The CSM Glossary of security terms
The following is the Cyber Security Mastery Internet glossary
Controlling who has access to a computer or online service and the information it stores.
Software that displays advertising content on your computer. Like its cousin spyware, some adware runs with your full knowledge and consent, some doesn't. More often an annoyance than a security risk, adware may also monitor browsing activities and relay that information to someone else over the Internet.
Something of value to a person, business or organization.
An encryption method using a widely published public key to encrypt messages, and a corresponding private key to decrypt them.
The process to verify that someone is who they claim to be when they try to access a computer or online service.
To make a copy of data stored on a computer or server to lessen the potential impact of failure or loss.
An extra copy of computer files, usually kept physically separate from the originals. Essential for recovery when original files are damaged or lost.
An attack combining a number of traditional attack methods, like a worm, a Trojan horse, and a key logger. Most require a combination of security tools and protection layers to defend.
Derived from "Web log." A website where an individual displays journal entries or commentary on a regular basis. Some blog owners allow others to post entries on their site.
Bluetooth or IEEE 802.15.1
Named after 10th century Danish king, Harald Blatan (Bluetooth), who was known as a uniter. A conventional set of wireless standards for short-range communication between wireless headsets, phones, PDAs, keyboards, and other disparate devices. Bluetooth supports a number of security measures, but it has flaws that can expose Bluetooth-enabled devices to attack.
Bot or Web Bot
Derived from "robot." An automated program, such as a Web crawler, that performs or simulates human actions on the Internet. Used for legitimate purposes by search engines, instant message (IM) programs, and other Internet services. Web bot can also be used to take control of computers, launch attacks, and compromise data; may act as part of a blended threat. See also, botnet.
Botnet or Zombie Armies
A group of computers that have been compromised and brought under the control of an individual. The individual uses malware installed on the compromised computers to launch denial-of-service attacks, send spam, or perpetrate other malicious acts.
Bring Your Own Device (BYOD)
The authorised use of personally owned mobile devices such as smartphones or tablets in the workplace.
High-speed data transmission system where the communications circuit is shared between multiple users.
Business Continuity Management
Preparing for and maintaining continued business operations following disruption or crisis.
In public key cryptography, a trusted third party who authenticates entities and their public keys. To do so, certificate authorities issue digital certificates, which validate that a public key belongs to the person whose digital signature is listed on the certificate.
Declaration that specified requirements have been met.
An independent organization that provides certification services.
An online forum where groups can exchange comments in real time. Many chat rooms use moderators to monitor behaviour and control access. However, chat room users can join anonymously, and sexual predators have used that anonymity to disguise themselves and target unsuspecting children and teens.
Delivery of storage or computing services from remote servers online (i.e. via the internet).
A small text file placed on your computer when you visit a Web page. Used to remember you or your preferences when you revisit that page or to track your browsing activities, cookies facilitate virtual shopping carts, page customization, and targeted advertising. They are not programs and cannot read your hard drive or cause damage to your computer.
A computer or program that provides other computers with access to shared files over a network.
Defragment or Defragging
Process of reorganizing information on your hard drive by placing parts of files in a more logical order and in closer proximity to one another. Fragmentation can slow down your computer; when defragmented, drives are faster and have larger areas of free space.
Also called public key certificate or identity certificate. In public key cryptography, validates that a public key is owned by the entity sending encrypted or digitally signed data with that key. Digital certificates are issued by a certificate authority and contain the sender's public key plus a digital signature verifying that the certificate is authentic and that the key belongs to the sender.
Used in public key cryptography to validate the integrity of encrypted data and to confirm both the identity of a digital certificate holder and the authenticity of the certificate itself.
Segment of a network where servers accessed by less trusted users are isolated. The name is derived from the term “demilitarised zone”.
Domain Spoofing or Domain Hijacking
Manipulation of the domain name system to associate a legitimate Web address with an imposter or otherwise malicious website. Used to perpetrate phishing and other types of attack, the user is sent to the imposter website with little or no warning.
Denial-of-Service. An attack on a computer or network in which bandwidth is flooded or resources are overloaded to the point where the computer or network's services are unavailable to clients. Can also be carried out by malicious code that simply shuts down resources.
A security method that makes information unreadable to anyone who doesn't have a key to decipher it; commonly used to secure online purchases and other transactions. When a website indicates it's "secure," that usually means the data you send and receive is encrypted. See also, public key cryptography.
Communications architecture for wired local area networks based upon IEEE 802.3 standards.
File Compression or Data Compression
Reduces a file's size by encoding its contents. Compression is used to maximize storage space and to facilitate faster transmission over the Internet. Compressed files are often placed in an archive file and must be extracted and decompressed before use; others are used in a compressed state. Common compression archive formats include .ZIP, .SIT, .TAR, .JAR, and .CAB. See also, image compression.
A hardware or software device, or both, that controls network access and communications between a network and the Internet, or between one part of a network and another.
Software that controls access and communications between a computer and the Internet or a local network. Blocks hackers and other unauthorized traffic, while allowing authorized traffic through.
File Transfer Protocol. A conventional set of communication rules for transferring files between computers on the Internet. While most Web browsers can transfer files using FTP, you can also use a dedicated FTP program, which usually provides better security features.
Graphics Interchange Format. An image file format popular on the Internet. GIFs are favored for graphics because they can be compressed without losing image quality. However, GIFs are limited to 256 colors and are therefore unsuitable for digital photos. See also, JPEG.
Commonly, a person who uses programming skills and technical knowledge to gain unauthorized access to computer systems for malicious or criminal purposes. The programming community, however, prefers to use the term "cracker" for such persons; they reserve "hacker" for any well-respected, highly skilled programmer.
The permanent storage medium within a computer used to store programs and data.
Hypertext Markup Language. The principal language used to create and format Web pages. Controls the layout, design, and display of text, hyperlinks, images, and other media on most Web pages.
The standard set of HTML code elements used to create and format Web pages.
Hypertext Transfer Protocol. A conventional set of communication rules for controlling how Web browsers and servers pass information back and forth over the Internet.
HTTP conventions for passing information to a server that's secured using encryption and/or authentication measures. The URLs of websites offering secure HTTP connections begin with "https:".
A clickable word, phrase, or image that takes you from one Web page to another Web page, or another resource on the Internet. Hyperlinks are createdusing HTML tags, and when displayed in a browser, they're typically underlined or set apart by a different color.
The process of recognising a particular user of a computer or online service.
Instant Message. A program that allows two or more people to communicate with one another over the Internet in real time. While most IM communications occur as text, some IM programs also offer streaming audio-visual conferencing and file exchange services. IM can also refer to messages sent by instant messaging, or to the act of sending an instant message.
Image compression. Reducing the size of an image file, while maintaining an acceptable level of quality. Used extensively on the Web, JPEG and GIF are common compressed image file formats. See also, file compression.
Provision of computing infrastructure (such as server or storage capacity) as a remotely provided service accessed online (i.e. via the internet).
Chat conversations between two or more people via typing on computers or portable devices.
Internet or the Net
A public, worldwide network of computers and computer networks. The World Wide Web, email, instant messaging, chat rooms, and many other online services and data transmissions are facilitated by the Internet.
Internet Service Provider (ISP)
Company that provides access to the internet and related services.
Intrusion Detection System (IDS)
Program or device used to detect that an attacker is or has attempted unauthorised access to computer resources.
Intrusion Prevention System (IPS)
Intrusion detection system that also blocks unauthorised access when detected.
Internet Protocol address. A unique identifier for each computer or other device on a network, including the Internet. Conceptually similar to a phone number, IP addresses are a string of numbers that allow computers, routers, printers, and other devices to recognize [identify] one another and communicate.
Joint Photographic Experts Group. A popular compressed file format for digital photos. JPEGs are favored on the Web because they can be compressed while maintaining high resolution; many digital cameras create JPEGs by default. The file extension for JPEGs is .jpg or .jpeg. See also, GIF.
Software that monitors and captures everything a user types into a computer keyboard. Used for technical support and surveillance purposes. Can also be integrated into malware and used to gather passwords, user names, and other private information.
Local Area Network (LAN)
Communications network linking multiple computers within a defined location such as an office building.
Mpeg audio layer 3. A compressed audio file format, popular for playing sound and music recordings over handheld and desktop audio players.
Malware (ie malicious software) that uses the macro capabilities of common applications such as spreadsheets and word processors to infect data.
Derived from "malicious software." Software designed to do harm by causing damage to systems or data, invading privacy, stealing information, or infiltrating computers without permission. Includes viruses, worms, Trojan horses, some keyloggers, spyware, adware, and bots.
A security method requiring both parties to a transaction to prove their identities. On the Web, this would require both the Web browser and Web server to prove their identities to one another, thus ensuring both the Web page and the page's user are legitimate. Used on financial and commerce sites, mutual authentication can help prevent phishing and other types of fraud.
Network or Computer Network
A group of two or more computers connected by cables or wireless signals or both, which can communicate with one another using network protocols. Networks can also include other devices, including printers, routers, and network hubs.
Device that controls traffic to and from a network.
A hardware device that connects computers to one another on a local network.
Obtaining services by using someone else’s resources.
A secret series of characters used to authenticate a person’s identity.
Personal Digital Assistant. A handheld computer usually containing address books, memo pads, and other personal organization software. Many PDAs can connect to the Web, send email, and synchronize with home computers; some work as cellular phones.
Software running on a PC that controls network traffic to and from that computer.
Personal data relating to an identifiable living individual.
An attempt to mislead people into divulging confidential information, such as Social Security numbers and passwords. Phishing typically uses legitimate-looking email or IMs in combination with imposter websites to make fraudulent requests for information (e.g., to go "fishing" for data). See also, social engineering.
An attempt to defraud Internet surfers by hijacking a website's domain name, or URL, and redirecting users to an imposter website where fraudulent requests for information are made. See also, URL spoofing.
Derived from "iPod broadcasting." A regularly updated set of MP3 audio files available on the Web for one-time download or subscription. Podcast subscribers receive updates automatically via RSS Web feeds.
In asymmetric encryption, an unpublished key used to decrypt messages encrypted using a corresponding public key.
Server that acts as an intermediary between users and others servers, validating user requests.
In asymmetric encryption, a key made available to anyone who wants to send an encrypted message to the owner of the key. The owner of the public key uses his or her private key to decrypt messages.
Public Key Cryptography
An encryption technique using public keys to encrypt messages, digital signatures to validate the integrity of messages, and digital certificates to authenticate the identity of public key owners.
Public Key Infrastructure (PKI)
A set of standards and services designed to support public key cryptography. Uses digital certificates issued by certificate authorities to authenticate public keys and the entities who own them.
The recovery of data following computer failure or loss.
Something that could cause an organization not to meet one of its objectives.
The process of identifying, analysing and evaluating risk.
A hardware device that connects two networks and directs traffic from one network to the appropriate destination on the other. Often used to connect a network to the Internet, some routers have network firewalls and other features built into them.
Really Simple Syndication. An XML format used to create Web feeds of content available on news sites, blogs, and other websites with fast-changing information. The feeds generally contain headlines and summaries of content, and subscribers use RSS readers to view them.
Something that modifies or reduces one or more security risks.
Security Information and Event Management (SIEM)
Process in which network information is aggregated, sorted and correlated to detect suspicious activities.
A well-defined boundary within which security controls are enforced.
Computer that provides data or services to other computers over a network.
A mobile phone built on a mobile computing platform that offers more advanced computing ability and connectivity than a standard mobile phone.
Simple Mail Transfer Protocol. A conventional set of communication rules for sending email messages over the Internet.
A method of deceiving users into divulging private information, social engineering takes advantage of our natural tendency to trust one another rather than rely solely on technological means to steal information. Often associated with phishing, pharming, spam, and other Internet-based scams.
The delivery of software applications remotely by a provider over the internet; perhaps through a web interface.
Unsolicited email, usually sent in bulk to a large number of random accounts; often contains ads for products or services. Also used in phishing scams and other online fraud. Can be minimized using email filtering software.
Spim or Instant Spam
Unsolicited instant messages, usually sent in bulk to a large number of IM accounts; often contain marketing materials and links to product Web pages. May also be used in phishing scams or to spread malware. See also, spam.
Spam over Internet telephony. Unsolicited VoIP phone calls sent in bulk over the Internet. Not yet a major annoyance or threat, but could become a serious problem as VoIP becomes more popular. See also, spam and spim.
Software that collects information about your computer and how you use it and relays that information to someone else over the Internet. Spyware ordinarily runs in the background, and in some cases installs itself on your computer without your knowledge or permission.
An encryption method using the same secret key to encrypt and decrypt messages.
An ultra-portable, touch screen computer that shares much of the functionality and operating system of smartphones, but generally has greater computing power.
Something that could cause harm to a system or organization.
A malicious program disguised as legitimate software; often gives someone else the power to take remote control of your computer; may also attack data or systems.
Obtaining evidence of identity by two independent means, such as knowing a password and successfully completing a smartcard transaction.
Uniform Resource Locator. A website or Web page's address (e.g., www.symantec.com or www.symantec.com/home_homeoffice/index.html). Browsers use URLs to identify and download Web pages from the Web servers where they're located.
Attempting to masquerade or closely mimic the URL displayed in a Web browser's address bar. Used in phishing attacks and other online scams to make an imposter website appear legitimate, the attacker obscures the actual URL by overlaying a legitimate looking address or by using a similarly spelled URL.
The short name, usually meaningful in some way, associated with a particular computer user.
The record of a user kept by a computer to control their access to files and programs.
Virtual Private Network (VPN)
Link(s) between computers or local area networks across different locations using a wide area network that cannot access or be accessed by other users of the wide area network.
A program that can self-replicate and infect files, programs, and computer systems. Some viruses simply replicate and spread themselves, while others can also damage your computer system and data.
Voice over Internet Protocol. A digital telephone service that facilitates voice transmissions over the Internet or other IP networks.
A flaw or weakness that can be used to attack a system or organisation.
A file, usually in XML format, containing headlines and summaries of fast-changing Web content, like news stories, podcasts, and blogs. Web feeds provide links to full versions of content for subscription or one-time download; they can also be shared and republished by other websites, creating a sort of online syndication. See also, RSS.
A file, usually in HTML format, available for retrieval by a browser on the Web. Web pages can contain text, images, and multimedia resources. They usually include hyperlinks to other Web pages or files, and some contain forms through which you can send information to the page host.
A computer that makes Web pages and other resources available for sharing over the Internet. Using HTTP, Web browsers request pages from Web servers, which then send or download those pages to the requester. Also refers to a program that facilitates a Web server's functions.
Wired Equivalent Privacy. Part of the 802.11 IEEE standards, WEP is a security protocol for encrypting information and preventing unauthorized access to wireless networks. Designed to provide as much security as hard-wired networks, WEP has serious flaws and has been replaced by WPA and WPA2 as the preferred wireless security protocols.
Wide Area Network (WAN)
Communications network linking computers or local area networks across different locations.
Generally an interactive graphic component, like a button, check box, window, or text box. Also refers to small desktop programs that display real-time information and provide quick access to commonly used functions.
Wireless Fidelity. A play on the term "hi-fidelity." A descriptive term used to refer to 802.11 wireless networks, devices, or anything associated with 802.11 wireless technology (e.g., Wi-Fi hotspot).
A physical area where you can use a Wi-Fi-enabled device to connect to the Internet over a public wireless network. Some hotspots have no security measures in place, while others use WEP or WPA to secure transmissions.
Adapted from The Shockwave Rider, a science fiction novel. An often malicious program that can copy and propagate itself over the Internet using email programs or other transport tools. May also compromise the security of an infected computer or cause system and data damage.
Wi-Fi Protected Access. Part of the 802.11 wireless standards, WPA is an extension and improvement of the WEP security protocol, offering better encryption and user authentication measures.
Part of the 802.11 wireless standards, WPA2 enhances the WPA security protocol. WEP, WPA, and WPA2 are all still in use, but WPA and WPA2 offer better protection.
Extensible Markup Language. Like HTML, a language Web programmers use to format and present information on the Web. Unlike HTML, it does not have a fixed set of formatting tags; rather, it is a meta-language that gives programmers the flexibility to create their own markup tags and thereby organize and present information in innovative ways.
A zombie is an infected computer that is remotely controlled by a hacker. It is part of a large group of compromised computers called a botnet.
© 2018 - Cyber Security Mastery - All rights reserved
Webdesign by Solution One Media