IT & Cybersecurity Glossary | Key Terms Explained

PAM (Privileged Access Management)

Systems to secure, control, and monitor access to an organization's critical information and resources

The Simple Definition:

Systems that protect and monitor accounts with high-level access to sensitive systems

PCI DSS

Payment Card Industry Data Security Standard, a set of security standards for organizations handling credit card information

The Simple Definition:

Rules that businesses must follow to safely process credit card payments

PII (Personally Identifiable Information)

Information that can be used to identify, contact, or locate a single person

The Simple Definition:

Personal data that can identify an individual, like name, address, or social security number

PaaS (Platform as a Service)

A category of cloud computing services that provides a platform allowing customers to develop, run, and manage applications

The Simple Definition:

A cloud service that provides everything you need to build and deploy applications without managing the infrastructure

Patch

A software update designed to address security vulnerabilities and other bugs

The Simple Definition:

A fix for a security problem or bug in software

Patching

The process of updating software to fix or improve it, often to address security vulnerabilities

The Simple Definition:

Updating software with fixes for security holes or bugs

Penetration Testing

An authorized simulated attack on a computer system to evaluate the security of the system

The Simple Definition:

A controlled hacking attempt to find vulnerabilities in your systems before real attackers do

Phishing

A cybercrime in which a target is contacted by email, telephone, or text message by someone posing as a legitimate institution

The Simple Definition:

Fake emails or messages that trick you into revealing personal information or clicking dangerous links

Private Cloud

Cloud infrastructure operated solely for a single organization

The Simple Definition:

A cloud system used by only one organization for greater control and security

Public Cloud

Cloud services offered to multiple customers by a cloud provider

The Simple Definition:

Cloud services available to anyone who wants to use or purchase them

Quantum Cryptography

The science of exploiting quantum mechanical properties to perform cryptographic tasks

The Simple Definition:

Encryption technology that uses the principles of quantum physics to create theoretically unbreakable codes

RBAC (Role-Based Access Control)

A method of regulating access to computer or network resources based on the roles of individual users within an organization

The Simple Definition:

A security approach that restricts system access based on a user's role in an organization

RDP (Remote Desktop Protocol)

A proprietary protocol developed by Microsoft that allows users to remotely connect to another computer

The Simple Definition:

Technology that lets you control a computer from a different location

Ransomware

A type of malicious software that blocks access to a computer system until a sum of money is paid

The Simple Definition:

Malicious software that locks your files until you pay a ransom

Recovery Point Objective (RPO)

The maximum targeted period in which data might be lost due to a disaster

The Simple Definition:

How much data your business can afford to lose in an incident, measured in time

Recovery Time Objective (RTO)

The targeted duration of time within which a business process must be restored after a disaster

The Simple Definition:

How quickly you need to restore your systems after a disaster

Red Team

A group of security professionals authorized to test the effectiveness of a security program by emulating the tools and techniques of likely attackers

The Simple Definition:

A team of ethical hackers who attack your systems like real hackers would to test your defenses

Risk Assessment

The identification, evaluation, and estimation of the levels of risks involved in a situation

The Simple Definition:

The process of identifying potential threats and vulnerabilities to determine how to protect your systems

Rootkit

A collection of computer software designed to enable unauthorized access to areas of the software not intended for anyone other than the system administrator

The Simple Definition:

Malicious software that gives attackers deep-level, hidden access to a computer

Router

A networking device that forwards data packets between computer networks

The Simple Definition:

The device that directs traffic between your network and the internet

S/MIME (Secure/Multipurpose Internet Mail Extensions)

A standard for public key encryption and signing of MIME data

The Simple Definition:

A method for sending encrypted and digitally signed emails

SCADA (Supervisory Control and Data Acquisition)

A system of software and hardware elements that allows industrial organizations to control industrial processes

The Simple Definition:

Control systems used to monitor and manage industrial equipment and infrastructure

SIEM (Security Information and Event Management)

An approach to security management that combines SIM (security information management) and SEM (security event management)

The Simple Definition:

A system that collects and analyzes security data from across your network to detect threats

SQL Injection

A code injection technique used to attack data-driven applications

The Simple Definition:

A hacking technique where attackers insert malicious code into a website's database

SSH (Secure Shell)

A cryptographic network protocol for operating network services securely over an unsecured network

The Simple Definition:

A secure way to access and manage remote computers

SSL/TLS (Secure Sockets Layer/Transport Layer Security)

Cryptographic protocols designed to provide secure communication over a computer network

The Simple Definition:

Security technology that creates an encrypted connection between a web server and a browser

SaaS (Software as a Service)

A software licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted

The Simple Definition:

Software you access through the internet instead of installing on your computer

Secure Coding

The practice of developing computer software in a way that guards against the accidental introduction of security vulnerabilities

The Simple Definition:

Writing software with security in mind from the start to prevent vulnerabilities

Security Audit

A systematic evaluation of the security of a company's information system

The Simple Definition:

A thorough check of your security measures to identify weaknesses

Server

A computer program or device that provides functionality for other programs or devices, called clients

The Simple Definition:

A powerful computer that provides resources, data, or services to other computers over a network

Shadow IT

Hardware or software within an enterprise that is not supported by the organization's central IT department

The Simple Definition:

Technology used by employees without official IT department approval or knowledge

Social Engineering

Psychological manipulation of people into divulging confidential information

The Simple Definition:

Tricks that manipulate people into giving away sensitive information or access

Spam

Unsolicited messages sent over the Internet, typically to a large number of users, for advertising, phishing, or malware spreading

The Simple Definition:

Unwanted emails or messages, usually sent in bulk

Spyware

Software that enables a user to obtain covert information about another's computer activities

The Simple Definition:

Malicious software that secretly gathers information about you without your knowledge

Supply Chain Attack

An attack that targets less-secure elements in the supply network

The Simple Definition:

An attack that targets a business by exploiting vulnerabilities in their suppliers or vendors

Threat

A potential danger that might exploit a vulnerability to breach security

The Simple Definition:

A person, event, or circumstance that could harm your systems

Trojan Horse

A type of malware that disguises itself as legitimate software

The Simple Definition:

Malicious software disguised as something useful or harmless

Two-Factor Authentication (2FA)

A security process in which users provide two different authentication factors

The Simple Definition:

A security method requiring two different ways to prove your identity

URL (Uniform Resource Locator)

A reference to a web resource that specifies its location on a computer network

The Simple Definition:

The address of a website or webpage

VPN (Virtual Private Network)

A service that creates a safe, encrypted connection over a less secure network

The Simple Definition:

A secure tunnel for your internet traffic that protects your privacy and can make it appear you're connecting from a different location

VoIP (Voice over Internet Protocol)

A technology that allows voice calls to be made over the internet

The Simple Definition:

Phone service that works over your internet connection instead of traditional phone lines

Vulnerability

A weakness in a system that can be exploited by a cyber attacker

The Simple Definition:

A weakness or flaw in your systems that could be exploited by attackers

WAF (Web Application Firewall)

A firewall that filters, monitors, and blocks HTTP traffic to and from a web application

The Simple Definition:

A security system that specifically protects web applications by filtering and monitoring HTTP traffic

Whaling

A type of phishing attack that targets high-profile employees such as C-level executives

The Simple Definition:

Phishing attacks specifically targeting high-level executives or other important people in an organization

White Hat Hacker

A computer security specialist who breaks into protected systems to test and assess their security

The Simple Definition:

An ethical hacker who helps organizations find and fix security problems

Wi-Fi

A wireless networking technology that allows devices to interface with the internet

The Simple Definition:

Wireless technology that connects your devices to the internet without cables

Worm

A standalone malware computer program that replicates itself to spread to other computers

The Simple Definition:

Malicious software that spreads by itself from computer to computer

XSS (Cross-Site Scripting)

A type of security vulnerability found in web applications

The Simple Definition:

A type of attack where malicious scripts are injected into trusted websites

Zero Trust Security

A security model that requires strict identity verification for every person and device trying to access resources on a private network

The Simple Definition:

A security approach that treats everyone as untrusted, requiring verification for anyone trying to access your systems, even those already inside your network

Zero-Day Exploit

An attack that exploits a previously unknown vulnerability in software or hardware

The Simple Definition:

An attack that targets a security hole unknown to the software creator and before they can fix it

Zombie

A computer connected to the internet that has been compromised by a hacker and can be used to perform malicious tasks

The Simple Definition:

An infected computer controlled remotely by hackers without the owner's knowledge