Cybersecurity Style Guide

End-to-end. Informal. Spell out in formal writing.

The Electronic Entertainment Expo. An annual video game industry convention.

Extensible Authentication Protocol.

Network traffic that travels within a data center, rather than north-south traffic that moves in and out of data centers. Explain on first use in public-facing documents.

Amazon Elastic Block Store. Do not use for AWS Elastic Beanstalk. Spell out on first use.

Amazon Elastic Compute Cloud. Do not spell out.

Engine control unit or electronic control unit. Spell out on first use.

Endpoint detection and response. Spell out on first use.

Electronic Frontier Foundation. A nonprofit digital rights advocacy group that has created tools such as Privacy Badger and HTTPS Everywhere. eff.org

Means “for example” in Latin. Always followed by a comma. i.e. means “that is to say.” Choose wisely.

An antivirus test file that is intended to be flagged as a virus (though it’s not actually malicious). Pronounced “eye-car.” Do not spell out.

Enhanced Interior Gateway Routing Protocol. A proprietary Cisco protocol.

Amazon Elastic Kubernetes Service.

A tool used to assess Amazon EC2 security.

An open source search engine.

A platform for building desktop applications.

If it’s a type of element, use the normal font. If it’s a named element, use the tech font, as in “a customErrors element.”

A common strategy for attackers: start as a low-privilege user and find flaws in permissions to gain admin credentials. Also called escalation of privileges.

A concise explanation of a project. Corporate jargon; use sparingly.

Executable and Linkable Format. A file format.

Use the tech font, as in [email protected].

A term in parallel computing. Also called pleasingly parallel.

Electromagnetic field.

Can be pluralized as emojis or emoji. Emoji means “picture letter” in Japanese.

Typography-based pictographs that pre-date emoji.

Electromagnetic pulse.

Electromagnetic radiation or Amazon Elastic MapReduce.

Always hyphenate.

Always hyphenate.

Always hyphenate.

Product lines reach end-of-life when they are no longer supported.

Use tech font when writing about the names of API endpoints, e.g., “the data endpoint.”

An online technology publication.

The scope of an engagement when it includes more than a single application, website, or network.

End-of-life. Product lines reach end-of-life when they are no longer supported. Can also stand for end of line. Spell out on first use.

Electronic protected health information. Pronounced as letters. Spell out on first use.

External penetration testing. Spell out on first use in formal writing.

Use the normal font with quotation marks around system messages, as in “The username or password is incorrect.”

Certain characters can be “escaped” so they are interpreted differently from their standard function. The escape character is used for this purpose.

Competitive online gaming. When referring to an organization or team, use their preferred spelling as in “NRG eSports” or “International e-Sports Federation.” Pronounced like “E-sports.”

Always hyphenate.

A VMware hypervisor. Pronounced as letters.

The MS17-010 vulnerability.

A blockchain platform.

This is capitalized because it’s a trademark.

End-user license agreement. Pronounced “you-la.” Spell out on first use.

A fictional Anonymous-style hacker collective from the TV show Elementary.

Spell out on first use.

Do not include a space between the number and unit, as in “50EB.” Do not pluralize EB.

Use the normal font for the names of columns and rows, as in A2 and B15.

Use the tech font for the content of Excel cells, as in =HYPERLINK and =1+1.

A section of quoted code.

Microsoft Exchange Server. Spell out on first use.

To enact or run a command or application.

To interact with, as in “exercise an API.” In cybersecurity, to use as intended.

Sometimes informally shortened to “exfil.”

A 2014 movie about an AI named Ava who undergoes a Turing test. Also a 2004 comic book series about a superhero who can communicate with and control machines.

Describes applications or functions that are available to the public internet (not only to a private or internal network) and are therefore vulnerable to attack.

A Bishop Fox tool used to “see” which web pages in a domain may be interesting to attackers.

A tool used during security assessments.