Cybersecurity Style Guide

Universal 2nd Factor.

A Linux distribution. Pronounced as “oo-boon-too.”

User Datagram Protocol. A faster alternative to TCP that can tolerate some loss of data.

Unified Diagnostic Services. A communication protocol.

Universal Greeting Time. On IRC, it’s always morning when you log on and always night when you log off. Informal.

User interface. Pronounced as letters. Spell out on first use when writing for a non-technical audience.

Universal Mobile Telecommunications System. Do not spell out.

The disturbing nightmare gap between semi-realistic artificial faces and actual living humans. Informal.

Describes a person who lacks proper credentials. When discussing authentication, we prefer to use unauthenticated.

A nonprofit that decides the internet standards for emoji and Unicode.

Corporate jargon for a successful startup. Informal.

A fictional, planet-eating robot from the Transformers universe. Voiced by Orson Welles in the 1986 movie.

Pay attention to unit capitalization (GB, Gb, GiB). Keep units singular, as in 500TB. Don’t put a space between the number and the unit for things like MB and GHz. Do use a space for some units like dpi, fps, and ms. Use the International System of Units (SI) for further guidance.

An operating system. Not an acronym. Pronounced as “you-nicks.”

In Python, this is the process of taking something out of serialization.

Describes an authenticated user with no permissions. Avoid using this term to describe an unauthenticated user; consider instead if anonymous, guest, or unregistered is more accurate. To avoid ambiguity, specify the name of the role or any permissions involved on first mention.

We prefer to write that “the issue was not remediated” to avoid implying that a problem was solved and then unsolved.

Means that security checks have not been performed. Typically pertains to user-supplied data. “Sanitized” data should be safe for an application to ingest, whereas unsanitized data may not be.

We prefer to use deserialize. For the PHP function, use tech font, as in unserialize().

A tool that predicts random numbers from insecure algorithms.

Invalidated data has been checked and deemed invalid. Unvalidated data has not been checked at all.

Universal Product Code. A common type of barcode. Pronounced as letters. Do not spell out.

User principal name. Used in Active Directory. Spell out on first use.

Universal Plug and Play. A set of networking protocols for device-to-device communication. Spell out on first use.

Better to write “put in uppercase” but if needed, “uppercased” is OK.

Uninterruptible power supply. Spell out on first use to avoid confusion with the shipping company United Parcel Service.

Term used to approve posts on Reddit. Analogous to a Facebook “like.”

Uniform/Universal Resource Identifier. Both URLs and URNs are subsets of URIs. Use the tech font when writing them out. URI is pronounced as letters.

Uniform/Universal Resource Locator. Use the tech font for URLs (including IPv6). Avoid starting sentences with URLs. Format variable segments in bold color, as in https://bishopfox.com/[variable]. If the URLs are meant to be clickable links, underline in the normal font and color in blue. URL is pronounced as letters or, more rarely, as “earl.” Do not spell out.

A specific kind of encoding used by browsers for characters outside the ASCII set and certain other characters (e.g., spaces and ampersands).

A Microsoft application.

Tool used to abbreviate lengthy URLs. Shortened URLs can hide the true identity of a site.

Uniform/Universal Resource Name. Pronounced as letters.

Universal Serial Bus. Pronounced as letters. Do not spell out.

A storage device that connects via USB. A thumb drive is a small form-factor USB drive. A flash drive is any drive with flash memory (solid state/NAND or USB).

A specification that allows a USB device to act as a host when connecting another USB device. Spell out OTG on first use.

A keyboard HID that automates keystrokes. Rubber Ducky is OK on second use.

Universal Scene Description Optimized. A file format for AR.

A vulnerability relating to how memory is used by a program.

A bulletin board system that preceded the modern internet and still exists.

A user’s login ID. Do not use this term to refer to a user’s IRL name, such as “John Smith.” Write usernames in the tech font, as in admin or Zero Cool.

A Unicode character encoding. Pronounced as letters. (Don’t pronounce the dash.)

Universally unique identifier. Pronounced as letters.

User experience. Pronounced as letters or the whole phrase. Spell out on first use in public-facing documents.