Security & Privacy terms

93 Security & Privacy terms explained in plain English.

Acceptable Use PolicyAn Acceptable Use Policy (AUP) is a written document that sets out the permitted and prohibited uses of an organization's IT systems, networks, devices, email, and internet access.
AdwareAdware is software that shows you unwanted advertisements, often as pop-ups, banners, or redirects in your web browser.
Attestation and CertificationAttestation is a formal written declaration -- typically by management or a third-party auditor -- that specified controls or requirements have been implemented and are operating effectively.
Biometric SecurityBiometric security uses your unique physical characteristics — like your fingerprint, face, or iris — to verify your identity.
BotnetA botnet is a network of computers, phones, routers, cameras, and other internet-connected devices that have been infected with malware and are secretly controlled by an attacker, called a bot herder.
Brute-force attackA brute-force attack is an attempt to break into an account, file, or encrypted data by systematically trying many possible passwords or keys until one works.
Bug bounty programA bug bounty program is an arrangement where an organization invites independent security researchers to find and report vulnerabilities in its software, apps, or websites, and pays rewards for valid findings.
BYOD PolicyBYOD -- Bring Your Own Device -- policy is the set of rules and controls an organization puts in place to govern employee use of personally owned phones, laptops, and tablets for work purposes.
Chain of CustodyChain of custody is a chronological, unbroken record that documents every person who has accessed, handled, transferred, or modified a piece of evidence or data from the moment it was collected to its final disposition.
CIS BenchmarksCIS Benchmarks are a set of internationally recognized, consensus-developed configuration guidelines published by the Center for Internet Security for securing operating systems, cloud platforms, browsers, databases, middleware, and applications.
CIS ControlsThe CIS Controls (formerly CIS Critical Security Controls) are a set of 18 prioritized cybersecurity best practices published by the Center for Internet Security (CIS).
Compliance AuditA compliance audit is a formal, independent examination of an organization's processes, controls, documentation, and practices to determine whether they meet the requirements of a specific regulation, standard, contract, or internal policy.
Computer wormA computer worm is a type of malware that spreads on its own from one computer to another, usually by exploiting security flaws or weak passwords, without needing a person to open a file.
Credential stuffingCredential stuffing is an attack where criminals take huge lists of usernames and passwords leaked from previous data breaches and automatically try them on other websites, betting that people reused the same password.
Cross-site scripting (XSS)Cross-site scripting (XSS) is a web security flaw where an attacker gets a website to include malicious JavaScript in pages that other visitors load.
Cryptographic hashA cryptographic hash function takes any input, such as a password, file, or message, and produces a fixed-length string of characters, often called a hash or digest, that acts like a digital fingerprint.
CVE (Common Vulnerabilities and Exposures)CVE, short for Common Vulnerabilities and Exposures, is a public catalogue that gives each known security flaw a unique identifier, such as CVE-2021-44228 for the Log4Shell bug.
Cyber EssentialsCyber Essentials is a UK government-backed certification scheme designed to help organizations protect against the most common cybersecurity threats.
Cyber kill chainThe cyber kill chain is a model that describes a cyberattack as a series of stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
CybersecurityCybersecurity is the practice of protecting computers, phones, networks, and data from unauthorized access or attacks.
Dark webThe dark web is a part of the internet made up of hidden websites that can only be reached using special software, most commonly the Tor browser, which hides users' and sites' locations.
Data BreachA data breach occurs when sensitive or private information — like names, passwords, credit card numbers, or medical records — is accessed by someone who shouldn't have it.
Data ClassificationData classification is the process of organizing an organization's data into categories based on how sensitive it is and how much harm its unauthorized disclosure, modification, or loss would cause.
Data loss prevention (DLP)Data loss prevention (DLP) is a set of tools and policies that identify sensitive information, such as credit card numbers, health records, or confidential documents, and stop it from leaving an organization in unauthorized ways, such as through email, cloud uploads, USB drives, or AI chatbots.
Data Processing Agreement (DPA)A Data Processing Agreement (DPA) is a legally binding contract between a data controller (the organization that determines the purposes of data processing) and a data processor (an organization that processes data on the controller's behalf).
Data Protection Impact Assessment (DPIA)A Data Protection Impact Assessment (DPIA) is a formal privacy risk assessment required under Article 35 of the EU General Data Protection Regulation (GDPR) whenever a proposed processing activity is likely to result in a high risk to individuals' rights and freedoms.
Data RetentionData retention refers to how long a company or organization stores your data before deleting or anonymizing it.
DDoS attackA distributed denial-of-service (DDoS) attack tries to knock a website, app, or network offline by overwhelming it with traffic or requests from many sources at once, often a botnet of hijacked devices.
Defence in depthDefence in depth is a security strategy that uses several independent layers of protection, such as firewalls, multi-factor authentication, endpoint protection, network segmentation, backups, and staff training, so that if one layer fails, others still protect the organization.
ExploitAn exploit is a piece of code, a command, or a technique that takes advantage of a vulnerability in software or hardware to make it behave in unintended ways, such as letting an attacker run their own code, gain higher privileges, or steal data.
FedRAMPFedRAMP -- the Federal Risk and Authorization Management Program -- is a US government program that provides a standardized security assessment, authorization, and continuous monitoring process for cloud products and services used by federal agencies.
FERPAFERPA -- the Family Educational Rights and Privacy Act -- is a US federal law enacted in 1974 that grants parents the right to access their children's education records, request corrections, and consent before those records are disclosed to third parties.
GDPRGDPR stands for General Data Protection Regulation.
HackerA hacker is a person who uses computer skills to find ways into systems, networks, or software.
Hardware security keyA hardware security key is a small physical device, usually plugged into a USB port or tapped against a phone using NFC, that proves your identity when you sign in.
HIPAAHIPAA -- the Health Insurance Portability and Accountability Act -- is a US federal law passed in 1996 that establishes national standards for protecting individually identifiable health information, known as Protected Health Information (PHI).
HoneypotA honeypot is a decoy system, account, file, or service designed to look valuable to attackers but serve no real business purpose.
HTTPS and the Padlock IconHTTPS is the secure version of HTTP, the system your browser uses to communicate with websites.
Identity Theft (Digital)Digital identity theft occurs when someone steals your personal information — such as your name, Social Security number, or login credentials — and uses it to impersonate you online.
Immutable backupAn immutable backup is a copy of data that, once written, can't be altered, encrypted, or deleted until a set retention period expires, not even by someone with administrator access.
Incognito / Private Browsing ModeIncognito mode, also called private browsing, is a feature in web browsers that stops your browsing history, cookies, and form data from being saved on your device after you close the window.
Indicators of compromise (IOC)Indicators of compromise (IOCs) are pieces of evidence that suggest a system or network has been breached, such as a known malicious IP address, a file's unique hash, a suspicious domain name, or an unusual registry change.
InfostealerAn infostealer is a type of malware designed to quickly collect sensitive information from an infected computer, such as saved browser passwords, session cookies, autofill data, crypto wallets, and files, then send it to criminals.
ISO 27001ISO 27001 is an international standard published by the International Organization for Standardization that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
ISO 27701ISO 27701 is an international standard published in 2019 that extends ISO 27001 and ISO 27002 to include requirements and guidance for a Privacy Information Management System (PIMS).
KeyloggerA keylogger is software or hardware that secretly records keystrokes typed on a computer or phone, capturing passwords, messages, credit card numbers, and anything else.
Lateral movementLateral movement is what attackers do after breaking into one computer or account: they move sideways through the network to other systems, collecting passwords and permissions until they reach valuable targets such as file servers, backups, or domain controllers.
Living off the land (LOTL)Living off the land (LOTL) is an attack approach where hackers use legitimate tools already built into a system, such as PowerShell, Windows Management Instrumentation, or remote desktop, instead of installing their own malware.
MalwareMalware is short for malicious software — any program or file created to cause harm.
Man-in-the-middle attackA man-in-the-middle (MITM) attack, also called an adversary-in-the-middle attack, happens when an attacker secretly positions themselves between two parties, such as you and a website, so they can read or change the data passing between you.
Memory safetyMemory safety is a property of software, or the programming language it's written in, that prevents bugs such as reading past the end of a buffer or using memory after it's been freed.
MFA fatigue attackAn MFA fatigue attack, also called push bombing, happens when an attacker who already has someone's password repeatedly triggers multi-factor authentication push notifications, hoping the person will eventually tap 'approve' out of annoyance, confusion, or late-night tiredness.
MITRE ATT&CKMITRE ATT&CK, pronounced 'attack,' is a free, publicly available knowledge base that catalogues the tactics, techniques, and procedures real cyber attackers use, organized by stage of an attack, such as initial access, privilege escalation, and exfiltration.
NIST Cybersecurity FrameworkThe NIST Cybersecurity Framework (NIST CSF) is a set of standards, guidelines, and best practices published by the US National Institute of Standards and Technology to help organizations manage cybersecurity risk.
OWASP Top 10The OWASP Top 10 is a consensus-based list of the ten most critical security risks facing web applications, published by the Open Web Application Security Project -- a nonprofit foundation dedicated to improving software security.
PasskeyA passkey is a modern way to sign in that replaces passwords with a pair of cryptographic keys: a private key stays on your phone, computer, or password manager, and a public key is stored by the website.
Password ManagerA password manager is a tool that securely stores all your passwords in one encrypted vault, protected by a single master password.
Password saltingPassword salting is a security technique where a website adds a unique random value, called a salt, to each user's password before hashing it for storage.
Patch / Security UpdateA patch, or security update, is a fix released by software developers to repair bugs, close security vulnerabilities, and improve how a program works.
PCI DSSPCI DSS -- the Payment Card Industry Data Security Standard -- is a set of 12 security requirements created by the major card networks (Visa, Mastercard, Amex, Discover) to protect credit and debit card data from theft and fraud.
Penetration Test ReportA penetration test report is the formal output of a penetration test -- an authorized, simulated cyberattack conducted by security professionals (ethical hackers or pen testers) to identify vulnerabilities in an organization's systems, networks, or applications before malicious actors can exploit them.
Penetration testingPenetration testing, or pen testing, is an authorized simulated attack on an organization's systems, networks, applications, or people, carried out by security professionals to find weaknesses before criminals do.
Permissions (App Permissions)App permissions are the access rights you grant to apps on your phone, tablet, or computer.
PhishingPhishing is when someone sends a fake message — usually an email, text, or website link — designed to trick you into giving up personal information like passwords or credit card numbers.
PIPEDAPIPEDA -- the Personal Information Protection and Electronic Documents Act -- is Canada's federal privacy law for the private sector, governing how organizations engaged in commercial activities collect, use, and disclose personal information.
Privacy Impact Assessment (PIA)A Privacy Impact Assessment (PIA) is a structured process for identifying, assessing, and mitigating the privacy risks associated with a new or modified system, project, or business process that involves the collection, use, or disclosure of personal information.
Privacy PolicyA privacy policy is a document that explains what personal information a company collects about you, how they use it, who they share it with, and how they protect it.
RansomwareRansomware is a type of malicious software that encrypts your files — essentially locking them — and then demands you pay a ransom to get them back.
Ransomware-as-a-service (RaaS)Ransomware-as-a-service (RaaS) is a criminal business model in which a ransomware group develops the malware, payment portals, and leak sites, then lets 'affiliates' use them to attack victims in exchange for a cut of each ransom.
Records Retention ScheduleA records retention schedule is a policy document that defines the minimum and maximum periods for retaining different categories of organizational records, based on legal requirements, regulatory obligations, and business needs.
Red team vs blue teamIn cybersecurity, a red team is a group that simulates real attackers to test an organization's defences, using whatever tactics a real adversary might, while a blue team defends systems, watches for threats, and responds to incidents.
Remote code execution (RCE)Remote code execution (RCE) is a type of vulnerability that lets an attacker run their own code or commands on a target system from a distance, over a network or the internet.
Risk RegisterA risk register (also called a risk log) is a structured document used to identify, assess, track, and manage risks across a project, system, or organization.
RootkitA rootkit is a type of malware designed to hide itself and other malicious software deep inside an operating system, firmware, or even hardware, while giving an attacker privileged control.
SandboxingSandboxing is a security technique that runs a program, file, or piece of code in an isolated, restricted environment, so it can't affect the rest of the device or network.
Security operations centre (SOC)A security operations centre (SOC) is the team and set of tools responsible for monitoring an organization's networks, devices, and cloud services for threats, investigating alerts, and responding to incidents, often 24 hours a day.
Security PostureSecurity posture describes an organization's overall cybersecurity strength across its people, processes, and technology -- how effectively it can prevent attacks, detect threats when they occur, respond to incidents, and recover from breaches.
SOC 2SOC 2 -- Service Organization Control 2 -- is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA) to evaluate how service organizations manage customer data against five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
SOXSOX -- the Sarbanes-Oxley Act -- is a US federal law passed in 2002 that imposes strict requirements on public companies regarding financial reporting accuracy, internal controls, and executive accountability.
SpywareSpyware is a type of malware that hides on your device and secretly watches what you do.
SQL injectionSQL injection is a web attack where an attacker types database commands into a website's input, such as a search box, login form, or web address, and the website mistakenly runs them against its database.
StalkerwareStalkerware is monitoring software secretly installed on someone's phone or computer, usually by a partner, ex-partner, or family member, to track their location, read messages, listen to calls, or view photos without their knowledge.
Strong PasswordA strong password is one that's difficult for both people and computers to guess.
Terms and ConditionsTerms and conditions — also called terms of service — are the rules you agree to follow when you use a website, app, or service.
Third-Party CookieA third-party cookie is a small tracking file placed in your browser by a website other than the one you're actually visiting.
Threat intelligenceThreat intelligence is evidence-based knowledge about cyber threats: who the attackers are, what they want, how they operate, and the technical clues they leave behind.
Tracking (Online Tracking)Online tracking is the practice of collecting data about your behavior as you browse the internet.
Trojan horse (malware)A trojan horse, or trojan, is malicious software disguised as something legitimate or useful, such as a free game, a software crack, a video player, or an invoice attachment.
Two-Factor AuthenticationTwo-factor authentication, often called 2FA, adds a second step when you log in to an account.
Vendor Risk ManagementVendor risk management (VRM), also called third-party risk management (TPRM), is the ongoing process of identifying, assessing, monitoring, and mitigating the risks that third-party suppliers introduce to an organization through access to its systems, data, or operations.
Virus vs Trojan vs WormViruses, trojans, and worms are all types of malware, but they work in different ways.
Zero-click exploitA zero-click exploit is an attack that compromises a device without any action from the victim, no link to click and no file to open.
Zero-Day VulnerabilityA zero-day vulnerability is a security flaw in software that the developer doesn't know about yet — meaning they've had 'zero days' to fix it.