Cybersecurity Glossary

Attacks and threats

• Business Email Compromise (BEC) — fraud in which an attacker impersonates an executive, supplier or colleague by email to trigger a payment or data disclosure. Usually financial rather than technical in nature. See DMARC.
• Brute force — repeatedly guessing credentials until one works. Countered by strong passwords, lockouts and multi-factor authentication.
• Credential stuffing — using username and password pairs stolen from one breach against other services, exploiting password reuse.
• DDoS — Distributed Denial of Service: overwhelming a service with traffic from many sources so legitimate users cannot reach it.
• Fileless attack — an attack running in memory or abusing legitimate tools already present, leaving no malicious file for antivirus to detect.
• Lateral movement — an attacker moving from an initially compromised device to more valuable systems. The main reason segmentation matters.
• Living off the land — abusing built-in tools such as PowerShell or WMI rather than deploying malware, making detection harder.
• Phishing — fraudulent messages designed to steal credentials or deliver malware. Spear phishing targets a specific individual with tailored detail.
• Ransomware — malware that encrypts data and demands payment. Modern variants also steal data first and threaten publication.
• Social engineering — manipulating people rather than technology to gain access.
• Supply chain attack — compromising a supplier or software vendor to reach their customers.
• Zero-day — a vulnerability with no vendor patch available at the time it is exploited.

Defences and controls

• Antivirus / EPP — software detecting malicious files on a device. See EDR vs antivirus.
• DKIM — cryptographic signing of outbound email proving it genuinely came from your domain.
• DMARC — policy telling receivers what to do with email failing authentication. See what is DMARC.
• EDR — Endpoint Detection and Response: continuous endpoint monitoring with investigation and response capability.
• Firewall — control governing which traffic may cross a network boundary. See what is a firewall.
• IDS / IPS — Intrusion Detection and Prevention: recognises attack patterns in traffic; IPS blocks, IDS only alerts.
• Least privilege — granting the minimum access necessary for a role.
• MFA — Multi-Factor Authentication: requiring more than a password. One of the highest-value controls available.
• NGFW — Next-Generation Firewall: application- and identity-aware with integrated IPS. See NGFW vs UTM.
• SIEM — Security Information and Event Management: centralised log collection and correlation.
• SOAR — automation of repetitive investigation and response tasks.
• SPF — DNS record listing which servers may send email for your domain.
• TLS inspection — decrypting encrypted traffic so it can be inspected, then re-encrypting it.
• WAF — Web Application Firewall: inspects HTTP requests to block application attacks such as SQL injection.
• XDR — Extended Detection and Response: correlates endpoint, network, identity and cloud telemetry.
• Zero trust — never trust, always verify. See what is zero trust.
• ZTNA — Zero Trust Network Access: grants access to specific applications rather than the whole network.

Testing and assurance

• Penetration test — human-led exercise exploiting weaknesses to prove real impact.
• Red team — goal-based adversary simulation testing detection and response, not just vulnerabilities.
• Blue team — the defenders. Purple team — red and blue working together to improve detection.
• Vulnerability assessment — automated discovery and ranking of known weaknesses.
• VAPT — the two combined. See what is VAPT.
• CVE — a public identifier for a specific known vulnerability.
• CVSS — a scoring system rating vulnerability severity from 0 to 10. Useful, but no substitute for business context.

Networking

• BGP / OSPF — routing protocols determining how traffic traverses networks.
• DMZ — a network zone for internet-facing services, isolated from the internal network.
• HSRP / VRRP — protocols providing gateway redundancy so one device failure does not break connectivity.
• NAT — Network Address Translation: mapping private addresses to public ones.
• SD-WAN — software-defined WAN steering traffic across multiple links. See what is SD-WAN.
• VLAN — a logically separate network on shared physical switching.
• VPN — an encrypted tunnel carrying traffic securely across an untrusted network.

Operations

• MDR — Managed Detection and Response: outsourced monitoring and response.
• SOC — Security Operations Centre. See what is a SOC.
• RTO / RPO — Recovery Time Objective (how quickly you must be back) and Recovery Point Objective (how much data you can afford to lose). Both should be defined before an incident, not during one.
• Threat hunting — proactively searching for intrusions that produced no alert.
• 3-2-1 backup — three copies, on two media types, one offsite. Add immutability for ransomware resilience.