Cybersecurity Glossary — Key Terms and Definitions

Advanced Persistent Threat (APT): A prolonged and targeted cyber attack where an intruder gains access and remains undetected for an extended period.

Backdoor: A method of bypassing normal authentication to gain unauthorized access to a system or network.

Brute Force Attack: An attack trying all possible combinations of passwords or encryption keys until the correct one is found.

Cross-Site Scripting (XSS): An attack injecting malicious scripts into web pages viewed by other users.

DDoS (Distributed Denial of Service): An attack using multiple compromised systems to flood a target with traffic, overwhelming it.

Drive-by Download: Malware downloaded automatically when visiting a compromised or malicious website.

Exploit: A piece of software, data, or code that takes advantage of a vulnerability to cause unintended behavior.

Keylogger: Software or hardware that records keystrokes to capture passwords, credit card numbers, and other sensitive data.

Man-in-the-Middle (MitM) Attack: An attack where an attacker secretly intercepts and possibly alters communication between two parties.

Malware: Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems. Types include viruses, worms, trojans, ransomware.

Phishing: A social engineering attack using fraudulent emails or websites to trick users into revealing sensitive information.

Ransomware: Malware that encrypts a victim’s files and demands payment (ransom) for the decryption key.

Rootkit: A collection of software tools enabling unauthorized access to a computer while hiding its presence.

Social Engineering: Manipulating people into performing actions or divulging confidential information through psychological manipulation.

SQL Injection: An attack inserting malicious SQL code into database queries through web application inputs.

Supply Chain Attack: An attack targeting the software supply chain, compromising updates or dependencies.

Trojan Horse: Malicious software disguised as legitimate software to trick users into installing it.

Zero-Day Exploit: An attack exploiting a previously unknown vulnerability before developers can issue a patch.

Zero-Day Vulnerability: A software vulnerability unknown to the vendor, with no patch available.

Air Gap: A security measure isolating a computer or network from unsecured networks, including the internet.

Antivirus Software: Programs designed to detect, prevent, and remove malware from computer systems.

Backup: A copy of data stored separately to restore in case of data loss or corruption. Types: full, incremental, differential.

Bug Bounty: A program offering rewards to individuals who discover and report software vulnerabilities.

Defense in Depth: A security strategy using multiple layers of defense to protect information and systems.

Endpoint Security: Protecting individual devices (endpoints) connecting to a network from cyber threats.

Firewall: A network security system monitoring and controlling incoming and outgoing traffic based on security rules.

Honeypot: A decoy system designed to attract and trap attackers, studying their methods and intentions.

Intrusion Detection System (IDS): Monitors network traffic for suspicious activity and alerts administrators.

Intrusion Prevention System (IPS): Monitors network traffic and actively blocks detected threats.

Least Privilege: The principle that users should have only the minimum access necessary to perform their job functions.

Penetration Testing: Authorized simulated attacks to evaluate the security of a system and identify vulnerabilities.

Patch Management: The process of acquiring, testing, and installing patches (updates) to fix vulnerabilities.

Security Audit: A systematic evaluation of an organization’s security policies, procedures, and controls.

Security Information and Event Management (SIEM): Software aggregating and analyzing security event data from across an organization.

Vulnerability Assessment: The process of identifying, quantifying, and prioritizing vulnerabilities in a system.

Web Application Firewall (WAF): A firewall protecting web applications by filtering and monitoring HTTP traffic.

Asymmetric Encryption: Encryption using a pair of keys (public and private). Data encrypted with one key can only be decrypted with the other. Examples: RSA, ECC.

Certificate Authority (CA): A trusted entity that issues digital certificates for TLS/SSL encryption.

Ciphertext: The encrypted form of plaintext, unreadable without the decryption key.

Cryptographic Hash Function: A function that converts input data into a fixed-size hash value. Used for integrity verification. Examples: SHA-256, MD5.

Digital Certificate: An electronic document binding a public key to an identity, verified by a Certificate Authority.

Digital Signature: A mathematical scheme verifying the authenticity and integrity of a message or document.

Encryption: The process of converting plaintext into ciphertext to prevent unauthorized access.

Hash: A fixed-size output of a cryptographic hash function. Used to verify data integrity.

Key Exchange: A method of securely sharing cryptographic keys between parties. Example: Diffie-Hellman.

Key Management: The process of generating, storing, distributing, and revoking cryptographic keys.

Plaintext: Readable data before encryption or after decryption. The original, unencrypted form.

Public Key: The publicly shared key in asymmetric encryption, used to encrypt data or verify signatures.

Private Key: The secret key in asymmetric encryption, used to decrypt data or create signatures.

RSA: A widely used asymmetric encryption algorithm based on the difficulty of factoring large numbers.

Symmetric Encryption: Encryption using a single shared key for both encryption and decryption. Examples: AES, DES.

TLS (Transport Layer Security): A cryptographic protocol providing secure communication over a network. Used in HTTPS.

Authentication: The process of verifying the identity of a user, device, or system.

Authorization: Determining what an authenticated user is allowed to do or access.

Biometric Authentication: Authentication based on unique physical characteristics (fingerprints, retina, face).

Multi-Factor Authentication (MFA): Authentication requiring two or more independent credentials (something you know, have, are).

OAuth: An open standard for token-based authentication and authorization.

Password Hashing: Storing passwords as hash values rather than plaintext, adding salt for security.

Password Policy: Rules governing password creation and management (length, complexity, rotation).

PAM (Privileged Access Management): Managing and auditing privileged accounts and their access.

RBAC (Role-Based Access Control): Access control based on user roles within an organization.

Single Sign-On (SSO): An authentication scheme allowing users to log in once and access multiple applications.

Token: A digital object representing identity or authorization. Used in authentication systems.

Anonymization: Removing personally identifiable information from data to protect privacy.

Data Breach: An incident where sensitive data is accessed, disclosed, or stolen by unauthorized parties.

Data Classification: Categorizing data based on sensitivity and the impact of unauthorized disclosure.

Data Loss Prevention (DLP): Software and processes preventing unauthorized data exfiltration.

Data Masking: Hiding sensitive data by replacing it with fictional but realistic data.

Encryption at Rest: Encrypting data stored on disk or in databases.

Encryption in Transit: Encrypting data as it moves across networks.

GDPR (General Data Protection Regulation): EU regulation governing data protection and privacy.

PII (Personally Identifiable Information): Data that can identify an individual (name, SSN, email, etc.).

Right to Be Forgotten: GDPR provision allowing individuals to request deletion of their personal data.

Tokenization: Replacing sensitive data with non-sensitive tokens that have no exploitable value.

Cybersecurity: The practice of protecting systems, networks, and data from digital attacks.

Incident Response: The organized approach to addressing and managing security breaches.

Log Analysis: The process of reviewing computer-generated records to identify security events.

Malware Analysis: The process of determining the functionality, origin, and impact of malware.

Red Team: A group simulating attacks to test an organization’s defenses.

Blue Team: The team responsible for maintaining internal network defenses.

Purple Team: A collaborative approach combining red and blue team activities.

SOC (Security Operations Center): A centralized unit monitoring and responding to security incidents.

Threat Intelligence: Information about current and potential cyber threats.

Vulnerability: A weakness in a system that can be exploited by a threat.

Zero Trust: A security model requiring strict identity verification for every person and device.

CIA Triad: The core principles of information security: Confidentiality, Integrity, Availability.

Compliance: Adhering to laws, regulations, and standards governing data protection and security.

Data Governance: The overall management of data availability, usability, integrity, and security.

ISO 27001: An international standard for information security management systems (ISMS).

NIST Framework: A framework developed by the National Institute of Standards and Technology for improving cybersecurity.

PCI DSS: Payment Card Industry Data Security Standard for organizations handling credit card data.

Risk Assessment: The process of identifying, analyzing, and evaluating risks to information assets.

Risk Management: The process of identifying, assessing, and controlling threats to an organization.

Security Policy: A document outlining an organization’s security rules, procedures, and guidelines.

• Cybersecurity Fundamentals
• Cryptography Guide
• Network Security Overview
• Incident Response Planning