New from Ponemon Institute: The State of Offensive Security in 2023. Read the Report ›
Internationalization. 18 represents the 18 letters removed from the middle of the word “internationalization.”
Invisible Internet Project. An anonymous communication network. Do not spell out.
Infrastructure as a service. Spoken as the whole phrase. Spell out on first use.
Identity and access management. Spell out on first use. Capitalize the phrase when discussing AWS and GCP features that provide this service.
“I am not a lawyer” or “I am no lawyer.” Informal.
Short for integrated circuit or intelligence community. Sometimes refers to a specific group of 16 U.S. agencies. Spell out on first use to clarify your intended meaning.
Intrusion Countermeasures Electronics or Immigration and Customs Enforcement. Spell out on first use to clarify your intended meaning.
Integrated development environment. Also stands for Integrated Drive Electronics, an obsolete device connector type. Spell out on first use.
Ex: Eclipse, NetBeans, Visual Studio
An idempotent operation produces a result that is not affected by repetition.
Ex: HTTP GET request
Insecure direct object reference. Pronounced as “eye-door,” letters, or the whole phrase. Spell out on first use.
Intrusion detection system. Spell out on first use. Avoid using the acronym in the plural if possible.
Means “that is to say” in Latin. Always followed by a comma. e.g. means “for example.” Choose wisely.
Inline frame. IFrame and iFrame also appear in texts, but we prefer lowercase.
Short for If This Then That. A service where users can create conditional statement chains called recipes. Pronounced as “ift.”
Industrial Internet of Things. Pronounced as “industrial IoT” or the whole phrase. Spell out on first use.
Internet Key Exchange. Do not spell out unless defining the term.
HPE Integrated Lights Out. A remote server management processor. Pronounced as letters or “eye-low.”
An open source .NET assembly browser and decompiler.
Instant message. Pronounced as letters or the whole phrase. Spell out in formal writing.
An image-hosting website with a giraffe mascot. Pronounced as “imager.”
Commonly describes vulnerabilities that involve a misconfiguration.
Ex: improper input validation, improper MIME type, improperly scoped cookies
Use lowercase when writing about the concept. Capitalize it if referring to the name of a specific document or team.
A social media celebrity. PR jargon; use sparingly.
The process of debriefing or transferring knowledge. Informal; do not use in formal writing.
This industry is also called infosec, cybersecurity, and internet security.
Outdated. Don’t use this to describe the internet.
Intelligence communities use this term to describe the information security industry. Informal.
Boot script for Unix.
A technique for inserting malicious content, typically with a goal of executing it. Compare to poisoning, which typically describes the insertion of content that is later retrieved by other systems or users.
Ex: The team accessed an in-scope server. The service was included in scope for testing.
These are sometimes used interchangeably but may mean very different things. Define briefly to clarify your intended meaning. Do not use “unsecure” as an adjective.
The number of unique locations in a codebase, system, or network that require modification to remediate a finding.
Use this term or in-house knowledge instead of “tribal knowledge.”
Data integrity is preserved when the data has not been tampered with — not altered, added to, or subtracted from.
As in “exposed administrative interface.”
A nonprofit library and archive of historical web pages through the Wayback Machine. https://archive.org/
A web browser.
Consumer-grade embedded devices.
A feature that allows a system to monitor or query itself. Avoid using the verb to describe use of this technology.
Ex: type introspection, virtual machine introspection
Invalidated data has been checked and deemed invalid. Unvalidated data has not been checked at all.
Indicator of attack. Spell out on first use.
Indicator of compromise. Spell out on first use to avoid confusion with the International Olympic Committee.
Internetwork Operating System. Cisco networking software.
Apple mobile platform. Because of the lowercase “i,” avoid beginning sentences with this term if possible. Do not confuse with Cisco’s IOS.
Internet of Things. Pronounced as letters or the whole phrase.
Short for Internet Protocol or intellectual property, depending on context. For clarity, spell out “intellectual property” on first use in technical writing.
Use the tech font, as in
Inter-process communication. Spell out on first use.
Intelligent Platform Management Interface. A computer interface specification. Spell out on first use.
Internet Printing Protocol.
Internal penetration testing. Spell out on first use.
The main versions of Internet Protocol used today. Do not spell out.
Incident response. Pronounced as letters or the whole phrase. Spell out on first use.
Short for incident response plan. Spell out on first use.
Information Sharing and Analysis Center. A sector-specific nonprofit threat detection organization. Pronounced as “I-sack.” Spell out on first use.
Ex: FS-ISAC, EE-ISAC
A common information security framework that determines international standards for many types of technology and equipment. ISO is pronounced as “eye-so.”
Internet service provider. Spell out on first use in public-facing documents.
A British sitcom about a tech support department.