CSV (Comma Separated Values)

A plain text file format that stores tabular data in a structured manner.

Cybersecurity

The art of protecting networks, devices, and data from unauthorized access or criminal use, and the practice of ensuring confidentiality, integrity, and availability of information.

D-F

Data

A raw observation of an event that can be structured, semi-structured, or unstructured. Data needs to be processed before it can be interpreted by humans for meaning.

Data Engineering

The process of extracting, storing, transforming, and loading data to be made available to analysts and data scientists.

Data Exploration

The initial analysis and understanding of the structure and content of a dataset to identify patterns, anomalies, and trends.

Data Governance

A series of policies, standards, and practices for managing and ensuring the quality, integrity, and security of data within an organization.

Data Ingestion

The process of collecting and importing data into a data system or storage layer from various sources.

Data Lake

A centralized repository for the storage of structured, semi-structured, and unstructured data at scale.

Data Migration

The process of transferring data from one system to another.

Data Mining

The process of extracting patterns, trends, and information from large datasets.

Data Modeling

The process of defining the structure of data and its relationship to other data in a database or system.

Data Orchestration

The coordination and management of dataflow across systems, services, and processes to ensure data workflows are executed in a controlled, organized manner.

Data Pipeline

A series of processes that move data smoothly from one system to another, typically involving stages such as extraction, transformation, and loading.

Data Quality

A measure of how well a dataset meets standards for accuracy, completeness, consistency, reliability, uniqueness, and timeliness.

Data Redundancy

An occurrence of duplicated data stored in multiple places within a database; this can be intentional.

Data Science

The academic field and discipline of extracting knowledge and insights from data.

Data Warehouse

An enterprise system used for the analysis and reporting of structured and semi-structured data from multiple sources.

Data Workflow

The series of steps, processes, and tasks involved in the end-to-end management and movement of data within an organization.

Decryption

The process of transforming an encrypted message into its original plaintext.

Encryption

The cryptographic transformation of "plaintext" data into "cipher text" that conceals the data’s original meaning and prevents it from being known or used.

Entity

In cybersecurity, a distinct unit that can be identified and interacts with a computer system or network: people, devices, software, or systems themselves.

Espionage

An intelligence activity directed towards the acquisition of information through clandestine means, proscribed by laws of the country against which it is committed.

Exploitation

The process of obtaining information by taking advantage of the source.

Extract

The engineering process of ETL for pulling data from a source.

Filter

The process and/or technique of specifying which data and information to keep versus discard.

FIS (Foreign Intelligence Service)

An organization of a foreign government that engages in intelligence activities (i.e. espionage).

Fusion

The blending of intelligence from multiple sources to produce a single intelligence product.

G-I

Geographical Intelligence

The aggregate locations, descriptions, and analysis of physical and cultural factors of the world, as well as their changes over time.

GPU (Graphics Processing Unit)

A specialized electronic circuit initially designed for digital image processing and to accelerate computer graphics by performing mathematical computations at high speed.

GPGPU (General Purpose GPU)

A GPU programmed to perform computation in applications traditionally handled by the CPU. Their cores are efficient and ideal for parallel tasks. Today they serve as the backbone for ML/AI.

Graph Database

A systematic collection of data that emphasizes the relationships between data entities via graph structures (nodes, edges, and properties).

Honeypot

In cybersecurity, a mechanism set to detect, deflect, or counteract attempts at unauthorized use of information systems. In HUMINT, an operational practice using a covert agent to create a sexual or romantic relationship in order to compromise a target.

HUMINT (Human Intelligence)

A category of intelligence activities and information derived from humans.

Human Source

A person who has either wittingly or unwittingly shared information of potential intelligence value to an intelligence activity.

Identity

The thing for whom someone or what something is known as or for.

Incident

An adverse network event in an information system or network, or the threat of the occurrence of such an event.

Information

Data that has been processed and can now be consumed and interpreted by analysts for meaning.

Integrity

In cybersecurity, the need to ensure that information has not been changed accidentally or deliberately, and that it is accurate and complete.

Intelligence

The arrangement of direct and indirect information, facts, and conclusions in order for an organization and its leaders to take follow-on actions.

J-L

JSON (JavaScript Object Notation)

An open standard file and data interchange format that uses human-readable text to store and transmit data objects consisting of attribute–value pairs and arrays.

Kernel

The essential center of a computer operating system, the core that provides basic services for all other parts of the operating system.

Lakehouse

A data management architecture that combines the best features of data lakes and data warehouses to create a single platform for storing and analyzing data.

Least Privilege

The principle of allowing users or applications the least amount of permissions necessary to perform their intended function.

LLM (Large Language Model)

A computational model, trained on vast amounts of textual data, capable of interpreting, generating, and/or manipulating human language at scale.

Load

The engineering process of ETL for staging data into a data warehouse or other unified data repository.

M-O

Malicious Code (Malware)

Software that appears to perform a useful or desirable function, but actually gains unauthorized access to system resources or tricks a user into executing other malicious logic.

Masquerade

A type of attack in which one system entity illegitimately poses as (assumes the identity of) another entity.

MICE (Money, Ideology, Coercion, Ego)

In HUMINT, basic human motivations delineated into four categories: Money (financial incentives), Ideology (beliefs or philosophies), Coercion (force or threats), and Ego (self-esteem or self-importance).

ML (Machine Learning)

A branch of AI that trains machines to imitate the way humans learn: identifying patterns and making decisions.

NLP (Natural Language Processing)

An ML technology that gives computers the ability to interpret, manipulate, and comprehend human language, bridging the gap between computers and human language.

NN (Neural Network)

A machine learning model that uses a network of interconnected nodes, or artificial neurons, to process data in a way that mimics the human brain.

Non-Repudiation

The ability for a system to prove that a specific user — and only that user — sent a message, and that it hasn’t been modified.

Normalization

A database design technique that aims to minimize data redundancy and dependency by organizing data into separate tables.

OPSEC (Operational Security)

The process by which organizations protect data that, if made public, could create harm or damage.

OSINT (Open-Source Intelligence)

The collection and analysis of data obtained from publicly accessible sources.

P-R

Pandas

A software library written for the Python programming language for data manipulation and analysis.

Pharming

A sophisticated form of man-in-the-middle attack where a user’s session is redirected to a masquerading website.

Phishing

The use of e-mails that appear to originate from a trusted source to trick a user into entering valid credentials at a fake website.

Processing

The manipulation of data (e.g. transformation) to make it consumable and useful for analysis: collecting, recording, organizing, filtering, sorting, analyzing, storing, retrieving.

Python

A high-level, general-purpose programming language.

Ransomware

A form of extortion malware that encrypts a victim’s hard drive, denying access to key files until a ransom is paid to decrypt them.

RBAC

A control assigning users to roles based on their organizational functions, determining authorization based on those roles.

Reconnaissance

In cybersecurity, the phase of an attack where an attacker finds new systems, maps networks, and probes for exploitable vulnerabilities. In HUMINT, an operation undertaken to obtain information of interest by visual observation or other detection methods.

Risk

The likelihood of an event happening and the impact of the event if it happens.

Risk Assessment

The process by which risks are identified and the impact of those risks determined.

Rootkit

A collection of tools a hacker uses to mask intrusion and obtain administrator-level access to a computer or network.

S-U

Sabotage

Deliberate actions to harm an organization’s physical or virtual infrastructure; or, in HUMINT, action against material, premises, or utilities that injures or obstructs national security.

Schema

The structure of data types, a database, or a data warehouse: tables, columns, relationships, and constraints, serving as a blueprint for organizing and representing data.

Semi-Supervised Model

An ML approach using both labeled and unlabeled data to improve model performance and generalization, and to extract relevant features from data.

SIGINT (Signals Intelligence)

A category of intelligence derived from communications, electronics, and foreign instrumentation signals. Arguably the "OG" of big data.

Smishing

A combination of "SMS" and "phishing": fraudulent messages sent over text messaging rather than email.

Social Engineering

Non-technical or low-technology means — lies, impersonation, tricks, bribes, blackmail, and threats — used to attack information systems.

Source

In data, the origin of a set of information. In HUMINT and SIGINT, a person, device, system, or activity from which intelligence information is obtained.

Spark

A multi-language engine for executing data engineering, data science, and machine learning on single-node machines or clusters.

Spoofing

A type of attack in which an unauthorized entity attempts to gain access to a system by posing as an authorized user.

Supervised Model

An ML approach using labeled inputs/outputs to train or "supervise" algorithms into making accurate predictions.

Surveillance

The systematic observation or monitoring of people, places, and things by visual, aural, electronic, photographic, and/or other means.

Symmetric Cryptography

A branch of cryptography where algorithms use the same shared key for two different steps (such as encryption and decryption); sometimes called "secret-key cryptography."

Tamper

An operational act to deliberately alter a system’s logic, data, or control information to cause it to perform unauthorized functions or services.

Target

A country, area, installation, organization, system, situation, signal, person, or other entity against which cyber and/or intelligence operations are conducted.

Targeting

The operational act of conducting cyber and/or intelligence operations against an organization and its people and systems for the purposes of gaining unauthorized access and collection.

Target Analysis

An examination of potential targets to determine importance, priority of attack, and long-term forecasts on arising issues and potential concerns.

Threat

A potential for violation of security: a circumstance, capability, action, or event that could breach security and cause harm.

Threat Assessment

The process and analysis for identifying the types of threats an organization might be exposed to.

Threat Intelligence

The structured collection, analysis, and dissemination of information regarding potential or existing threats, whether cyber or to national security.

Training Data

A large dataset used to train ML models to process information and accurately predict outcomes.

Transform

The engineering process of ETL for "cleaning" data: applying a series of rules or functions to extracted data to prepare it for loading.

Trojan Horse

A program that appears to have a useful function but also has a hidden, potentially malicious function that evades security mechanisms.

Unsupervised Model

An ML approach for analyzing unlabeled datasets and discovering hidden patterns without human intervention; useful for clustering and anomaly detection.

User

A person, organization entity, or automated process that accesses a system, whether authorized to do so or not.

User Contingency Plan

The alternative methods of continuing business operations if IT systems are unavailable.

V-X

VPN (Virtual Private Network)

A restricted-use, logical computer network constructed from the resources of a relatively public physical network (such as the Internet), often using encryption and tunneling.

Virus

A hidden, self-replicating section of software, usually malicious, that propagates by inserting a copy of itself into another program. It requires its host program to run to become active.

Vishing

A type of phishing attack that uses voice calls, via conventional phone systems or VoIP.

War Driving

The process of traveling around looking for wireless access point signals that can be used to get network access.

Wire Tapping

The monitoring and recording of data flowing between two points in a communication system.

Worm

A program that can run independently and propagate a complete working version of itself onto other hosts on a network, potentially consuming resources destructively.

Y-Z

Zero Day

The day a new vulnerability is made known; a "zero day" exploit is one for which no patch is available yet.

Zombie

A computer connected to the Internet that has been compromised by a hacker, virus, or trojan horse.