Terms and definitions from Course 5

Cybersecurity Glossary

A

Access controls: Security controls that manage access, authorization, and
accountability of information
Adware: A type of legitimate software that is sometimes used to display digital
advertisements in applications
Advanced persistent threat (APT): An instance when a threat actor maintains
unauthorized access to a system for an extended period of time
Algorithm: A set of rules used to solve a problem
Angler phishing: A technique where attackers impersonate customer service
representatives on social media
Application programming interface (API) token: A small block of encrypted code
that contains information about a user
Asset: An item perceived as having value to an organization
Asset classification: The practice of labeling assets based on sensitivity and
importance to an organization
Asset inventory: A catalog of assets that need to be protected
Asset management: The process of tracking assets and the risks that affect them
Asymmetric encryption: The use of a public and private key pair for encryption and
decryption of data
Attack surface: The characteristics and features of the areas where an attack can
come from

Attack tree: A diagram that maps threats to assets
Attack vector: The pathways attackers use to penetrate security defenses

B

Baiting: A social engineering tactic that tempts people into compromising their
security
Basic auth: The technology used to establish a user’s request to access a server
Bit: The smallest unit of data measurement on a computer
Botnet: A collection of computers infected by malware that are under the control of a
single threat actor, known as the “bot-herder"
Brute force attack: The trial and error process of discovering private information
Bug bounty: Programs that encourage freelance hackers to find and report
vulnerabilities

C

Cipher: An algorithm that encrypts information
Common Vulnerabilities and Exposures (CVE®) list: An openly accessible dictionary
of known vulnerabilities and exposures
Common Vulnerability Scoring System (CVSS): A measurement system that scores
the severity of a vulnerability
Compliance: The process of adhering to internal standards and external regulations
Computer virus: see “virus”
Cross-site scripting (XSS): An injection attack that inserts code into a vulnerable
website or web application
Cryptojacking: A form of malware that installs software to illegally mine
cryptocurrencies

Cryptographic key: A mechanism that decrypts ciphertext
Cryptography: The process of transforming information into a form that unintended
readers can’t understand
CVE Numbering Authority (CNA): An organization that volunteers to analyze and
distribute information on eligible CVEs

D

Data: Information that is translated, processed, or stored by a computer
Data at rest: Data not currently being accessed
Data in transit: Data traveling from one point to another
Data in use: Data being accessed by one or more users
Data custodian: Anyone or anything that’s responsible for the safe handling,
transport, and storage of information
Data owner: The person that decides who can access, edit, use, or destroy their
information
Defense in depth: A layered approach to vulnerability management that reduces risk
Digital certificate: A file that verifies the identity of a public key holder
DOM-based XSS attack: An instance when malicious script exists in the webpage a
browser loads
Dropper: A type of malware that comes packed with malicious code which is delivered
and installed onto a target system

E

Encryption: The process of converting data from a readable format to an encoded
format
Exploit: A way of taking advantage of a vulnerability

Exposure: A mistake that can be exploited by a threat

F

Fileless malware: Malware that does not need to be installed by the user because it
uses legitimate programs that are already installed to infect a computer

H

Hacker: Any person who uses computers to gain access to computer systems,
networks, or data
Hash collision: An instance when different inputs produce the same hash value
Hash function: An algorithm that produces a code that can’t be decrypted
Hash table: A data structure that's used to store and reference hash values

I

Identity and access management (IAM): A collection of processes and technologies
that helps organizations manage digital identities in their environment
Information privacy: The protection of unauthorized access and distribution of data
Information security (InfoSec): The practice of keeping data in all states away from
unauthorized users
Injection attack: Malicious code inserted into a vulnerable application
Input validation: Programming that validates inputs from users and other programs
Intrusion detection system (IDS): An application that monitors system activity and
alerts on possible intrusions

L

Loader: A type of malware that downloads strains of malicious code from an external
source and installs them onto a target system

M

Malware: Software designed to harm devices or networks
MITRE: A collection of non-profit research and development centers
Multi-factor authentication (MFA): A technology that requires at least two distinct
forms of identification

N

National Institute of Standards and Technology (NIST) Cybersecurity Framework
(CSF): A voluntary framework that consists of standards, guidelines, and best
practices to manage cybersecurity risk
Non-repudiation: The concept that the authenticity of information can’t be denied

O

OAuth: An open-standard authorization protocol that shares designated access
between applications

P

Process of Attack Simulation and Threat Analysis (PASTA): A popular threat
modeling framework that’s used across many industries
Payment Card Industry Data Security Standards (PCI DSS): A set of security
standards formed by major organizations in the financial industry
Personally identifiable information (PII): Any information used to infer an individual's
identity
Phishing: The use of digital communications to trick people into revealing sensitive
data or deploying malicious software
Phishing kit: A collection of software tools needed to launch a phishing campaign
Policy: A set of rules that reduce risk and protect information

Potentially unwanted application (PUA): A type of unwanted software that is
bundled in with legitimate programs which might display ads, cause device slowdown,
or install other software
Prepared statement: A coding technique that executes SQL statements before
passing them onto the database
Principle of least privilege: The concept of granting only the minimal access and
authorization required to complete a task or function
Procedures: Step-by-step instructions to perform a specific security task
Protected health information (PHI): Information that relates to the past, present, or
future physical or mental health or condition of an individual
Public key infrastructure (PKI): An an encryption framework that secures the
exchange of online information

Q

Quid pro quo: A type of baiting used to trick someone into believing that they’ll be
rewarded in return for sharing access, information, or money

R

Rainbow table: A file of pre-generated hash values and their associated plaintext
Ransomware: Type of malicious attack where attackers encrypt an organization’s data
and demand payment to restore access
Regulations: Rules set by a government or other authority to control the way
something is done
Reflected XSS attack: An instance when malicious script is sent to a server and
activated during the server’s response
Risk: Anything that can impact confidentiality, integrity, or availability of an asset
Rootkit: Malware that provides remote, administrative access to a computer

S

 

Salting: An additional safeguard that’s used to strengthen hash functions
Scareware: Malware that employs tactics to frighten users into infecting their device
Security assessment: A check to determined how resilient current security
implementations against threats
Security audit: A review of an organization's security controls, policies, and
procedures against a set of expectations
Security controls: Safeguards designed to reduce specific security risks
Security hardening: The process of strengthening a system to reduce its vulnerability
and attack surface
Separation of duties: The principle that users should not be given levels of
authorization that would allow them to misuse a system
Session: A sequence of network HTTP basic auth requests and responses associated
with the same user
Session cookie: A token that websites use to validate a session and determine how
long that session should last
Session hijacking: An event when attackers obtain a legitimate user’s session ID
Session ID: A unique token that identifies a user and their device while accessing a
system
Single sign-on (SSO): A technology that combines several different logins into one
Smishing: The use of text messages to trick users to obtain sensitive information or to
impersonate a known source
Social engineering: A manipulation technique that exploits human error to gain
private information, access, or valuables
Spear phishing: A malicious email attack targeting a specific user or group of users,
appearing to originate from a trusted source
Spyware: Malware that’s used to gather and sell information without consent
SQL (Structured Query Language): A programming language used to create, interact
with, and request information from a database

SQL injection: An attack that executes unexpected queries on a database
Standards: References that inform how to set policies
Stored XSS attack: An instance when a malicious script is injected directly on the
server
SQL (Structured Query Language): A programming language used to create, interact
with, and request information from a database
Symmetric encryption: The use of a single secret key to exchange information

T

Tailgating: A social engineering tactic in which unauthorized people follow an
authorized person into a restricted area
Threat: Any circumstance or event that can negatively impact assets
Threat actor: Any person or group who presents a security risk
Threat modeling: The process of identifying assets, their vulnerabilities, and how each
is exposed to threats
Trojan horse: Malware that looks like a legitimate file or program

U

User provisioning: The process of creating and maintaining a user's digital identity

V

Virus: Malicious code written to interfere with computer operations and cause damage
to data and software
Vishing: The exploitation of electronic voice communication to obtain sensitive
information or to impersonate a known source
Vulnerability: A weakness that can be exploited by a threat

Vulnerability scanner: Software that automatically compares existing common
vulnerabilities and exposures against the technologies on the network
Vulnerability assessment: The internal review process of a company’s security
systems
Vulnerability management: The process of finding and patching vulnerabilities

W

Watering hole attack: A type of attack when a threat actor compromises a website
frequently visited by a specific group of users
Whaling: A category of spear phishing attempts that are aimed at high-ranking
executives in an organization
Web-based exploits: Malicious code or behavior that’s used to take advantage of
coding flaws in a web application
Worm: Malware that can duplicate and spread itself across systems on its own

Z

Zero-day: An exploit that was previously unknown