Cybersecurity Style Guide

Network as a service. Spell out on first use.

Network access control. Pronounced as “nack.” Spell out on first use.

An internet server that resolves domain name queries.

Short for negative-AND gate. A logic gate that produces a false output only if all of its inputs are true.

NetBIOS Name Service. A modern Windows protocol. Briefly define on first use in public-facing documents.

Non-disclosure agreement. Pronounced as letters. Spell out on first use in public-facing documents.

Intel is provided on a need-to-know basis. The user does not need to know this.

Network Basic Input/Output System. Do not spell out.

A range of IP addresses.

A utility that reads from and writes to network connections with TCP or UDP.

A Microsoft software framework. If possible, don’t begin sentences with this term. Pronounced as “dot-net.”

Overall risk.

A capture-the-flag competition.

An alternate term for information security.

The titular fictional AI in the 1984 cyberpunk novel by William Gibson.

An invisible character that moves the following characters to the next vertical line down.

Corporate jargon; use sparingly.

Network File System. Spell out in public-facing documents.

An offensive security tool for spoofing NFS credentials.

Web server software. Pronounced as “engine-X.”

Network grep. A network packet analyzer. Use the tech font when writing about the command. Pronounced as “N-grep.”

Network-based intrusion detection system. Pronounced as “network-I-D-S.” Spell out on first use.

This and many other Nintendo product names should be preceded by “Nintendo” on first use.

National Institute of Standards and Technology. Pronounced as “nist.” Spell out on first use when writing for a general audience.

NIST Cybersecurity Framework. Spell out on first use.

Network Level Authentication. An RDP feature. Spell out or briefly define on first use in public-facing documents.

Natural language processing. Spoken out loud as the whole phrase. Spell out on first use.

Short for Network Mapper. A pen testing tool used to scan ports and map networks. Do not spell out.

A low-privilege, default Linux user.

Network operations center. Pronounced as “nock.” Spell out on first use.

An open source JavaScript runtime environment.

Network traffic that goes in and out of a data center, rather than east-west traffic within a data center. Briefly define on first use in public-facing documents.

A option for the X-Content-Type-Options response header that prevents MIME sniffing.

A variant of ransomware based on Petya.

Node package manager. This is the name of a tool; do not spell out.

The U.S. National Security Agency.

“Not safe for work.” Informal.

A tool used in testing to query DNS records.

Short for NT LAN Manager. A suite of Windows security protocols.

NTLM protocol uses two hashed password values: the LM hash and the NT hash.

An invalid, default, or special state for a value, often expressed as 0 or as NULL. When used as a verb, it means to erase data and replace it with zeros.

Per AP style, write out numbers below 10, except in set phrases. Write numbers plainly, without superscript. Plural years like “in the 1990s” do not take an apostrophe. Non-year numbers have a comma every 3 digits, as in “525,600 minutes.” Use tech font and do not use commas when describing integers in code.

National Vulnerability Database. Spell out on first use when writing for a general audience. https://nvd.nist.gov/