Cybersecurity Glossary
25 essential terms — because precise language is the foundation of clear thinking in Cybersecurity.
Showing 25 of 25 terms
Policies and mechanisms that restrict who or what can view or use resources in a computing environment, based on identity and authorization level.
The process of verifying the identity of a user, device, or system before granting access to resources.
A network of compromised computers (bots or zombies) controlled remotely by an attacker, often used for DDoS attacks or spam distribution.
An attack method that attempts every possible combination of credentials or keys until the correct one is found.
The encrypted, unreadable form of data after an encryption algorithm has been applied to plaintext.
A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attack that floods a target with traffic from many distributed sources to overwhelm its resources and make it unavailable.
The process of converting data into an encoded format that can only be decoded by authorized parties possessing the correct key.
A piece of code, software, or technique that takes advantage of a vulnerability to gain unauthorized access or cause unintended behavior.
A network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules.
A one-way function that converts data into a fixed-length string of characters, used for verifying data integrity and storing passwords securely.
The organized approach to addressing and managing the aftermath of a security breach or cyberattack to minimize damage and recovery time.
A system that monitors network traffic or host activities for suspicious behavior and generates alerts when potential threats are detected.
Any software intentionally designed to cause damage to a computer, server, client, or network, including viruses, worms, trojans, and ransomware.
A software update issued to fix security vulnerabilities, bugs, or other issues in an application or operating system.
An authorized simulated attack on a computer system to evaluate its security by identifying exploitable vulnerabilities.
A social engineering attack that uses deceptive communications to trick individuals into revealing sensitive information or installing malware.
A framework of roles, policies, hardware, software, and procedures for creating, managing, distributing, and revoking digital certificates.
Malware that encrypts a victim's data and demands payment for the decryption key, often spreading through phishing or unpatched vulnerabilities.
A code injection technique that exploits vulnerabilities in an application's database layer by inserting malicious SQL statements through user input.
A cryptographic protocol that provides end-to-end encryption for data transmitted over a network, commonly used to secure web traffic (HTTPS).
A weakness in a system, application, or process that can be exploited by a threat actor to gain unauthorized access or cause harm.
A previously unknown vulnerability in software or hardware that has not yet been patched by the vendor, leaving systems exposed to potential exploitation.