cybersecurity glossary

Zero Trust is a security model that assumes all users, devices, and networks are untrusted and must be verified before access is granted. It is used to protect organizations from malicious actors and insider threats and is implemented through authentication methods and access control policies.

XDR is a language-independent data representation format used to facilitate the transfer of data between different computer systems. It is used in a variety of applications, including network protocols, distributed systems, and data storage.

Wireless Security is the practice of protecting networks, devices, and data that use wireless connections from unauthorized access. It involves the use of various security protocols and technologies to protect wireless networks from malicious attacks and unauthorized access.

Wire Transfer Fraud is a type of financial fraud that involves the unauthorized transfer of funds from one account to another without the account holder's knowledge or consent. Criminals use stolen or fake identities to gain access to bank accounts and transfer funds.

Whitelisting is a security measure used to protect computer systems and networks from malicious software and other unauthorized access. It is used to allow only approved programs, websites, and other digital resources to be accessed or used.

Whaling is the centuries-old practice of hunting whales for their meat, oil, and other products. It is used for subsistence hunting and commercial purposes, and is regulated by international agreements.

Vulnerability scanning is a process used to identify and assess security vulnerabilities in computer systems, networks, and applications. Automated tools are used to scan for known vulnerabilities and generate a report of the findings.

Vulnerability management tools are software applications that help organizations identify, assess, and remediate security vulnerabilities in their IT systems. These tools can be used to detect and address potential security risks, as well as to monitor and track the progress of remediation efforts.

A Virtual Private Network (VPN) is a secure connection between two or more devices that allows for private data exchange over a public network. It is used to protect data and provide access to restricted networks and websites, as well as bypass geographic restrictions.

Vishing is a type of social engineering attack that uses voice calls or voice messages to deceive victims into providing sensitive information. It is used to gain access to bank accounts, credit card numbers, and other confidential information, as well as to spread malware or ransomware.

Learn about User Accounra, which are unique profiles used to access computer systems, websites, and applications. User accounts store personal information and preferences, and track user activity. Examples of usage are provided.

UEBA is a type of security analytics that uses machine learning and data science to detect anomalies in user and entity behavior. It can be used to detect malicious activities, insider threats, and anomalous behavior in user accounts.

Two-Factor Authentication is an additional layer of security that requires two forms of authentication when logging into an account. It is used by banks, social media sites, and other services to increase security and protect online accounts.

Threat Management is the process of identifying, assessing, and responding to potential threats to an organization or individual. It involves the use of various strategies and techniques to mitigate risks and protect physical assets, data, and systems.

Trojan Horse is a type of malicious software disguised as legitimate software, used to gain access to a computer system without the user's knowledge or consent. Examples include malicious attachments and malicious websites.

Threat hunting is a proactive approach to cybersecurity that involves actively searching for malicious activity or indicators of compromise (IOCs) on a network or system. It is used to detect malicious actors, malicious code, and suspicious activity before it can cause damage.

Threat Actors are individuals or groups who engage in malicious activities such as cyber-attacks, espionage, or sabotage. They use a variety of techniques, including malware, phishing, and social engineering, to achieve their goals.

Threat & Vulnerability Management (TVM) is a comprehensive approach to identifying, assessing, and mitigating security risks. It involves the identification of potential threats and vulnerabilities, the assessment of their impact, and the implementation of measures to reduce or eliminate the risks.

A Supply Chain Attack is a malicious cyberattack that targets the supply chain of an organization to gain access to sensitive data, disrupt operations, or cause financial losses. Examples include malware, phishing, and social engineering.

Strategic Advisory is a type of consulting service that helps organizations develop and implement strategies to achieve their goals. It involves providing advice and guidance on market analysis, competitive positioning, financial planning, and more.

Static Application Security Testing (SAST) is a type of software security testing that analyzes source code for coding errors, insecure coding practices, and potential security flaws. Automated tools are used to detect issues such as buffer overflows, SQL injection, and hard-coded passwords.

Spyware is a type of malicious software that is installed on a computer or device without the user's knowledge or consent. It is used to collect personal information, monitor activity, display ads, and redirect users to malicious websites.

Spoofing is a type of cyber attack in which an attacker disguises themselves as a legitimate user to gain access to sensitive information, disrupt services, or launch further attacks. Examples of spoofing include creating false identities, manipulating data, and sending malicious emails.

Spear Phishing is a type of cyber attack that uses social engineering techniques to target a specific individual or organization. Attackers typically impersonate a trusted source to gain access to sensitive data or systems. Examples include malicious links in emails and websites designed to steal credentials.

Session Hijacking is a type of cyber attack in which an attacker steals a user's session ID to gain access to sensitive information and restricted areas of a website or network. Examples include gaining access to a user's bank account or launching other types of attacks.

Social Engineering is a type of attack that uses psychological manipulation techniques to deceive victims into providing confidential information or access to resources. Examples include phishing emails, tailgating, and shoulder surfing. Attackers can use social engineering to steal money, data, or other valuable assets.

SIEM is a type of security management system used to detect and respond to cyber threats, such as malicious activity, data breaches, and other security incidents. It can be used to monitor network traffic, generate reports and alerts, and investigate security incidents.

Shadow IT is the use of unauthorized IT systems, applications, and services within an organization, often without the knowledge or approval of the organization's IT department. Examples include bypassing IT policies, accessing services not available through the organization's IT infrastructure, and gaining access to sensitive data.

A security policy is a set of rules and regulations that govern how an organization or individual handles data and information security. It outlines measures taken to protect data from unauthorized access, modification, or destruction, as well as procedures for responding to security incidents and breaches.

Establish a Security Perimeter to protect your organization's internal network from external threats. Combinations of hardware, software, and policies are used to prevent unauthorized access and common examples include firewalls, intrusion detection systems, and virtual private networks (VPNs).

Security Orchestration Platforms are software solutions that enable organizations to automate and streamline their security operations, including incident response, threat intelligence, and security analytics. Quickly respond to security incidents, identify threats, and take proactive measures to protect networks.

Security Orchestration Tools are software applications that enable organizations to automate and streamline their security operations. These tools allow organizations to integrate multiple security tools and processes into a single platform, allowing for more efficient and effective security operations.

Learn about Security Operations Centers (SOCs), a centralized unit within an organization responsible for monitoring, detecting, analyzing, and responding to security threats and incidents. SOCs are staffed by security professionals and equipped with tools and technologies to detect and respond to security threats.

Security control is a measure taken to protect systems, networks, and data from unauthorized access, malicious attacks, and other security risks. Examples of security controls include firewalls, antivirus software, encryption, authentication, and access control.

Security operations is the process of managing and monitoring the security of an organization's systems, networks, and data. It involves the implementation of security policies, procedures, and technologies to protect the organization's assets from unauthorized access, malicious attacks, and other security threats.

Security Information and Event Management (SIEM) is a type of security software used to detect and respond to security threats, such as malicious activity, unauthorized access, and data breaches. It can also generate reports and analyze trends to improve security posture.

Secure Shell (SSH) is a network protocol used to securely transfer data between two computers over an unsecured network. It is commonly used to access remote servers, transfer files, and manage network services, and is a secure alternative to the traditional Telnet protocol.

Risk assessment is the process of identifying, analyzing, and evaluating potential risks to an organization, project, or individual. It is used in a variety of contexts, such as business, finance, healthcare, and engineering, to identify and prioritize risks and develop strategies to mitigate them.

Red Team vs. Blue Team is a type of security assessment that involves two teams of security professionals working together to identify and address potential security vulnerabilities. It is often used by organizations to test the effectiveness of their security measures and identify areas that need improvement.

Ransomware is a type of malicious software that blocks access to a computer system or data until a ransom is paid. It is typically spread through phishing emails, malicious websites, or other online sources, resulting in the loss of important data and disruption of business operations.

Ransomware-as-a-Service (RaaS) is a type of cybercrime in which criminals offer ransomware as a service to other criminals. It is a lucrative business for criminals, as it allows them to monetize their skills and resources without having to invest in the development of the ransomware themselves.

A Proxy server is a computer or network service that acts as an intermediary between a client and a server. It can be used to improve network performance, filter content, and protect against malicious activity.

Learn about privilege escalation, a type of attack that allows an attacker to gain access to more resources or privileges than they are normally allowed. Examples and usage of privilege escalation are discussed, such as gaining access to sensitive data or other user accounts.

Platform-as-a-Service (PaaS) is a cloud computing model that provides users with a platform to develop, run, and manage applications without the need for infrastructure or hardware. Popular PaaS solutions include AWS, Azure, Google App Engine, and Heroku.

Phishing is a type of cyber attack that uses deceptive tactics to obtain sensitive information from unsuspecting victims. It is typically carried out through email, text messages, or malicious websites. Examples of phishing attacks include malicious websites asking for credit card information and text messages asking for bank account details.

Penetration Testing is a security testing technique used to evaluate the security of a computer system or network by simulating an attack to identify potential vulnerabilities and security weaknesses. It is typically performed by a security professional or team.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to protect cardholder data and reduce fraud. Organizations must comply with the PCI DSS to ensure the secure processing, storage, and transmission of credit card information.

Password cracking is the process of attempting to gain access to a system or account by guessing or recovering passwords. It is used by malicious actors to gain access to sensitive information or systems, and by security professionals to test the strength of passwords and identify weak passwords.

Learn about passwords, a secret string of characters used to authenticate a user's identity and gain access to a system, application, or website. Understand how passwords are used to protect sensitive data and examples of how to create a secure password.

Network Security Assessment is a process of evaluating the security of a computer network, identifying potential security risks, and recommending measures to improve the security. Qualified security professionals review the network architecture, security policies, and security controls to ensure the network's security posture.

The NIST Cybersecurity Framework is a set of guidelines and best practices developed by the National Institute of Standards and Technology (NIST) to help organizations protect their information systems and data from cyber threats. It provides a comprehensive approach to managing cybersecurity risk, organized into five core functions.

Multi-Factor Authentication (MFA) is an authentication method that requires more than one form of authentication to verify a user's identity. It is used to protect against unauthorized access to sensitive data and systems, and is often used in combination with other security measures. Examples include entering a username and password, and then providing a one-time code or scanning a fingerprint.

Network Security is the practice of protecting networks, systems, and programs from digital attacks. It involves authorization of access, prevention and detection of unauthorized access, and the use of firewalls, antivirus software, intrusion detection systems, and encryption.

Network Penetration Testing is a security testing technique used to identify vulnerabilities in a network or system. It is a simulated attack to identify potential weaknesses that could be exploited by malicious actors and is used by organizations to proactively address potential threats.

Network firewalls are a combination of hardware and software used to protect private networks from malicious or unauthorized access. Firewalls can be configured to allow or deny certain types of traffic, and can be used to detect and prevent malicious activities.

Managed Detection and Response (MDR) is a security service that provides organizations with the ability to detect, investigate, and respond to cyber threats. MDR services are used to supplement existing security infrastructure and provide an additional layer of protection against cyber threats.

MTTD and MTTR are metrics used to measure the performance of a system or process in terms of how quickly it can detect and repair any issues that arise. They are used to measure effectiveness, compare performance, and track performance over time.

Malicious apps are applications designed to harm or exploit a user's device or data. They can be found in both official and third-party app stores and can be used to steal personal information, spread malware, display unwanted ads, and hijack a user's device.

Malware is a type of malicious software designed to damage, disrupt, or gain unauthorized access to a computer system. It can take many forms, including viruses, worms, Trojans, ransomware, spyware, and adware, and can be spread through email attachments, downloads, or malicious websites.

Macro viruses are a type of computer virus written in the same macro language used for software programs. They are spread through documents, applications, email attachments, and file sharing. Examples include macros that automatically format text in Microsoft Word documents.

Keyboard loggers are a type of surveillance software used to monitor and record every keystroke typed on a computer's keyboard. It is often used by Hackers, employers, and parents to track passwords, emails, and other sensitive information.

ISO 27001 is an international standard for information security management systems (ISMS) that provides a framework for organizations to identify, assess, and manage risks associated with their information systems. It is used to protect information assets and comply with applicable laws and regulations.

An Intrusion Prevention System (IPS) is a type of security system that monitors and detects malicious activity on a network. It is designed to detect and prevent malicious activity before it can cause damage or disruption.

Intrusion Detection System (IDS) is a type of security software that monitors a network or system for malicious activity or policy violations. It is designed to detect and respond to unauthorized access, misuse, and other malicious activities.

Internal Penetration Testing is a security assessment technique used to identify vulnerabilities and weaknesses in an organization's internal network. It is used to identify potential security risks and misconfigurations, as well as weaknesses in authentication and authorization systems.

Initial Access Brokers are cybercriminals who specialize in providing access to compromised systems and networks. They are typically hired by other cybercriminals to gain access to a target system or network for malicious activities such as data theft and ransomware attacks.

IaaS is a cloud computing model that provides users with access to virtualized computing resources such as servers, storage, and networking. It is used to host applications and services, and can be scaled up or down as needed. It is a cost-effective solution for businesses that need to quickly deploy and manage their IT infrastructure.

Incident Response is the process of responding to and managing the aftermath of a security breach or cyberattack. It involves steps to contain the damage, investigate the incident, and restore affected systems and data. It is also used to identify the root cause and prevent similar incidents from occurring.

Identity Theft is a type of fraud that involves stealing someone's personal information to commit financial crimes. It can have serious consequences for the victim and can be difficult to detect.

Learn about Identification, the process of recognizing or establishing the identity of a person, object, or concept. Examples include verifying a person's identity, confirming the authenticity of a document, and assigning a unique identifier to an object or concept.

Hypervisor (VMM) is a software program that enables multiple operating systems to run on the same physical computer. It is commonly used in cloud computing and virtual desktop infrastructure (VDI) solutions for greater efficiency and scalability.

HIPAA is a federal law that protects the privacy of individuals' health information and sets standards for its use and disclosure. Covered entities must comply with HIPAA regulations, including implementing safeguards to protect PHI.

FISMA is a US federal law that requires federal agencies to develop and implement an information security program to protect their information and information systems from threats. Examples include the Department of Defense's Risk Management Framework.

Darknet is a private network used to share data and information between users, often for activities that are not legal or considered unethical. It is used to access websites and services not available on the public internet, and to host websites not accessible through the public internet.

A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic. It is commonly used to target websites, online services, and networks.

A Hacker is an individual who uses their technical knowledge to gain unauthorized access to computer systems, networks, or data. They may use their skills to gain access to confidential information, disrupt services, or cause damage to systems, or to create new software or applications. Ethical Hackers may use their skills to help organizations identify and fix security vulnerabilities.

Gap analysis is a process used to compare the current state of an organization or system to its desired future state. It is used to identify areas of improvement and develop strategies to bridge the gaps between the two states.

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that gives individuals more control over their personal data and requires organizations to comply with higher standards of accountability. It applies to any organization that processes the personal data of EU citizens, regardless of location.

Firewalls are network security systems used to protect private networks from malicious activity and unauthorized access. They can be implemented as hardware, software, or a combination of both, and can be configured to allow or deny access based on source, destination, type of traffic, or application.

Ethical Hacking Tools are software and hardware tools used to identify and exploit weaknesses in computer systems, networks, and applications. These tools can be used to test the security of a system, simulate attacks, detect malicious activity, and provide detailed reports on the security of a system.

Endpoints are nodes in a network used for data exchange between two or more devices. They are used in computer networks, the Internet, and distributed systems, such as cloud computing.

Endpoint Detection and Response (EDR) is a security technology that enables organizations to detect, investigate, and respond to malicious activity on their endpoints. EDR solutions use machine learning, behavioral analytics, and threat intelligence to detect and respond to malicious activity.

Learn about Encryption, a process used to protect sensitive information from unauthorized access and ensure data is not modified or corrupted during transmission. Examples include online banking, secure email, and secure file sharing.

DMZ is a network security architecture that creates a separate, isolated network segment between an organization's internal network and the Internet. It is used to protect an organization's internal network from malicious traffic and to host public-facing services.

A Declaration of Conformity is a legally binding document issued by the manufacturer or importer of a product to demonstrate that it meets the relevant safety, health, and environmental protection standards. It is an important part of the CE marking process for products sold in the EU.

Data Loss Prevention (DLP) is a security strategy used to protect sensitive data from unauthorized access, use, or disclosure. DLP solutions can be used to detect and block the unauthorized transfer of data, as well as to monitor and control the transfer of data over the internet, email, and other communication channels.

Data Breaches are incidents in which sensitive, confidential, or protected data is accessed, viewed, stolen, or used without authorization. Examples include hacking, phishing, malware, and physical theft, which can lead to identity theft, financial losses, or reputational damage.

The Cyber Maturity Model Certification (CMMC) is a certification program developed by the U.S. Department of Defense (DoD) to ensure contractors and subcontractors handling sensitive information have the necessary security controls in place. Organizations must be certified at the appropriate level to be eligible for DoD contracts.

Cyber Threat Intelligence (CTI) is a proactive approach to cybersecurity that helps organizations anticipate and prepare for potential threats. It involves gathering data from various sources, analyzing patterns and trends, and interpreting the data to determine the potential impact of a threat.

Cyber Attacks are malicious activities that target computer systems, networks, or personal devices. Common types of cyber attacks include phishing, malware, ransomware, DDoS attacks, and SQL injection.

Cryptocurrency is a digital or virtual currency secured by cryptography and decentralized, used as a medium of exchange and an investment. Examples include Bitcoin, Ethereum, Litecoin, and Ripple.

Cryptojacking is a type of cyber attack in which a malicious actor hijacks a computer or other device to secretly mine cryptocurrency without the owner's knowledge or consent. Attackers use scripts or programs to hijack the device's processing power and collect the mined cryptocurrency for their own benefit.

COBIT is a framework for IT governance, risk management, and compliance that provides best practices and processes for managing IT resources. It is used by organizations of all sizes to ensure IT investments are managed effectively and efficiently, and to align IT objectives with business objectives.

Cloud Security is the practice of protecting data, applications, and infrastructure associated with cloud computing. It involves a set of policies, technologies, and controls to protect data from unauthorized access, malicious attacks, and data leakage.

CIS Controls are a set of best practices developed by the Center for Internet Security (CIS) to help organizations protect their networks and data from cyber threats. Organizations can use the CIS Controls to reduce their risk of a cyber attack, such as setting strong passwords, disabling unnecessary services, and using access control measures.

Attack Surface is a measure of the potential vulnerability of a system or network to malicious attacks. It is an important concept in cybersecurity, as it helps to identify and mitigate potential risks by reducing the number of components, simplifying the system architecture, and limiting the number of entry points.

Cloud Computing is a type of computing that uses a network of remote servers hosted on the Internet to store, manage, and process data. It is used for a variety of purposes, from storing and sharing data to running applications and cloud gaming.

CIS RAM is a comprehensive approach to managing computer security incidents, including the identification, containment, investigation, and resolution of incidents, as well as the development of policies and procedures to prevent future incidents.

BYOD (Bring Your Own Device) is a policy that allows employees to use their own personal devices for work purposes. It is becoming increasingly popular in the workplace and should include security measures to protect company data and networks.

Advanced Persistent Threats (APTs) are long-term, sophisticated cyber attacks conducted by highly skilled attackers to steal intellectual property, disrupt operations, or gain access to confidential information. Examples include the 2017 North Korean attack on Sony Pictures Entertainment.