Cybersecurity Glossary

An advanced persistent threat (APT) is an adversary with sophisticated expertise and significant resources, often associated with a nation-state, that conducts a sustained cyber campaign against a target organization or individual.

Authentication is the process of verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system.

Authorization is the decision to permit or deny a subject access to system objects such as networks, data, applications, and services, and the access privileges granted to a user, program, or process as a result.

A backdoor is an undocumented way of gaining access to a computer system that lets attackers bypass security measures. The term covers both a weakness or defect in a system, application, or service and a malicious program that listens for an attacker's commands.

Business email compromise (BEC) is a scam in which an attacker impersonates or takes over the email of a trusted person, such as an executive, colleague, or business partner, to get the recipient to transfer funds, disclose sensitive information, or take another action that benefits the attacker.

A botnet is a network of internet-connected devices infected with malware without their owners' awareness and controlled remotely by a threat actor, who coordinates them to carry out tasks such as distributed denial of service (DDoS) attacks.

A brute force attack is a trial-and-error method of cracking passwords, login credentials, or encryption keys by systematically attempting all possible combinations.

A cloud access security broker (CASB) is security software that sits on the network between an organization's users of cloud services and the cloud service providers, and enforces the organization's security and governance policies for cloud applications.

A computer virus is a type of malicious software that spreads by modifying other programs or files to include a copy of itself, and runs when the infected program is invoked. A virus cannot run by itself; its host program must run to make it active.

A computer worm is self-replicating malware that uses a network to distribute copies of itself to other computers, often without user intervention. Unlike a virus, a worm does not need to attach itself to an existing program.

Credential stuffing is the automated use of username and password pairs stolen in the breach of one site to log in to user accounts on other sites, relying on people reusing the same password.

Cloud security posture management (CSPM) is the continuous monitoring of a cloud environment to identify, alert on, and remediate misconfigurations and vulnerabilities, reducing risk and improving cloud security.

Cyber threat intelligence (CTI) is information about cyber threats that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the context an organization needs to make decisions.

Cybersecurity is the prevention of damage to, protection of, and restoration of computers and electronic communications systems and services, including the information they contain, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.

Dynamic application security testing (DAST) tests an application while it is running. It simulates attacks against the application, usually from the outside, and analyzes how the application reacts to determine whether it is vulnerable.

A data breach is the loss of control, compromise, unauthorized disclosure, or unauthorized acquisition of personal or other sensitive information, where someone other than an authorized user gets or may get access to it, or an authorized user uses it for an unauthorized purpose.

A distributed denial of service (DDoS) attack is a denial of service technique that uses many hosts to overload a website, network, or service and make it unavailable to legitimate users. The attacking machines are often a botnet of compromised computers.

Defense in depth is an information security strategy that integrates people, technology, and operations capabilities to establish barriers across multiple layers of an organization, so that attacks missed by one security control are caught by another.

DevSecOps is a culture and set of practices, supported by automation tools, that brings development, security, and operations teams together to deliver software, with security testing built into each stage of the CI/CD pipeline.

Data loss prevention (DLP) is the ability to identify, monitor, and protect sensitive data in use, in motion, and at rest to detect and prevent its unauthorized use and transmission.

Endpoint detection and response (EDR) is security software that monitors endpoints such as desktop computers, servers, and mobile devices, detects malicious activity on them, and helps the security team investigate and remediate it.

Encryption is the process of transforming plaintext into ciphertext using a cryptographic algorithm and key, which conceals the data's original meaning from anyone who does not hold the key.

Endpoint security is the protection of endpoints, the laptops, desktops, mobile devices, servers, and other devices that connect to a network, with safeguards that run on the device itself, such as antivirus, personal firewalls, host-based intrusion prevention, and endpoint detection and response.

A firewall is a device or program that controls the flow of network traffic between networks or hosts with different security postures, limiting access according to a security policy.

A honeypot is a decoy system or system resource, such as a web server or a file on a server, designed to attract attackers so that any interaction with it can be logged and analyzed.

Identity and access management (IAM) is a framework of business processes, policies, and technologies for managing digital identities, so that users gain access to data only when they have the appropriate credentials.

Identity theft is when someone uses another person's personal or financial information without permission, such as their name and address, credit card or bank account numbers, Social Security number, or medical insurance account numbers.

An intrusion detection system (IDS) is software that monitors the events on a computer system or network, analyzes them for signs of possible incidents, and alerts administrators to suspicious activity.

An indicator of compromise (IOC) is a technical artifact or observable, such as a malicious file hash, IP address, or domain name, that suggests an attack is imminent or underway or that a compromise may have already occurred.

An intrusion prevention system (IPS) is a system that detects intrusive activity, as an intrusion detection system does, and also attempts to stop that activity, ideally before it reaches its targets.

A keylogger is malicious software that records which keys a user presses, typically to capture confidential information such as login or financial details and send it to an attacker. The practice is also called keystroke logging.

Lateral movement is the set of techniques an attacker uses to enter and control other systems on a network after gaining an initial foothold, broadening its access on the way to valuable data or systems.

Least privilege is a security principle that a system should restrict the access privileges of users, and of processes acting on behalf of users, to the minimum necessary to accomplish assigned tasks.

Malware is malicious software, defined by NIST as software or firmware intended to perform an unauthorized process that harms the confidentiality, integrity, or availability of a system. Viruses, worms, trojan horses, spyware, and ransomware are common types.

Multi-factor authentication (MFA) is a security control that requires a user to present two or more different authenticators, from something you know, something you have, or something you are, to verify their identity at login.

A man-in-the-middle (MitM) attack is an attack in which the attacker is positioned between two communicating parties to intercept or alter the data traveling between them, while the victim believes they are communicating directly with the other party.

Network segmentation is the partitioning of a network into smaller networks, usually combined with segregation, a ruleset that controls which hosts and services may communicate, to restrict access to sensitive data, hosts, and services and limit the impact of an intrusion.

OAuth is an IETF authorization framework that lets a third-party application obtain limited access to an HTTP service, either on behalf of a resource owner who approves the access or on the application's own behalf.

Open source intelligence (OSINT) is intelligence drawn from information that is generally available to the public, such as media reports, professional and academic records, and public government data, which is then reviewed and analyzed.

Privileged access management (PAM) is a security measure placed in front of system administration interfaces that gives administrators temporary, task-limited privileged access on request, based on just-in-time and just-enough administration.

A passkey is a FIDO authentication credential that replaces a password with a cryptographic key pair and lets a user sign in to apps and websites with the same method that unlocks their device, such as a biometric, PIN, or pattern.

A password manager is a tool that generates, stores, and automatically fills in passwords, so a user can have a strong, unique password for every account while remembering only the one primary password that unlocks the manager.

Patch management is the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization.

Penetration testing is an authorized security assessment in which testers attempt to breach some or all of a system's security, using the same tools and techniques an adversary might, to gain assurance in how secure the system is.

Pharming is an attack that redirects users to a fake website made to look like a legitimate one, so that they enter personal information such as usernames, passwords, or credit card numbers. Unlike phishing, it does not depend on a message. The attacker redirects users with malware or by manipulating the domain name system (DNS).

Phishing is a form of social engineering in which attackers send messages that appear to come from a trusted source to trick recipients into revealing sensitive information such as passwords, transferring money, or clicking links and opening attachments that lead to malware.

Public key infrastructure (PKI) is a framework established to issue, maintain, and revoke public key certificates. It is used to confirm identity by proving ownership of a private key.

Prompt injection is an attack on applications built on large language models (LLMs) in which untrusted input, combined with a prompt written by a higher-trust party such as the application designer, alters the model's behavior or output in unintended ways.

Ransomware is a form of malware designed to encrypt files on a device, making the files and the systems that rely on them unusable. The attackers then demand a ransom in exchange for decryption.

Role-based access control (RBAC) is an access control model in which permitted actions on resources are tied to roles rather than to individual users, and each user receives the permissions of the roles assigned to them.

Red teaming is an authorized exercise in which a group of people emulates a potential adversary's attacks against an organization, under real-world conditions, to assess its security capabilities, including how well it detects and responds to threats.

A rootkit is a set of tools an attacker uses to gain the highest level of privilege on a host, hide their activity, and keep that root-level access through covert means. It alters the host's standard functionality in a malicious and stealthy way.

Security Assertion Markup Language (SAML) is a protocol of XML-based request and response messages for exchanging security information, expressed as assertions about subjects, between online partners. It is used to pass authentication and authorization data from identity providers to service providers.

Secure access service edge (SASE) is an architecture that converges wide area networking and network security functions and delivers them together as a cloud service, rather than through separate point security products.

Static application security testing (SAST) analyzes an application's source code, bytecode, or binary code for security vulnerabilities without running the program.

A software bill of materials (SBOM) is a formal record of the components used to build a piece of software and their supply chain relationships. It is a nested inventory, or list of ingredients, of that software.

Supervisory control and data acquisition (SCADA) is a type of operational technology system that gathers data from geographically dispersed field sites and lets operators monitor and control those assets from a central location.

Security information and event management (SIEM) is software that collects, centralizes, and analyzes log data from across an organization's systems to detect activity that could be a security event or incident, and alerts the security team.

Smishing is phishing carried out through SMS text messages. The attacker sends fraudulent texts to trick recipients into revealing sensitive information such as login credentials, bank account details, or credit card numbers.

Security orchestration, automation, and response (SOAR) is software that automates part of the response to detected security events and incidents by running predefined playbooks, either on its own log analysis or on top of an existing SIEM.

A security operations center (SOC) is a team of security professionals, together with its processes and technology, that monitors an organization's systems to detect, investigate, and respond to cyber attacks and incidents.

Social engineering is the use of deception and manipulation to trick people into revealing sensitive information, granting unauthorized access, or committing fraud. It targets people rather than computer systems, often by impersonating a trusted person or organization.

Spear phishing is a targeted form of phishing aimed at a specific person, company, or small group. The message includes personal details about the target to make it appear more convincing.

Spoofing is the forging or masking of a website, email address, or phone number so that it appears to come from a trusted source. NIST defines it more broadly as an attempt to gain access to a system by posing as an authorized user.

Spyware is software that is secretly installed on a system to gather information about individuals or organizations without their knowledge. It is a type of malicious code intended to violate the user's privacy.

Single sign-on (SSO) is an authentication process in which one account and its authenticators are used to access multiple applications, generally implemented with a federation protocol.

A supply chain attack is an incident in which an adversary exploits vulnerabilities in the supply network of products and services that its intended target relies on, such as third-party product or service providers.

Threat hunting is the proactive, iterative, and human-led search for signs of cyber threats and intrusions that have evaded an organization's existing security controls and automated detection rules.

Threat modeling is a set of techniques for modeling and analyzing a system, application, or service to understand how it might be attacked or otherwise fail, and which measures or controls are needed to manage those risks.

A trojan horse is a computer program that appears to have a useful function but also has a hidden and potentially malicious function. It does not replicate itself, and its hidden code runs when the program is invoked.

Vishing, short for voice phishing, is a social engineering attack carried out over the phone. The caller impersonates a trusted person or organization to get the victim to share personal or sensitive information.

Vulnerability management is the ongoing process of finding the vulnerabilities in an organization's systems and software, triaging and prioritizing them by business risk, and fixing them or putting mitigations in place.

A web application firewall (WAF) is a firewall for HTTP applications that applies a set of rules to HTTP traffic to block common attacks, such as cross-site scripting and SQL injection, against a web application.

Extended detection and response (XDR) is security tooling that extends endpoint detection and response beyond endpoints, correlating endpoint telemetry with email, cloud, and network activity to detect threats and coordinate the response across those layers.

Zero trust is a set of cybersecurity principles that grants no implicit trust to users or assets based on their network location or ownership, and instead makes least privilege access decisions for each request, treating the network as compromised.

A zero-day is a vulnerability that is not yet known to the vendor and therefore has no patch. A zero-day exploit, or zero-day attack, is an attack that targets such a previously unknown hardware, firmware, or software vulnerability.

Zero trust network access (ZTNA) is an architectural approach for controlling how users and devices access applications over a network, in which network connectivity alone never grants access and each request is explicitly authorized based on policy and context.