Cybersecurity glossary

Security has a lot of jargon. Each term below gets a short, plain-English definition, with a link to the full guide where we have one.

96 terms

#

2FA (two-factor authentication)

A second proof of identity after your password, such as an app code, a passkey or a security key. See 2FA and passkeys.

A

Account takeover

When a criminal gets control of one of your online accounts, usually with a stolen or reused password.

Adware

Software that floods you with ads or redirects your searches, often bundled with free downloads.

AES

Advanced Encryption Standard, the widely used encryption algorithm that protects everything from Wi-Fi to disk encryption.

Air gap

Keeping a computer or backup physically disconnected from any network.

Antivirus

Software that detects and blocks malware. Built-in options like Microsoft Defender are good for most people.

APT (advanced persistent threat)

A well-resourced group that quietly stays inside a target's network for a long time.

Attack surface

All the points where an attacker could try to get in: devices, apps, accounts and people.

Authentication

Proving who you are, for example with a password, passkey or fingerprint.

Authorization

Deciding what an authenticated person is allowed to do.

B

Backdoor

A hidden way into a system that bypasses normal security.

BEC (business email compromise)

A scam where criminals pose as a boss or supplier by email to redirect payments.

Biometrics

Using a fingerprint, face or other body feature to unlock a device.

Botnet

A network of infected devices controlled remotely, used for spam or attacks. See Mirai.

Breach

An incident where data leaves an organization's control without permission. See data breaches.

Brute force

Guessing a password by trying huge numbers of combinations.

Bug bounty

A program that pays researchers for responsibly reporting security flaws.

C

Certificate (TLS)

A digital file that proves a website's identity and enables HTTPS encryption.

CISA

The US Cybersecurity and Infrastructure Security Agency, which publishes advisories and free guidance.

Cookie

A small file a website stores in your browser. Session cookies keep you logged in and are valuable to thieves.

Credential stuffing

Trying leaked username and password pairs on other sites. See credential stuffing.

Credit freeze

Blocking access to your credit report so no one can open new credit in your name. See freeze your credit.

CVE

Common Vulnerabilities and Exposures, the public ID system for known security flaws, such as CVE-2021-44228.

CVSS

A 0 to 10 score that rates how severe a vulnerability is.

D

Dark web

Parts of the internet reachable only with special software, where stolen data is often traded.

DDoS (distributed denial of service)

Overwhelming a website or service with traffic from many machines to knock it offline.

Deepfake

AI-generated audio, image or video that imitates a real person. See deepfakes.

Defense in depth

Using several layers of protection so one failure does not mean total compromise.

DKIM

An email standard that adds a digital signature proving a message was not altered.

DMARC

An email policy that tells receivers what to do with messages that fail SPF or DKIM checks.

DNS

The internet's phone book, which turns names like example.com into numeric addresses.

Double extortion

Ransomware that both encrypts and steals data, threatening to publish it.

E

EDR (endpoint detection and response)

Advanced security software that monitors computers for suspicious behavior and helps investigate.

Encryption

Scrambling data so only someone with the right key can read it.

End of life

When a product stops receiving security updates.

End-to-end encryption

Encryption where only the sender and recipient can read messages, not the service provider.

Evil twin

A fake Wi-Fi hotspot that imitates a real one. See public Wi-Fi.

Exploit

Code or a technique that takes advantage of a vulnerability.

F

FIDO2

The open standard behind passkeys and hardware security keys.

Firewall

A filter that allows or blocks network traffic based on rules.

Firmware

Low-level software built into hardware such as routers and cameras.

H

Hash

A one-way fingerprint of data. Websites should store passwords as slow, salted hashes.

Honeypot

A decoy system set up to attract and study attackers.

HTTPS

The encrypted version of HTTP, shown by a padlock in the browser. It does not prove a site is honest.

I

Identity theft

Using someone's personal details to commit fraud. See identity theft.

Incident response

The organized process of handling a security incident. See incident response plan.

Infostealer

Malware that grabs saved passwords, cookies and crypto wallets.

IoT (Internet of Things)

Everyday devices connected to the internet, such as cameras, plugs and TVs. See smart home.

K

Keylogger

Malware that records what you type.

L

Lateral movement

An attacker moving from the first compromised machine to others in a network.

Least privilege

Giving every person and program only the access they actually need.

M

Malvertising

Malicious ads that lead to scams or malware downloads.

Malware

Any software designed to harm, spy or steal. See malware types.

MFA fatigue

Spamming someone with sign-in approval prompts until they tap Approve.

MFA (multi-factor authentication)

Same idea as 2FA, possibly with more than two factors.

N

NIST

The US National Institute of Standards and Technology, which publishes widely used security guidance.

P

Passkey

A phishing-resistant replacement for passwords based on cryptographic keys stored on your device.

Passphrase

A long password made of several random words.

Password manager

An app that creates, stores and fills unique passwords. See password managers.

Patch

A software update that fixes a flaw. See software updates.

Penetration test

An authorized, simulated attack to find weaknesses before criminals do.

Phishing

Fake messages designed to steal logins, money or data. See phishing.

Pretexting

Inventing a believable story to manipulate someone. See social engineering.

Principle of least privilege

See least privilege.

Privilege escalation

Gaining higher access rights than originally granted, such as becoming an administrator.

Q

Quishing

Phishing with QR codes. See QR code scams.

R

Ransomware

Malware that encrypts or steals data and demands payment. See ransomware.

Red team / blue team

Attackers (red) and defenders (blue) in authorized security exercises.

Rootkit

Malware that hides deep in a system to avoid detection.

S

Salt

Random data added to a password before hashing so identical passwords produce different hashes.

Sandbox

An isolated environment for safely running untrusted code.

SBOM (software bill of materials)

A list of all components inside a piece of software. See Log4Shell.

Security key

A small physical device used for phishing-resistant sign-in.

SIEM

A system that collects and analyzes security logs from across an organization.

SIM swap

Hijacking someone's phone number by moving it to a SIM the attacker controls. See SIM swapping.

Smishing

Phishing by text message. See smishing and vishing.

Social engineering

Manipulating people rather than hacking technology. See social engineering.

SOC (security operations center)

The team that monitors and responds to security alerts around the clock.

Spear phishing

Phishing tailored to a specific person or organization.

SPF

An email standard listing which servers may send mail for a domain.

Spoofing

Faking a sender's identity, such as a phone number or email address.

Spyware

Software that secretly monitors your activity.

SQL injection

A flaw where attacker input is treated as a database command. See MOVEit.

Supply chain attack

Compromising a supplier or software component to reach many downstream victims.

T

Threat actor

Any person or group behind a cyberattack.

TOTP

Time-based one-time passwords: the six-digit codes from authenticator apps.

Trojan

Malware disguised as legitimate software.

Typosquatting

Registering misspelled domains to catch people who mistype addresses.

V

Vishing

Voice phishing by phone call.

VPN

An encrypted tunnel for your internet traffic. See public Wi-Fi and VPNs.

Vulnerability

A weakness in software or a system that can be exploited.

W

Whaling

Phishing aimed at senior executives.

Worm

Malware that spreads by itself across networks. See the Morris worm.

WPA3

The current Wi-Fi security standard. See home Wi-Fi.

Z

Zero-day

A vulnerability exploited before a fix exists.

Zero trust

A security model that never assumes trust based on network location and verifies every request.