- Air gap
- The historical practice of keeping operational control systems on a network with no connection to business IT or the internet, so malware physically could not cross over. In many facilities the gap eroded gradually through convenience decisions until the isolation existed only on the diagram, not in the building.
- Backup fate-sharing
- The failure mode in which a backup is destroyed by the same single compromise that hits production because it is reachable by the same network path or credentials — the cyber analogue of two generators in one flooded basement. Real protection requires the backup and its source not share a fate (offline or isolated).
- Blast radius
- The total extent of damage or access reachable from a single compromised point — how far one foothold spreads before it hits a wall. It is a design variable set in advance by architecture, not an accident, and it determines whether a breach stays local or becomes total.
- Extortion funnel
- The industrialized ransomware business model, shaped like a sales funnel: cheap automation scans the whole internet at the wide top, targets are filtered down through intrusion and access, and the narrow bottom is the payment. Most victims are harvested by script, not personally chosen.
- Forced shutdown
- A physical process halted not by an attacker directly manipulating equipment, but by operators deliberately shutting down as a safety precaution after losing trustworthy information from compromised IT systems. It is a rational human safety decision made under lost visibility.
- Operational technology (OT)
- The computers that touch physical reality — controllers that run pumps, valves, turbines, and cooling loops. Its job is stable, predictable control rather than information, and its failure mode is physical: fire, flood, and equipment damage rather than mere inconvenience.
- Optimized versus random
- The core distinction between a deliberate attack and an accidental failure. Random faults are statistically independent and scatter across a facility; an adversary concentrates effort on the highest-value, load-bearing components, producing a coordinated, non-random pattern that reveals intent.
- Segmentation and least privilege
- The two tools that shrink blast radius from opposite directions. Segmentation divides the network into isolated zones with controlled crossings, limiting where an attacker can travel; least privilege grants each account and system only the minimum access it needs, limiting what a stolen credential can do.