Glossary
Cyber security jargon, explained.
Plain-English definitions of the terms you’ll meet in security reports, proposals and board papers.
A
- Attack surface
- Every point where an attacker could try to get into your organisation: websites, cloud services, remote access, email and the people who use them.
- Attack surface management (ASM)
- Continuously discovering and monitoring everything you expose to the internet, so unknown or forgotten assets can be secured. Learn more
B
- Business email compromise (BEC)
- Fraud in which attackers impersonate a colleague, supplier or executive by email to trick staff into paying money or sharing data. Learn more
C
- CISO
- Chief Information Security Officer: the senior leader responsible for an organisation’s security strategy.
- CREST
- An international accreditation body for technical security providers. CREST accreditation shows testing meets a recognised standard. Learn more
- Cyber Essentials
- A UK government-backed certification covering five basic controls that stop the most common attacks. Cyber Essentials Plus adds a technical audit. Learn more
D
- DDoS
- Distributed denial of service: flooding a website or service with traffic so genuine users can’t reach it.
- DKIM
- DomainKeys Identified Mail: a digital signature on outgoing email that proves it came from your domain and wasn’t altered.
- DMARC
- An email policy that tells receiving servers what to do with messages that fail SPF or DKIM checks, helping stop spoofing of your domain.
E
- EDR
- Endpoint detection and response: software that monitors laptops and servers for suspicious behaviour and helps contain threats.
- Endpoint
- Any device that connects to your network, such as a laptop, desktop, phone or server.
- Exploit
- Code or a technique that takes advantage of a vulnerability to compromise a system.
F
- Firewall
- A device or service that controls which network traffic is allowed in and out, based on a set of rules. Learn more
I
- Incident response
- The process of detecting, containing, investigating and recovering from a security incident. Learn more
- Indicator of compromise (IoC)
- Evidence that a system may have been breached, such as a known malicious file, domain or IP address.
- ISMS
- Information security management system: the policies, processes and controls an organisation uses to manage information risk, as defined by ISO 27001. Learn more
- ISO 27001
- The international standard for information security management systems. Organisations can be independently certified against it. Learn more
L
- Lateral movement
- How attackers move from one compromised system to others inside a network.
M
- Malware
- Malicious software, including viruses, trojans, spyware and ransomware.
- MFA
- Multi-factor authentication: requiring a second proof of identity, such as an app prompt or code, as well as a password.
- MITRE ATT&CK
- A public knowledge base of attacker tactics and techniques, widely used to design and measure threat detection.
N
- NIST Cybersecurity Framework
- A widely used framework from the US National Institute of Standards and Technology for organising and improving cyber security. Learn more
O
- OT
- Operational technology: the systems that control physical processes, such as production lines and building management systems. Learn more
P
- Patch management
- Keeping software up to date by applying security updates promptly. Learn more
- Penetration test
- An authorised, simulated attack by ethical hackers to find and prove exploitable weaknesses. Learn more
- Phishing
- Fraudulent messages designed to trick people into clicking a link, opening a file or giving away information. Learn more
- Privilege escalation
- When an attacker gains higher levels of access than they started with, such as admin rights.
R
- Ransomware
- Malware that encrypts systems or data and demands payment, often after stealing data to threaten publication. Learn more
- Red team
- A full-scope attack simulation that tests people, processes and technology together, often over a longer period than a penetration test.
S
- SIEM
- Security information and event management: technology that collects and analyses logs from across an organisation to spot threats.
- SOC
- Security Operations Centre: the team and technology that monitor, detect and respond to threats, often 24/7. Learn more
- Social engineering
- Manipulating people, rather than technology, to gain access or information. Learn more
- SPF
- Sender Policy Framework: a DNS record listing which servers are allowed to send email for your domain.
- Spear phishing
- Phishing aimed at a specific person or role, using personal details to make it convincing.
- Statement of Applicability
- An ISO 27001 document listing which Annex A controls apply to your organisation, and why. Learn more
- Supply chain attack
- An attack that reaches its target through a trusted supplier, software provider or service partner. Learn more
T
- Tabletop exercise
- A facilitated discussion in which a team walks through a simulated incident to test plans and decisions. Learn more
- Threat hunting
- Proactively searching for signs of attackers who have evaded automated defences.
V
- vCISO
- A virtual CISO: senior security leadership provided part-time or on demand. Learn more
- Vulnerability
- A weakness in software, configuration or process that an attacker could exploit. Learn more
X
- XDR
- Extended detection and response: security monitoring that correlates signals across endpoints, email, identity, cloud and network to detect and respond to threats. Learn more
Z
- Zero-day
- A vulnerability that’s exploited before the vendor has released a fix.
- Zero Trust
- A security approach that never assumes trust based on network location, verifying every user and device for every request.
AskQ Service Finder
Not sure where to start? AskQ.
Tell us what you want to achieve and we’ll match you to the right services in under a minute.
Get started
Talk to our team.
Book a call with a CyberQ specialist, or call us on 0800 0614 715. No obligation, no jargon.
