The FREE Cybersecurity Glossary by Thor Pedersen!

Zachman framework: A system for categorizing and organizing the components of an enterprise architecture. It is used by organizations to help plan, design, and implement complex information systems and to ensure alignment with business goals and strategies. Examples of Zachman framework components include data, function, network, people, and time.

Zero-day exploit: A cyber-attack that targets a software vulnerability on the day it is discovered by the attackers. Since developers have no warning or time to patch the vulnerability, zero-day exploits are particularly dangerous, often leading to significant damage as defenses have not yet been developed.

Zero-Defect: The ultimate goal of creating systems, software, or procedures that have no defects or flaws, particularly those that could be exploited to compromise security. Achieving a zero-defect state would theoretically mean that all potential vulnerabilities have been identified and resolved. However, the complexity of modern systems and software often makes this goal difficult to achieve in practice.

Zero fill: A process of overwriting all data on a storage device with zeroes in order to permanently erase the data. It is used to securely delete sensitive data and prevent it from being recovered. Examples of zero fill include wiping a hard drive, formatting a USB drive, and using a secure erase utility.

Zero-knowledge proof: A mathematical proof that allows one party to prove to another party that they know a certain piece of information without revealing the information itself. It is used in cryptography and secure communication protocols to verify the authenticity of a user or device without exposing sensitive information. Examples of zero-knowledge proofs include the Schnorr signature algorithm and the Fiat-Shamir heuristic.

Zero-trust architecture: A security model that assumes no user or device can be trusted by default, regardless of its location (inside or outside the network) or whether it has previously been verified. Instead, every request for access to resources must be authenticated and authorized. This approach minimizes the potential for unauthorized access and reduces the attack surface by limiting access to only what is needed for a specific task, even if a user's credentials or device has been compromised.