| Access Control | A way of ensuring that only authorised users (or systems) can access data or services |
| Administrator | A person who manages a computer system, usually with highly privileged access to data and services |
| AI (Artificial Intelligence) | Computer systems which can perform tasks usually requiring human intelligence, including visual perception, speech recognition or translation between languages |
| Anti-Malware | Software designed to detect, stop and remove malicious software (malware) |
| Antivirus | Software designed to detect, stop and remove viruses and other kinds of malware |
| API | Application Programming Interface - a set of rules and tools that lets different software talk to each other |
| Asset Management | Identifying and recording your physical assets |
| Asynchronous | Things that do not happen at the same time or speed |
| Authentication | The process of determining if someone/thing is who/what they claim to be |
| Biometrics | A type of authentication based on biological data that is unique and specific to a person (like fingerprints or face ID) |
| Breach | An incident in which data, computer systems or networks are access/affected without authorisation |
| Browser | An application that accesses and displays services from the internet, such as Edge, Chrome, Firefox and Safari. |
| Brute Force Attack | An attack that uses computing power to automatically enter a large number of guesses for security credentials to try gain access |
| Certification | A form of digital identity for a computer, user or organisation to allow authentication and secure exchange of data |
| Cloud | An on-demand service, hosted on a global network of remote servers, accessible via the internet. Typical services include providing data storage and processing |
| Configuration Management | Processes for defining and maintaining consistent configurations of software, hardware and other elements of an organisation to ensure reliable performance |
| Credentials | Information used to verify someone's identity, like a password or token, that authenticates use of a service |
| Credential Stuffing | A method where attackers use stolen passwords from one web service to try and access accounts on another service, taking advantage of reused username/password combinations |
| CRUD | Create, Read, Update and Delete - used in computer programming |
| CVE | Common Vulnerabilities and Exposures - a public list and standard naming convention for cybersecurity flaws and software weaknesses |
| CVSS | Common Vulnerability Scoring System - a framework for rating the severity of security vulnerabilities ranging from 0 to 10 |
| Cyber Attack | An attempt to damage, disrupt or gain unauthorised access to computer systems, networks or devices |
| Cyber Essentials | A government-backed, industry supported scheme to help organisations protect themselves against common cyber attacks |
| Cyber Security | The protection of devices, services and networks as well as the information on them from unauthorised access, theft or damage |
| Cyber Threat | A threat of cyber attack to a user or organisation |
| Data Centre | A managed facility that houses data storage and computer systems |
| Decryption | Making encrypted information readable again |
| Devices | Computer-based hardware that physically exists - desktop computer, smartphone, tablet etc |
| Digital Footprint | The traces of digital information - the footprint - that a person's online activity leaves |
| DKIM | DomainKeys Identified Mail. An email authentication method that adds a digital signature to outgoing messages, verifying the origin of the message |
| DMARC | Domain-based Messaging and Reporting Conformance. Email authentication and reporting protocol that helps monitor and improve protection from fraudulent emails |
| DNS | Domain Name System. The directory service that translates internet domain names to their IP addresses |
| Domain | A set of network addresses on the internet, managed by an organisation or person |
| Download Attack | A type of cyber attack where the victim unintentionally installs malware onto a device |
| EDR | Endpoint Detection and Response - a cybersecurity tool that monitors computers, servers and mobile devices to detect threats |
| Encryption | Protecting information by making it unreadable to all except those with the key to decrypt it |
| End User Device | Term to describe smartphones, laptops and tablets that connect to an organisation's network |
| Firewall | Hardware or software used to prevent unauthorised access to or from a network |
| Firmware | The software embedded into a device that allows it to function |
| Hacker | Someone who uses their technology skills to break into computers, systems and networks |
| Hashing | Converting data into a fixed-length unreadable format that can't easily be reversed. Commonly used to protect passwords |
| Host | A network endpoint like a PC, laptop or smartphone |
| HSTS | HTTP Strict Transport Security - a web security tool that forces web browsers to communicate with a website only through secure HTTPS connections |
| HTTPS | Hypertext Transfer Protocol Secure - uses encryption for secure communication over a computer network |
| Hypervisor | Computer software or hardware that can run and manage one or more virtual machines |
| Identity Provider | An organisation that provides online user identification on behalf of third parties |
| Incident Management | Activities to identify, analyse, and determine the response to cyber security incidents to minimise the immediate and long-term impact |
| Information Assurance | Managing the risks to data, networks and information systems |
| Insider Threat | Deliberate or accidental threat to an organisation's security from someone with authorised access |
| IP | Internet Protocol - a communications protocol that relays data over networks boundaries and establishes routing across the internet |
| IP Address | Internet Protocol Address - A number assigned to each device that is sending or receiving data across the internet |
| ITDR | Identity Threat Detection and Response - a cybersecurity framework to detect, investigate, and mitigate identity-based attacks |
| Keylogger | Hardware or software used to covertly record each keystroke entered into a computer or device |
| Logging | Generating, capturing, retaining and storing information on security-relevant events or behavious from computer systems |
| Machine Learning | A type of AI where computers find patterns in data or solve problems automatically without having to be explicitly programmed |
| Macro | A small program that can automate tasks in applications which attackers can exploit to cause harm |
| Malware | Malicious software - any kind of software that can damage computer systems, networks or devices |
| MDM | Mobile Device Management - software that simplifies the administration and configuration of smartphones, laptops, tablets and other devices across an organisation |
| MDR | Managed Detection and Response - a cybersecurity service that combines technology and human expertise to proactively hunt, detect, and quickly respond to cyberthreats |
| Metadata | The properties of data and communications like file date and packet size |
| Mitigation | Actions that organisations and individuals can take to minimise and address risks |
| MITRE ATT&CK | Knowledge base of Adversary Tactics and Techniques & Common Knowledge |
| Monitoring | The analysis of logging information to identify unusual events or patterns of behaviours |
| MTA-STS | Mail Transfer Agent Strict Transport Security - an internet security standard forcing mail servers to use encrypted TLS connections when sending and receiving emails |
| MX Record | Mail Exchange Record - a type of DNS entry that controls where incoming mail is delivered |
| Network | Multiple computers and/or devices connected to shared resources and information |
| NIST | National Institute of Standards and Technology - non-regulatory agency that promotes measurement standards, calibration services and quality assurance programmes |
| OCSF | Open Cybersecurity Schema Framework - open-source standard designed to normalise and structure cybersecurity log and event data |
| Open Source | Software for which the source code is freely available for use and modification |
| Operating System | The basic software running on computers, tablets and smartphones - required to run additional applications and hardware |
| Operational Security | The day-to-day protection of computer systems from cyber attack like back up, incident management, patching etc |
| Password Manager | Software which can generate, storem, and retrieve passwords |
| Passwords | A sequence of characters used to verify the identity of a user, usually to gain access to an account, website or system |
| Patching | Installing updates to devices/software to improve security and/or enhance functionality |
| Pentest | Penetration Testing - an authorised test of a computer network or system, designed to look for security weaknesses with the end aim of fixing them |
| Pharming | A cyber attack where a person is misdirected to a fraudulent website despite them entering the correct address |
| Phishing | Scam emails/text messages that contain links to websites which may contain malware, or may trick users into revealing sensitive information (like passwords) or transferring money |
| Platform | Hardware (PCs, Macs etc) or software (Windows, Androis, iOS etc) environments where applications can run |
| Powershell | A powerful command-line tool and scripting language, often used to automate administrative and configuration tasks on Windows computers |
| Protocol | A set of rules that determine how data is handled, protected, and transmitted between devices on a network |
| Remote Working | Working away from you business premises |
| Risk Appetite | The level of risk that an organisation is prepared to take in pursuit of its objectives |
| Risk Management | Governing, communicating and making decisions about risk |
| Router | A device which sends data from one network to another based on the destination IP address |
| Sanitisation | Techniques that ensure data stored on devices is removed so that it can no longer be recovered by unauthorised parties |
| Schedule | Controls and monitors how and when data is synchronised across your different connectors |
| Secure Storage | Protecting digitally stored information using physical and electronic techniques |
| Security Monitoring | Active analysis of logging information to look for signs of attack or unusual behavious, help detect events that could be considered an icident and to respond accordingly |
| Server | A software or hardware based device that accepts and responds to requests made over a network |
| SIEM | Security Information and Event Management - Technology that supports threat detection and security management by collecting, monitoring, and analysing security related data from logs and alerts |
| SOAR | Security Orchestration, Automation, and Response - a technology stack that helps collect threat data, connect different security tools, and run automated workflows to fix cyber attacks quickly without human help |
| SOC | Security Operations Centre - a centralised facility within an organisation, responsible for activities such as security monitoring and incident management |
| Spam | Unsolicited email sent in bulk |
| SPF | Sender Policy Framework - an email authentication protocol that lets domain owners list authorised mail servers to help prevent email spoofing |
| SSL | Secure Sockets Layer - a security technology that encrypts links across the internet |
| SSO | Single Sign On - Using a single set of credentials (such as the same login and password combination) to access multiple services |
| Threat Intelligence | Information about threats that has been aggregated, analysed, and enriched to provide useful context for decision making processes |
| Throttling | Forcing a time delay between successive login attempts to defend against brute force attacks |
| TLS | Transport Layer Security - a cryptographic protocol that provides secure communications across computer networks like the internet |
| TLS-RPT | TLS Reporting - an email security standard that allows domain owners to receive automated JSON reports when other mail servers try to send emails to their domain |
| Token | A physical device or digital data, typically used with a password, to provide a user access to a computer or network |
| Virtual Machine | A virtual environment within a physical computer that behaves like a separate computer. It allows the user to run programs and test apps in isolation |
| VPN | Virtual Private Network - a set of cryptographic technologies used to encrypt data as it travels over a network between two fixed endpoints |
| Vulnerabilities | A weakness or flaw in software, a system, or process. An attacker exploits these to (for example) gain unauthorised access to a computer system |