Security Glossary
Definitions of key cybersecurity terms used in this guide.
- MFA (Multi-Factor Authentication)
- An authentication method requiring the user to provide two or more distinct verification factors (e.g., something you know like a password, something you have like a security key or authenticator app code, something you are like a fingerprint) to gain access to a resource. Significantly increases account security compared to passwords alone.
- Zero Trust
- A security model based on the principle of "never trust, always verify." It requires strict identity verification for every person and device attempting to access resources on a network, regardless of whether they are inside or outside the network perimeter. Access is granted on a least-privilege basis.
- End-to-End Encryption (E2EE)
- A system of secure communication where data is encrypted on the sender's device and decrypted only on the intended recipient's device. This prevents intermediaries, including the service provider itself, from reading the content of the communication.
- Phishing
- A type of cyberattack where attackers attempt to trick individuals into revealing sensitive information (like usernames, passwords, credit card details, or SSNs) by impersonating a legitimate entity or person in an email, instant message, or other communication channel.
- Vishing (Voice Phishing)
- Phishing attempts conducted over phone calls, often using social engineering or AI voice cloning to impersonate legitimate organizations or individuals to extract sensitive information.
- Smishing (SMS Phishing)
- Phishing attempts conducted via SMS text messages, often containing malicious links or urgent requests for information.
- SIM Swapping (SIM Hijacking)
- An identity theft technique where an attacker fraudulently transfers a victim's phone number to a SIM card controlled by the attacker, allowing them to intercept calls, texts, and SMS-based authentication codes.
- Dark Web
- A part of the internet that isn't indexed by standard search engines and requires specific software (like Tor Browser) to access. While used for legitimate privacy purposes, it's also known for hosting illicit marketplaces and forums where stolen data is often traded.
- VPN (Virtual Private Network)
- A service that creates a secure, encrypted connection (a "tunnel") over a public network like the internet. It masks your IP address and encrypts your traffic, enhancing privacy and security, especially on untrusted networks like public Wi-Fi.
- Ransomware
- A type of malicious software (malware) that encrypts a victim's files or locks their system, making them inaccessible. The attackers then demand a ransom payment (often in cryptocurrency) in exchange for the decryption key or unlocking the system. Modern ransomware often involves data exfiltration (theft) as well (double extortion).
- Social Engineering
- The art of manipulating people into performing actions or divulging confidential information. It relies on psychological manipulation rather than technical hacking techniques. Phishing, pretexting, baiting, and tailgating are all forms of social engineering.
- Penetration Testing (Pen Test)
- An authorized, simulated cyberattack performed on a computer system, network, or web application to evaluate its security. Pen testers use the same tools and techniques as malicious attackers to find and exploit vulnerabilities, providing organizations with insights to improve their defenses.
- Full-Disk Encryption (FDE)
- A security measure that encrypts the entire contents of a hard drive or storage volume at the hardware or software level. This protects data at rest, making it unreadable if the physical device is lost or stolen, unless the correct decryption key or password is provided (e.g., BitLocker on Windows, FileVault on macOS).
- Malware
- Short for "malicious software." A broad term encompassing any software intentionally designed to cause damage to a computer, server, client, or computer network. Examples include viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware.
- Firewall
- A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between a trusted internal network and untrusted external networks (like the internet).
- IP Address (Internet Protocol Address)
- A unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. It serves two main functions: host or network interface identification and location addressing.
- HTTPS (Hypertext Transfer Protocol Secure)
- The secure version of HTTP, the protocol over which data is sent between your browser and the website you are connected to. The 'S' stands for 'Secure', meaning communication is encrypted using TLS/SSL, protecting against eavesdropping and tampering.
- IoT (Internet of Things)
- The network of physical devices, vehicles, home appliances, and other items embedded with electronics, software, sensors, actuators, and connectivity which enables these objects to connect and exchange data.