# Terms and definitions from Course 5

Cybersecurity Glossary

##   
A

  
Access controls: Security controls that manage access, authorization, and  
accountability of information  
Adware: A type of legitimate software that is sometimes used to display digital  
advertisements in applications  
Advanced persistent threat (APT): An instance when a threat actor maintains  
unauthorized access to a system for an extended period of time  
Algorithm: A set of rules used to solve a problem  
Angler phishing: A technique where attackers impersonate customer service  
representatives on social media  
Application programming interface (API) token: A small block of encrypted code  
that contains information about a user  
Asset: An item perceived as having value to an organization  
Asset classification: The practice of labeling assets based on sensitivity and  
importance to an organization  
Asset inventory: A catalog of assets that need to be protected  
Asset management: The process of tracking assets and the risks that affect them  
Asymmetric encryption: The use of a public and private key pair for encryption and  
decryption of data  
Attack surface: The characteristics and features of the areas where an attack can  
come from

Attack tree: A diagram that maps threats to assets  
Attack vector: The pathways attackers use to penetrate security defenses

## B

  
Baiting: A social engineering tactic that tempts people into compromising their  
security  
Basic auth: The technology used to establish a user’s request to access a server  
Bit: The smallest unit of data measurement on a computer  
Botnet: A collection of computers infected by malware that are under the control of a  
single threat actor, known as the “bot-herder"  
Brute force attack: The trial and error process of discovering private information  
Bug bounty: Programs that encourage freelance hackers to find and report  
vulnerabilities

##   
C

  
Cipher: An algorithm that encrypts information  
Common Vulnerabilities and Exposures (CVE®) list: An openly accessible dictionary  
of known vulnerabilities and exposures  
Common Vulnerability Scoring System (CVSS): A measurement system that scores  
the severity of a vulnerability  
Compliance: The process of adhering to internal standards and external regulations  
Computer virus: see “virus”  
Cross-site scripting (XSS): An injection attack that inserts code into a vulnerable  
website or web application  
Cryptojacking: A form of malware that installs software to illegally mine  
cryptocurrencies

Cryptographic key: A mechanism that decrypts ciphertext  
Cryptography: The process of transforming information into a form that unintended  
readers can’t understand  
CVE Numbering Authority (CNA): An organization that volunteers to analyze and  
distribute information on eligible CVEs

## D

  
Data: Information that is translated, processed, or stored by a computer  
Data at rest: Data not currently being accessed  
Data in transit: Data traveling from one point to another  
Data in use: Data being accessed by one or more users  
Data custodian: Anyone or anything that’s responsible for the safe handling,  
transport, and storage of information  
Data owner: The person that decides who can access, edit, use, or destroy their  
information  
Defense in depth: A layered approach to vulnerability management that reduces risk  
Digital certificate: A file that verifies the identity of a public key holder  
DOM-based XSS attack: An instance when malicious script exists in the webpage a  
browser loads  
Dropper: A type of malware that comes packed with malicious code which is delivered  
and installed onto a target system

##   
E

  
Encryption: The process of converting data from a readable format to an encoded  
format  
Exploit: A way of taking advantage of a vulnerability

Exposure: A mistake that can be exploited by a threat

##   
F

  
Fileless malware: Malware that does not need to be installed by the user because it  
uses legitimate programs that are already installed to infect a computer

##   
H

  
Hacker: Any person who uses computers to gain access to computer systems,  
networks, or data  
Hash collision: An instance when different inputs produce the same hash value  
Hash function: An algorithm that produces a code that can’t be decrypted  
Hash table: A data structure that's used to store and reference hash values

##   
I

  
Identity and access management (IAM): A collection of processes and technologies  
that helps organizations manage digital identities in their environment  
Information privacy: The protection of unauthorized access and distribution of data  
Information security (InfoSec): The practice of keeping data in all states away from  
unauthorized users  
Injection attack: Malicious code inserted into a vulnerable application  
Input validation: Programming that validates inputs from users and other programs  
Intrusion detection system (IDS): An application that monitors system activity and  
alerts on possible intrusions

##   
L

  
Loader: A type of malware that downloads strains of malicious code from an external  
source and installs them onto a target system

## M

  
Malware: Software designed to harm devices or networks  
MITRE: A collection of non-profit research and development centers  
Multi-factor authentication (MFA): A technology that requires at least two distinct  
forms of identification

##   
N

  
National Institute of Standards and Technology (NIST) Cybersecurity Framework  
(CSF): A voluntary framework that consists of standards, guidelines, and best  
practices to manage cybersecurity risk  
Non-repudiation: The concept that the authenticity of information can’t be denied

##   
O

  
OAuth: An open-standard authorization protocol that shares designated access  
between applications

##   
P

  
Process of Attack Simulation and Threat Analysis (PASTA): A popular threat  
modeling framework that’s used across many industries  
Payment Card Industry Data Security Standards (PCI DSS): A set of security  
standards formed by major organizations in the financial industry  
Personally identifiable information (PII): Any information used to infer an individual's  
identity  
Phishing: The use of digital communications to trick people into revealing sensitive  
data or deploying malicious software  
Phishing kit: A collection of software tools needed to launch a phishing campaign  
Policy: A set of rules that reduce risk and protect information

Potentially unwanted application (PUA): A type of unwanted software that is  
bundled in with legitimate programs which might display ads, cause device slowdown,  
or install other software  
Prepared statement: A coding technique that executes SQL statements before  
passing them onto the database  
Principle of least privilege: The concept of granting only the minimal access and  
authorization required to complete a task or function  
Procedures: Step-by-step instructions to perform a specific security task  
Protected health information (PHI): Information that relates to the past, present, or  
future physical or mental health or condition of an individual  
Public key infrastructure (PKI): An an encryption framework that secures the  
exchange of online information

##   
Q

  
Quid pro quo: A type of baiting used to trick someone into believing that they’ll be  
rewarded in return for sharing access, information, or money

##   
R

  
Rainbow table: A file of pre-generated hash values and their associated plaintext  
Ransomware: Type of malicious attack where attackers encrypt an organization’s data  
and demand payment to restore access  
Regulations: Rules set by a government or other authority to control the way  
something is done  
Reflected XSS attack: An instance when malicious script is sent to a server and  
activated during the server’s response  
Risk: Anything that can impact confidentiality, integrity, or availability of an asset  
Rootkit: Malware that provides remote, administrative access to a computer

##   
S

Salting: An additional safeguard that’s used to strengthen hash functions  
Scareware: Malware that employs tactics to frighten users into infecting their device  
Security assessment: A check to determined how resilient current security  
implementations against threats  
Security audit: A review of an organization's security controls, policies, and  
procedures against a set of expectations  
Security controls: Safeguards designed to reduce specific security risks  
Security hardening: The process of strengthening a system to reduce its vulnerability  
and attack surface  
Separation of duties: The principle that users should not be given levels of  
authorization that would allow them to misuse a system  
Session: A sequence of network HTTP basic auth requests and responses associated  
with the same user  
Session cookie: A token that websites use to validate a session and determine how  
long that session should last  
Session hijacking: An event when attackers obtain a legitimate user’s session ID  
Session ID: A unique token that identifies a user and their device while accessing a  
system  
Single sign-on (SSO): A technology that combines several different logins into one  
Smishing: The use of text messages to trick users to obtain sensitive information or to  
impersonate a known source  
Social engineering: A manipulation technique that exploits human error to gain  
private information, access, or valuables  
Spear phishing: A malicious email attack targeting a specific user or group of users,  
appearing to originate from a trusted source  
Spyware: Malware that’s used to gather and sell information without consent  
SQL (Structured Query Language): A programming language used to create, interact  
with, and request information from a database

SQL injection: An attack that executes unexpected queries on a database  
Standards: References that inform how to set policies  
Stored XSS attack: An instance when a malicious script is injected directly on the  
server  
SQL (Structured Query Language): A programming language used to create, interact  
with, and request information from a database  
Symmetric encryption: The use of a single secret key to exchange information

##   
T

  
Tailgating: A social engineering tactic in which unauthorized people follow an  
authorized person into a restricted area  
Threat: Any circumstance or event that can negatively impact assets  
Threat actor: Any person or group who presents a security risk  
Threat modeling: The process of identifying assets, their vulnerabilities, and how each  
is exposed to threats  
Trojan horse: Malware that looks like a legitimate file or program

##   
U

  
User provisioning: The process of creating and maintaining a user's digital identity

##   
V

  
Virus: Malicious code written to interfere with computer operations and cause damage  
to data and software  
Vishing: The exploitation of electronic voice communication to obtain sensitive  
information or to impersonate a known source  
Vulnerability: A weakness that can be exploited by a threat

Vulnerability scanner: Software that automatically compares existing common  
vulnerabilities and exposures against the technologies on the network  
Vulnerability assessment: The internal review process of a company’s security  
systems  
Vulnerability management: The process of finding and patching vulnerabilities

##   
W

  
Watering hole attack: A type of attack when a threat actor compromises a website  
frequently visited by a specific group of users  
Whaling: A category of spear phishing attempts that are aimed at high-ranking  
executives in an organization  
Web-based exploits: Malicious code or behavior that’s used to take advantage of  
coding flaws in a web application  
Worm: Malware that can duplicate and spread itself across systems on its own

##   
Z

  
Zero-day: An exploit that was previously unknown