Glossary
Allen's info-sec Agency
TABLE OF CONTENTS
A
Access Control
Definition: Access control is the process of managing which users, systems, or devices are permitted to view or interact with protected resources. It is a foundational security practice that ensures data is only accessible to authorized individuals. Well designed access control reduces the risk of unauthorized access and data misuse.
Use Case: Strong access control prevented employees without proper clearance from opening confidential documents during an internal audit. The security team also used access logs to verify that no unauthorized attempts were made during the period. This helped maintain full compliance with data protection policies.
Use Case: Strong access control prevented employees without proper clearance from opening confidential documents during an internal audit. The security team also used access logs to verify that no unauthorized attempts were made during the period. This helped maintain full compliance with data protection policies.
Attack Surface
Definition: The attack surface refers to all possible entry points where a system or network can be compromised. This includes software, hardware, network exposures, user accounts, and even physical vulnerabilities. Reducing the attack surface helps limit the number of opportunities available to attackers.
Use Case: The IT team minimized the attack surface by removing outdated applications and disabling unused network ports. They also reviewed user permissions to ensure only essential accounts remained active. As a result, external scanning tools detected far fewer exploitable entry points.
Use Case: The IT team minimized the attack surface by removing outdated applications and disabling unused network ports. They also reviewed user permissions to ensure only essential accounts remained active. As a result, external scanning tools detected far fewer exploitable entry points.
Authentication
Definition: Authentication is the process of verifying the identity of a user or system before granting access to resources. It ensures that only legitimate individuals can log in or perform authorized actions. Modern authentication often uses passwords, biometrics, or multi factor verification to strengthen identity checks.
Use Case: Multi factor authentication blocked a credential stuffing attempt when attackers tried thousands of stolen passwords. Although several passwords matched, the additional verification step stopped unauthorized access. This reduced risk from reused credentials across different services.
Use Case: Multi factor authentication blocked a credential stuffing attempt when attackers tried thousands of stolen passwords. Although several passwords matched, the additional verification step stopped unauthorized access. This reduced risk from reused credentials across different services.
Authorization
Definition: Authorization determines what an authenticated user is allowed to access or perform within a system. It defines permissions, roles, and the scope of actions permitted for each identity. Strong authorization safeguards prevent users from performing tasks outside their intended responsibilities.
Use Case: Updated authorization rules stopped employees from editing administrative settings that fell outside their assigned roles. The system logged attempted violations, helping the team identify accounts that required permission adjustments. This ensured a more secure access structure across departments.
Use Case: Updated authorization rules stopped employees from editing administrative settings that fell outside their assigned roles. The system logged attempted violations, helping the team identify accounts that required permission adjustments. This ensured a more secure access structure across departments.
Antivirus
Definition: Antivirus software detects, blocks, and removes malicious programs that attempt to infect a device or system. It uses signature databases, behavioral analysis, and heuristics to identify known and unknown threats. Regular updates allow antivirus tools to stay effective against evolving malware.
Use Case: The antivirus system quarantined a suspicious file before it could run any harmful code. Analysts later confirmed that the file contained ransomware disguised as a PDF document. The early detection prevented a widespread infection across employee laptops.
Use Case: The antivirus system quarantined a suspicious file before it could run any harmful code. Analysts later confirmed that the file contained ransomware disguised as a PDF document. The early detection prevented a widespread infection across employee laptops.
API Security
Definition: API security protects application programming interfaces from attacks such as injection attempts, data scraping, and unauthorized requests. As APIs often expose critical business functions, strong security controls ensure integrity and privacy. Proper authentication, rate limiting, and input validation help safeguard API endpoints.
Use Case: API security tools detected and blocked unauthorized attempts to access customer account data from an unknown IP range. Developers also increased logging to monitor access patterns in real time. This reduced the risk of data scraping and brute force attacks targeting the interface.
Use Case: API security tools detected and blocked unauthorized attempts to access customer account data from an unknown IP range. Developers also increased logging to monitor access patterns in real time. This reduced the risk of data scraping and brute force attacks targeting the interface.
Asset Inventory
Definition: Asset inventory is the complete and organized listing of all hardware, software, applications, and network devices within an organization. Maintaining an accurate inventory helps security teams track vulnerabilities and manage updates effectively. It also supports compliance audits and risk assessments.
Use Case: The asset inventory revealed several unpatched workstations that were missed during the previous update cycle. Technicians quickly applied missing security updates and documented the devices for future tracking. This reduced the number of unmanaged assets in the environment.
Use Case: The asset inventory revealed several unpatched workstations that were missed during the previous update cycle. Technicians quickly applied missing security updates and documented the devices for future tracking. This reduced the number of unmanaged assets in the environment.
Access Logs
Definition: Access logs record which users accessed which systems, resources, or files at specific times. They provide essential audit trails for security investigations and compliance requirements. Proper log management helps detect unauthorized activity quickly.
Use Case: When sensitive data was viewed without authorization, analysts reviewed access logs to identify the responsible account. The logs revealed that a compromised user account had been used for the activity. Immediate action helped contain the incident and prevent additional misuse.
Use Case: When sensitive data was viewed without authorization, analysts reviewed access logs to identify the responsible account. The logs revealed that a compromised user account had been used for the activity. Immediate action helped contain the incident and prevent additional misuse.
Anomaly Detection
Definition: Anomaly detection identifies unusual or unexpected patterns in system behavior that may indicate security threats. It relies on baselines and behavioral models to detect deviations. This approach helps uncover hidden attacks that bypass traditional alerts.
Use Case: An anomaly detection tool flagged a device that suddenly began uploading large volumes of data. Investigators discovered a malware program attempting to exfiltrate sensitive files. Early detection prevented further data leakage.
Use Case: An anomaly detection tool flagged a device that suddenly began uploading large volumes of data. Investigators discovered a malware program attempting to exfiltrate sensitive files. Early detection prevented further data leakage.
Application Hardening
Definition: Application hardening strengthens software by removing weak components, applying security controls, and limiting potential attack vectors. It reduces opportunities for exploitation by tightening internal and external functions. Hardening helps secure applications before deployment.
Use Case: The IT team hardened the organization’s financial application by disabling unnecessary APIs and adding stricter authentication. These changes prevented attackers from exploiting previously accessible endpoints. Regular hardening reviews were scheduled to maintain protection.
Use Case: The IT team hardened the organization’s financial application by disabling unnecessary APIs and adding stricter authentication. These changes prevented attackers from exploiting previously accessible endpoints. Regular hardening reviews were scheduled to maintain protection.
Attack Vector
Definition: An attack vector is the path or method used by an attacker to breach a system. Common vectors include phishing emails, exploited vulnerabilities, and malicious downloads. Understanding attack vectors helps organizations improve defenses.
Use Case: A forensic review revealed that email attachments were the primary attack vector in a recent intrusion. Security teams enhanced email filtering and trained employees to recognize suspicious messages. As a result, attempted attacks decreased noticeably.
Use Case: A forensic review revealed that email attachments were the primary attack vector in a recent intrusion. Security teams enhanced email filtering and trained employees to recognize suspicious messages. As a result, attempted attacks decreased noticeably.
B
Backup Recovery
Definition: Backup recovery is the process of restoring data, applications, and systems from stored backups after a failure, attack, or corruption event. It acts as a safety net that allows organizations to maintain continuity even during major disruptions. Effective backup strategies involve regular testing and secure storage.
Use Case: After a ransomware incident encrypted several servers, backup recovery restored all critical systems within hours. Because the team tested their recovery process regularly, restoration went smoothly without data loss. This prevented prolonged downtime and eliminated the need to negotiate with attackers.
Use Case: After a ransomware incident encrypted several servers, backup recovery restored all critical systems within hours. Because the team tested their recovery process regularly, restoration went smoothly without data loss. This prevented prolonged downtime and eliminated the need to negotiate with attackers.
Behavioral Analytics
Definition: Behavioral analytics monitors user activity to identify unusual patterns that may indicate malicious behavior or compromised accounts. It uses machine learning to understand normal behavior and highlight deviations. These insights help detect threats that traditional systems may miss.
Use Case: Behavioral analytics alerted administrators to an employee account logging in from a foreign country at an unusual hour. Additional investigation revealed that the account had been compromised. Immediate action stopped further unauthorized access.
Use Case: Behavioral analytics alerted administrators to an employee account logging in from a foreign country at an unusual hour. Additional investigation revealed that the account had been compromised. Immediate action stopped further unauthorized access.
Bot Mitigation
Definition: Bot mitigation involves tools and methods that detect and block automated attacks such as credential stuffing, scraping, or fake account creation. Many attacks begin with bots probing for weaknesses or performing repetitive actions faster than humans. Effective bot controls reduce noise and prevent abuse.
Use Case: Bot mitigation tools blocked thousands of fake account creation attempts from automated scripts. The system also flagged several IP addresses that attempted repeated login failures. This prevented attackers from testing stolen passwords at scale.
Use Case: Bot mitigation tools blocked thousands of fake account creation attempts from automated scripts. The system also flagged several IP addresses that attempted repeated login failures. This prevented attackers from testing stolen passwords at scale.
Brute Force Attack
Definition: A brute force attack is a method where attackers try multiple username and password combinations until they find a correct match. It relies on repetition, automation, and weak credentials to succeed. Rate limiting and strong authentication methods help defend against this attack.
Use Case: Rate limiting restricted repeated login attempts on user accounts, stopping a brute force attack before any credentials were compromised. Alerts informed security analysts of the attempted intrusion. The team added additional protections for high value accounts.
Use Case: Rate limiting restricted repeated login attempts on user accounts, stopping a brute force attack before any credentials were compromised. Alerts informed security analysts of the attempted intrusion. The team added additional protections for high value accounts.
Baseline Security
Definition: Baseline security refers to the minimum required protections and configurations that every system must have. It ensures consistent security practices across all devices and applications. Baselines act as a foundational safeguard against common threats.
Use Case: The organization enforced baseline security standards on all new servers to eliminate weak default settings. Regular compliance scans ensured no system drifted from these requirements. This consistency reduced the risk of misconfigurations.
Use Case: The organization enforced baseline security standards on all new servers to eliminate weak default settings. Regular compliance scans ensured no system drifted from these requirements. This consistency reduced the risk of misconfigurations.
C
Certificate Pinning
Definition: Certificate pinning is a security technique that binds an application to a specific SSL certificate or public key. This prevents attackers from using forged or fraudulent certificates to intercept communications. Pinning adds an extra layer of trust for mobile and web applications.
Use Case: Certificate pinning prevented a man in the middle attack when an attacker attempted to intercept mobile app traffic using a fake certificate. The app rejected the connection immediately. Users continued to communicate securely with the legitimate server.
Use Case: Certificate pinning prevented a man in the middle attack when an attacker attempted to intercept mobile app traffic using a fake certificate. The app rejected the connection immediately. Users continued to communicate securely with the legitimate server.
Cloud Security
Definition: Cloud security encompasses policies, technologies, and procedures that protect cloud based systems, data, and infrastructure from threats. It includes access control, encryption, monitoring, and compliance management. Effective cloud security requires shared responsibility between the cloud provider and the customer.
Use Case: Cloud security rules blocked login attempts from unfamiliar geographic regions after detecting suspicious behavior. Administrators tightened access controls and enabled multi factor authentication. This reduced the number of unauthorized access alerts across cloud platforms.
Use Case: Cloud security rules blocked login attempts from unfamiliar geographic regions after detecting suspicious behavior. Administrators tightened access controls and enabled multi factor authentication. This reduced the number of unauthorized access alerts across cloud platforms.
Configuration Hardening
Definition: Configuration hardening strengthens systems by tightening default settings, removing unnecessary features, and disabling insecure functions. Hardening reduces the number of vulnerabilities that attackers can exploit. It is an essential step during system deployment.
Use Case: After configuration hardening, several servers showed far fewer open ports during security scans. Unused services were disabled, reducing the likelihood of external attacks. Routine reviews ensured that settings remained secure as systems evolved.
Use Case: After configuration hardening, several servers showed far fewer open ports during security scans. Unused services were disabled, reducing the likelihood of external attacks. Routine reviews ensured that settings remained secure as systems evolved.
Cyber Hygiene
Definition: Cyber hygiene refers to the set of basic security practices that help maintain a strong cybersecurity posture. These include regular updates, password management, monitoring, and safe browsing habits. Good cyber hygiene reduces the likelihood of human driven security incidents.
Use Case: Improved cyber hygiene practices reduced employee related security incidents by more than half. Staff began using password managers and updating software promptly. This created a more secure environment with fewer preventable vulnerabilities.
Use Case: Improved cyber hygiene practices reduced employee related security incidents by more than half. Staff began using password managers and updating software promptly. This created a more secure environment with fewer preventable vulnerabilities.
Cyber Threat Intelligence (CTI)
Definition: Cyber threat intelligence consists of data and analysis that help organizations understand existing and emerging cyber threats. It covers attacker motives, techniques, and indicators of compromise. CTI helps security teams make informed decisions and respond proactively.
Use Case: CTI reports warned the organization of a phishing campaign targeting companies within the same industry. The team updated email filters and issued an internal alert. As a result, multiple attempted attacks were blocked before reaching employees.
Use Case: CTI reports warned the organization of a phishing campaign targeting companies within the same industry. The team updated email filters and issued an internal alert. As a result, multiple attempted attacks were blocked before reaching employees.
Credential Theft
Definition: Credential theft occurs when attackers steal usernames, passwords, or authentication tokens through tactics such as phishing, keylogging, or malware. Stolen credentials allow unauthorized access to sensitive systems. This threat is a major contributor to modern breaches.
Use Case: When multiple login attempts appeared from foreign locations, investigators discovered that employee credentials had been stolen. Password resets and session revocations stopped unauthorized access. Additional MFA requirements were added to reduce future risks.
Use Case: When multiple login attempts appeared from foreign locations, investigators discovered that employee credentials had been stolen. Password resets and session revocations stopped unauthorized access. Additional MFA requirements were added to reduce future risks.
D
Data Encryption
Definition: Data encryption converts readable information into an unreadable format using cryptographic algorithms. Only authorized parties with the appropriate key can decrypt the data. Encryption protects sensitive information during storage and transmission.
Use Case: Encryption protected customer records during a database breach, preventing attackers from viewing personal information. Even though the files were accessed, decrypting them without the key was not possible. This helped the organization avoid major regulatory penalties.
Use Case: Encryption protected customer records during a database breach, preventing attackers from viewing personal information. Even though the files were accessed, decrypting them without the key was not possible. This helped the organization avoid major regulatory penalties.
Data Masking
Definition: Data masking hides sensitive information by replacing it with fictitious or obfuscated values while preserving overall format and usability. It allows teams to work with realistic datasets without exposing private details. Masking is commonly used in testing and analytics environments.
Use Case: Developers safely accessed masked production data to troubleshoot application issues without viewing real customer information. The masking process protected personally identifiable data while still enabling accurate testing. This reduced the risk of accidental exposure.
Use Case: Developers safely accessed masked production data to troubleshoot application issues without viewing real customer information. The masking process protected personally identifiable data while still enabling accurate testing. This reduced the risk of accidental exposure.
Data Minimization
Definition: Data minimization is the practice of collecting and storing only the information that is strictly necessary for business operations. Reducing stored data lowers the risk of exposure and improves compliance. It helps limit the impact of potential breaches.
Use Case: The organization reduced the amount of personal data stored in its CRM by removing outdated or unnecessary fields. This lowered compliance risks and made data management more efficient. Security teams reported fewer sensitive assets requiring protection.
Use Case: The organization reduced the amount of personal data stored in its CRM by removing outdated or unnecessary fields. This lowered compliance risks and made data management more efficient. Security teams reported fewer sensitive assets requiring protection.
Data Redaction
Definition: Data redaction involves removing or obscuring sensitive information before documents or files are shared. It ensures that confidential details remain hidden from unauthorized viewers. Redaction is frequently used in legal, compliance, and public records environments.
Use Case: Sensitive client information was redacted before documents were shared with an external legal team. This prevented exposure of names, addresses, and financial details. The redaction process enabled collaboration without compromising privacy.
Use Case: Sensitive client information was redacted before documents were shared with an external legal team. This prevented exposure of names, addresses, and financial details. The redaction process enabled collaboration without compromising privacy.
Data Residency
Definition: Data residency refers to the geographic location where data is stored, which may affect regulatory compliance and privacy protections. Organizations often choose storage locations that align with legal and industry requirements. Understanding residency rules is critical for global operations.
Use Case: The company selected an EU based data center to ensure compliance with GDPR. This decision reduced legal risk and simplified international data management. Regulators confirmed that the company met location specific storage requirements.
Use Case: The company selected an EU based data center to ensure compliance with GDPR. This decision reduced legal risk and simplified international data management. Regulators confirmed that the company met location specific storage requirements.
Data Tokenization
Definition: Data tokenization replaces sensitive data with randomly generated tokens that hold no exploitable value. The original data is stored securely in a dedicated vault. Tokenization helps reduce exposure during processing and transactions.
Use Case: Tokenization protected customer card numbers during payment processing by ensuring only tokens were transmitted. Even if intercepted, the tokens revealed nothing about the original data. This greatly improved compliance with payment security standards.
Use Case: Tokenization protected customer card numbers during payment processing by ensuring only tokens were transmitted. Even if intercepted, the tokens revealed nothing about the original data. This greatly improved compliance with payment security standards.
Decryption
Definition: Decryption is the process of converting encrypted data back into its readable form using the correct cryptographic key. It allows authorized users or systems to access protected information. Decryption is essential for secure communication and data retrieval.
Use Case: Only authorized servers were allowed to decrypt sensitive medical records stored in the database. This prevented staff without proper permission from viewing patient information. Access logs showed that all decryption events followed compliance rules.
Use Case: Only authorized servers were allowed to decrypt sensitive medical records stored in the database. This prevented staff without proper permission from viewing patient information. Access logs showed that all decryption events followed compliance rules.
Digital Forensics
Definition: Digital forensics involves collecting, analyzing, and preserving electronic evidence related to cybersecurity incidents. It helps investigators understand the cause, impact, and timeline of an attack. Proper forensic techniques maintain the integrity of evidence for legal or regulatory review.
Use Case: Forensic analysts examined system logs and memory artifacts to determine how malware infiltrated a critical server. Their findings identified the attack method and helped prevent similar incidents. The evidence also supported the company’s report to regulators.
Use Case: Forensic analysts examined system logs and memory artifacts to determine how malware infiltrated a critical server. Their findings identified the attack method and helped prevent similar incidents. The evidence also supported the company’s report to regulators.
Disaster Recovery
Definition: Disaster recovery is the structured process of restoring systems, data, and operations after a major disruption such as a cyberattack, hardware failure, or natural disaster. It ensures business continuity by defining clear recovery procedures and responsibilities. Testing recovery plans improves reliability during real emergencies.
Use Case: When a power failure damaged the primary data center, the disaster recovery plan guided the transition to backup systems. Operations were restored within the planned recovery time objective. The company avoided significant downtime and maintained customer trust.
Use Case: When a power failure damaged the primary data center, the disaster recovery plan guided the transition to backup systems. Operations were restored within the planned recovery time objective. The company avoided significant downtime and maintained customer trust.
Distributed Denial of Service (DDoS)
Definition: A Distributed Denial of Service attack overwhelms a system or network with excessive traffic from many sources, making it unavailable to legitimate users. Attackers often use infected devices, known as botnets, to generate massive volumes of requests. Effective DDoS protection requires monitoring, filtering, and traffic control.
Use Case: The organization’s DDoS firewall absorbed millions of malicious requests during an attempted outage. Legitimate users continued accessing services while the system blocked harmful traffic. The attack provided valuable insights that helped refine traffic filtering policies.
Use Case: The organization’s DDoS firewall absorbed millions of malicious requests during an attempted outage. Legitimate users continued accessing services while the system blocked harmful traffic. The attack provided valuable insights that helped refine traffic filtering policies.
DNS Filtering
Definition: DNS filtering blocks users from accessing malicious or unwanted domains by intercepting DNS requests. It acts as a protective layer between users and the broader internet. By preventing connections to harmful sites, DNS filtering reduces phishing and malware risks.
Use Case: DNS filtering stopped employees from visiting fraudulent websites that impersonated financial institutions. Security logs showed that multiple risky domains were automatically blocked. This helped reduce the number of successful phishing attempts inside the organization.
Use Case: DNS filtering stopped employees from visiting fraudulent websites that impersonated financial institutions. Security logs showed that multiple risky domains were automatically blocked. This helped reduce the number of successful phishing attempts inside the organization.
Data Exposure
Definition: Data exposure occurs when sensitive information becomes accessible to unauthorized parties due to misconfigurations or weak security controls. Unlike breaches, exposures may not always involve malicious activity. Exposed data still creates serious legal and operational risks.
Use Case: A misconfigured cloud storage bucket unintentionally exposed customer records. Once discovered, the system was secured and an audit was performed to verify whether the data was accessed externally. Stronger configuration policies were implemented to prevent future incidents.
Use Case: A misconfigured cloud storage bucket unintentionally exposed customer records. Once discovered, the system was secured and an audit was performed to verify whether the data was accessed externally. Stronger configuration policies were implemented to prevent future incidents.
Digital Identity
Definition: A digital identity is the online representation of a user or device, verified through authentication data and attributes. It is essential for determining who can access digital systems. Securing digital identities helps prevent unauthorized access and identity fraud.
Use Case: The company enhanced digital identity protection by requiring MFA for all user accounts. When attackers attempted to log in using leaked passwords, the secondary authentication step blocked them. This significantly reduced account takeover attempts.
Use Case: The company enhanced digital identity protection by requiring MFA for all user accounts. When attackers attempted to log in using leaked passwords, the secondary authentication step blocked them. This significantly reduced account takeover attempts.
E
Endpoint Detection and Response (EDR)
Definition: Endpoint Detection and Response tools continuously monitor devices for suspicious activity and provide real time responses to threats. They combine behavior analysis, threat intelligence, and automated containment. EDR solutions are essential for finding advanced attacks that bypass traditional antivirus.
Use Case: The EDR system isolated an infected laptop before the malware could spread to other devices. Analysts used captured data to understand how the threat infiltrated the system. This enabled the team to update security policies and strengthen endpoint protections.
Use Case: The EDR system isolated an infected laptop before the malware could spread to other devices. Analysts used captured data to understand how the threat infiltrated the system. This enabled the team to update security policies and strengthen endpoint protections.
Endpoint Hardening
Definition: Endpoint hardening strengthens devices such as laptops, servers, and mobile phones by applying secure configuration settings. It removes unnecessary services, tightens permissions, and reduces exposure to attacks. Hardening is a critical step in establishing baseline device security.
Use Case: After hardening all endpoints, unauthorized software installations dropped significantly. Regular configuration checks ensured that devices stayed aligned with security standards. These improvements made it harder for malware to enter the environment.
Use Case: After hardening all endpoints, unauthorized software installations dropped significantly. Regular configuration checks ensured that devices stayed aligned with security standards. These improvements made it harder for malware to enter the environment.
Endpoint Management
Definition: Endpoint management involves centrally controlling and securing all devices within an organization, including desktops, laptops, and mobile devices. It ensures consistent application of updates, policies, and protections. Strong endpoint management reduces vulnerabilities across the device ecosystem.
Use Case: The company implemented endpoint management to enforce full disk encryption on all laptops. Compliance reports showed that every device met security requirements without manual intervention. This reduced risks associated with lost or stolen hardware.
Use Case: The company implemented endpoint management to enforce full disk encryption on all laptops. Compliance reports showed that every device met security requirements without manual intervention. This reduced risks associated with lost or stolen hardware.
Ethical Hacking
Definition: Ethical hacking involves authorized security experts testing systems to find vulnerabilities before malicious actors can exploit them. These professionals use the same methods as attackers but operate legally and responsibly. Ethical hacking helps organizations strengthen overall security posture.
Use Case: Ethical hackers discovered a flaw in the login portal that allowed brute force attempts without detection. Developers quickly patched the vulnerability and implemented rate limiting. The test helped the organization prevent a potential large scale intrusion.
Use Case: Ethical hackers discovered a flaw in the login portal that allowed brute force attempts without detection. Developers quickly patched the vulnerability and implemented rate limiting. The test helped the organization prevent a potential large scale intrusion.
Event Logging
Definition: Event logging records system activities, user actions, and security events to provide visibility into system behavior. It helps organizations monitor operations, detect anomalies, and investigate incidents. Well organized logs support compliance and improve forensic analysis.
Use Case: Event logs helped security analysts trace unauthorized login attempts across multiple systems. By reviewing timestamps and IP addresses, the team identified a compromised account. They used this information to reset credentials and block suspicious access.
Use Case: Event logs helped security analysts trace unauthorized login attempts across multiple systems. By reviewing timestamps and IP addresses, the team identified a compromised account. They used this information to reset credentials and block suspicious access.
Endpoint Isolation
Definition: Endpoint isolation removes an infected or suspicious device from the network to prevent further spread of malware or unauthorized access. It allows forensic analysis while protecting other systems. Isolation is a key step in incident containment.
Use Case: When ransomware behavior was detected on a workstation, the EDR system automatically isolated the device. Security teams analyzed the infection and restored the machine safely. Early isolation prevented the ransomware from spreading.
Use Case: When ransomware behavior was detected on a workstation, the EDR system automatically isolated the device. Security teams analyzed the infection and restored the machine safely. Early isolation prevented the ransomware from spreading.
F
File Integrity Monitoring (FIM)
Definition: File Integrity Monitoring tracks changes to critical system files and alerts teams when unexpected or unauthorized modifications occur. It protects against tampering, malware infections, and insider threats. FIM is commonly used on servers and sensitive infrastructure.
Use Case: FIM alerted the security team to unusual changes in a configuration file on a production server. Investigators determined that malware attempted to alter system settings. Prompt action prevented additional damage and restored the file to its original state.
Use Case: FIM alerted the security team to unusual changes in a configuration file on a production server. Investigators determined that malware attempted to alter system settings. Prompt action prevented additional damage and restored the file to its original state.
Firewall Rule Set
Definition: A firewall rule set is a collection of instructions that determine which network traffic is allowed or blocked. These rules define permitted protocols, ports, and IP ranges. Properly designed rule sets are essential for protecting network boundaries.
Use Case: Updating the rule set blocked foreign traffic that had been triggering suspicious activity alerts. Security teams reviewed logs to confirm that only legitimate traffic was allowed. The improved configuration reduced unnecessary exposure.
Use Case: Updating the rule set blocked foreign traffic that had been triggering suspicious activity alerts. Security teams reviewed logs to confirm that only legitimate traffic was allowed. The improved configuration reduced unnecessary exposure.
Firmware Security
Definition: Firmware security involves protecting the low level code that controls hardware devices such as routers, printers, and laptops. Because firmware operates beneath the operating system, compromised firmware can allow deep and persistent attacks. Strong update practices and integrity checks help secure firmware.
Use Case: A firmware update patched a critical vulnerability in company routers that hackers had begun targeting globally. After the update, monitoring tools showed repeated attempts to exploit the flaw, all of which failed. This reinforced the importance of timely firmware maintenance.
Use Case: A firmware update patched a critical vulnerability in company routers that hackers had begun targeting globally. After the update, monitoring tools showed repeated attempts to exploit the flaw, all of which failed. This reinforced the importance of timely firmware maintenance.
Fileless Malware
Definition: Fileless malware operates entirely in system memory rather than using traditional files, making it harder to detect with standard antivirus tools. It often exploits legitimate processes to avoid leaving traces. This type of malware is used in advanced attacks.
Use Case: Behavioral monitoring tools detected unusual script activity that indicated a fileless malware infection. Analysts terminated the malicious processes and implemented stronger PowerShell restrictions. These changes reduced the likelihood of future fileless attacks.
Use Case: Behavioral monitoring tools detected unusual script activity that indicated a fileless malware infection. Analysts terminated the malicious processes and implemented stronger PowerShell restrictions. These changes reduced the likelihood of future fileless attacks.
G
Geofencing
Definition: Geofencing restricts system access based on geographic location, blocking requests from regions known for high cyber risk. It helps reduce exposure to fraudulent login attempts and remote attacks. Geofencing is a common layer of access control.
Use Case: The organization blocked access from several high risk countries using geofencing rules. Suspicious login attempts from these locations dropped immediately. Analysts monitored logs to confirm that legitimate users were unaffected.
Use Case: The organization blocked access from several high risk countries using geofencing rules. Suspicious login attempts from these locations dropped immediately. Analysts monitored logs to confirm that legitimate users were unaffected.
H
Honeypot
Definition: A honeypot is a decoy system designed to attract attackers and study their methods. It appears vulnerable but contains no valuable data. Honeypots help organizations learn about emerging threats without risking real systems.
Use Case: The honeypot captured new attack patterns targeting Internet of Things devices. Analysts used these insights to update detection rules in production environments. This helped the organization stay ahead of evolving threats.
Use Case: The honeypot captured new attack patterns targeting Internet of Things devices. Analysts used these insights to update detection rules in production environments. This helped the organization stay ahead of evolving threats.
Hashing
Definition: Hashing transforms data into a fixed length, irreversible value used for secure storage and verification. It protects sensitive information, especially passwords, by ensuring original data cannot be retrieved. Strong hashing algorithms reduce the risk of credential compromise.
Use Case: The IT team migrated to a modern hashing algorithm to protect stored passwords. During an attempted breach, attackers accessed the hashed values but were unable to reverse them. This prevented unauthorized account access.
Use Case: The IT team migrated to a modern hashing algorithm to protect stored passwords. During an attempted breach, attackers accessed the hashed values but were unable to reverse them. This prevented unauthorized account access.
I
Identity Governance
Definition: Identity governance ensures that users have appropriate access based on their roles, responsibilities, and employment status. It includes lifecycle management, access reviews, and policy enforcement. Strong governance reduces the risk of excessive or outdated permissions.
Use Case: Governance tools identified former contractors who still had active accounts. The access review process removed unnecessary permissions and prevented unauthorized system usage. This improved overall identity security.
Use Case: Governance tools identified former contractors who still had active accounts. The access review process removed unnecessary permissions and prevented unauthorized system usage. This improved overall identity security.
Incident Response (IR)
Definition: Incident Response is the coordinated approach to detecting, containing, and resolving cybersecurity incidents. It involves predefined procedures, communication plans, and technical actions that reduce impact. A strong IR program improves resilience and recovery speed.
Use Case: The IR team detected a ransomware attack early and contained it before significant damage occurred. They isolated infected systems, restored clean backups, and documented lessons learned. This reinforced the importance of regular incident response training.
Use Case: The IR team detected a ransomware attack early and contained it before significant damage occurred. They isolated infected systems, restored clean backups, and documented lessons learned. This reinforced the importance of regular incident response training.
Insider Threat
Definition: An insider threat occurs when employees, contractors, or trusted individuals intentionally or unintentionally compromise security. Insiders may leak data, misuse access, or fall victim to social engineering. Monitoring and policy enforcement help reduce this risk.
Use Case: Behavioral alerts identified an employee downloading large volumes of sensitive data without authorization. Security teams intervened and prevented the information from being exported externally. The incident led to better monitoring and access restrictions.
Use Case: Behavioral alerts identified an employee downloading large volumes of sensitive data without authorization. Security teams intervened and prevented the information from being exported externally. The incident led to better monitoring and access restrictions.
Intrusion Detection System (IDS)
Definition: An Intrusion Detection System monitors network and system activity for suspicious behavior that may indicate attacks. It alerts administrators to potential intrusions without blocking traffic. IDS tools provide valuable visibility into attempted exploits.
Use Case: The IDS detected unusual outbound traffic from a compromised workstation. Analysts traced the activity to a malware infection attempting to communicate with an external server. Early detection allowed rapid containment.
Use Case: The IDS detected unusual outbound traffic from a compromised workstation. Analysts traced the activity to a malware infection attempting to communicate with an external server. Early detection allowed rapid containment.
Intrusion Prevention System (IPS)
Definition: An Intrusion Prevention System actively blocks threats by analyzing traffic patterns and enforcing security rules. It stops attacks before they can impact systems. IPS tools combine detection, filtering, and automatic response capabilities.
Use Case: The IPS blocked a SQL injection attempt targeting the company website. Security logs provided a detailed breakdown of the attack method. This allowed the web team to tighten input validation on the application.
Use Case: The IPS blocked a SQL injection attempt targeting the company website. Security logs provided a detailed breakdown of the attack method. This allowed the web team to tighten input validation on the application.
IP Reputation
Definition: IP reputation measures whether an IP address is associated with malicious or trustworthy behavior based on historical data. Security systems use these scores to block or allow traffic automatically. Good reputation intelligence helps stop attacks early.
Use Case: The firewall blocked incoming traffic from IP addresses with poor reputation scores. Logs showed that many of these requests attempted credential brute forcing. Using reputation data significantly reduced threat volume.
Use Case: The firewall blocked incoming traffic from IP addresses with poor reputation scores. Logs showed that many of these requests attempted credential brute forcing. Using reputation data significantly reduced threat volume.
K
Keystroke Logging
Definition: Keystroke logging captures everything a user types, including passwords and personal information. Attackers often deploy keyloggers through malware or physical devices. This practice threatens user privacy and system security.
Use Case: Analysts detected a hidden keylogger on a workstation after observing suspicious outbound traffic. The device was isolated and rebuilt to ensure complete removal. Policy updates restricted the installation of unverified software.
Use Case: Analysts detected a hidden keylogger on a workstation after observing suspicious outbound traffic. The device was isolated and rebuilt to ensure complete removal. Policy updates restricted the installation of unverified software.
L
Least Privilege
Definition: Least privilege is a security principle that restricts users to the minimum level of access necessary to perform their duties. It reduces the impact of compromised accounts and limits misuse. Enforcing least privilege requires careful role and permission management.
Use Case: Implementing least privilege significantly reduced the number of accounts with administrative rights. When one user account was compromised, the attacker had limited access and could not reach critical systems. This minimized the severity of the incident.
Use Case: Implementing least privilege significantly reduced the number of accounts with administrative rights. When one user account was compromised, the attacker had limited access and could not reach critical systems. This minimized the severity of the incident.
Log Correlation
Definition: Log correlation combines events from multiple sources to identify patterns or security incidents that may not be obvious from isolated logs. It helps analysts understand complex attacks involving multiple systems. Correlation is a key function of SIEM platforms.
Use Case: Correlated logs revealed that a series of failed login attempts, unusual file changes, and outbound traffic were part of a coordinated attack. Analysts used this information to trace the attacker’s movements. This improved the response time and accuracy.
Use Case: Correlated logs revealed that a series of failed login attempts, unusual file changes, and outbound traffic were part of a coordinated attack. Analysts used this information to trace the attacker’s movements. This improved the response time and accuracy.
Lateral Movement
Definition: Lateral movement occurs when attackers expand their access within a network after an initial compromise. They search for valuable systems, escalate privileges, and establish persistence. Detecting lateral movement is critical for early breach containment.
Use Case: Network segmentation prevented attackers from moving beyond the initial compromised host. Security teams identified the intrusion early through abnormal credential usage. Containment steps were taken immediately to protect sensitive systems.
Use Case: Network segmentation prevented attackers from moving beyond the initial compromised host. Security teams identified the intrusion early through abnormal credential usage. Containment steps were taken immediately to protect sensitive systems.
Log Retention
Definition: Log retention involves storing security logs for a required period to support investigations, audits, and compliance. Longer retention improves forensic accuracy and historical analysis. Proper policies help ensure important data is not lost prematurely.
Use Case: Extended log retention allowed analysts to trace back an attack that began months before detection. The logs provided crucial insights into attacker behavior. These findings were used to close security gaps.
Use Case: Extended log retention allowed analysts to trace back an attack that began months before detection. The logs provided crucial insights into attacker behavior. These findings were used to close security gaps.
M
Malware Analysis
Definition: Malware analysis examines malicious software to understand how it behaves, spreads, and impacts systems. It can involve static analysis, dynamic analysis, and reverse engineering. Understanding malware helps organizations develop better defenses.
Use Case: Analysts performed malware analysis on a suspicious executable and discovered that it attempted to encrypt user files. They created detection signatures based on the findings. This allowed the organization to block similar threats in the future.
Use Case: Analysts performed malware analysis on a suspicious executable and discovered that it attempted to encrypt user files. They created detection signatures based on the findings. This allowed the organization to block similar threats in the future.
Misconfiguration
Definition: A misconfiguration occurs when system or application settings are not properly secured, leaving vulnerabilities that attackers can exploit. Common examples include open ports, default passwords, and inadequate access controls. Misconfigurations are among the most frequent causes of breaches.
Use Case: A cloud storage misconfiguration exposed sensitive documents to the public internet. After identifying the issue, the team corrected the settings and implemented automated configuration checks. This prevented similar exposures from recurring.
Use Case: A cloud storage misconfiguration exposed sensitive documents to the public internet. After identifying the issue, the team corrected the settings and implemented automated configuration checks. This prevented similar exposures from recurring.
Multi Factor Authentication (MFA)
Definition: Multi Factor Authentication requires users to verify their identity using at least two independent forms of authentication, such as passwords, tokens, or biometrics. MFA significantly reduces successful account compromises. It strengthens identity security by making stolen credentials insufficient for access.
Use Case: MFA prevented attackers from accessing corporate email accounts even after several passwords were leaked online. Employees received alerts about attempted logins, prompting security reviews. This highlighted the importance of layered authentication.
Use Case: MFA prevented attackers from accessing corporate email accounts even after several passwords were leaked online. Employees received alerts about attempted logins, prompting security reviews. This highlighted the importance of layered authentication.
Memory Forensics
Definition: Memory forensics examines a system’s RAM to uncover evidence of malware, hidden processes, or volatile data. It captures activity that traditional disk analysis may miss. This technique is essential for investigating advanced or fileless threats.
Use Case: Memory forensics revealed malicious scripts running in memory without creating files on disk. Analysts used the results to create new detection signatures. These improvements strengthened defenses across the entire environment.
Use Case: Memory forensics revealed malicious scripts running in memory without creating files on disk. Analysts used the results to create new detection signatures. These improvements strengthened defenses across the entire environment.
N
Network Segmentation
Definition: Network segmentation divides a network into smaller, isolated sections that restrict lateral movement. It helps contain breaches and limit the spread of malware. Segmentation also improves performance and simplifies compliance.
Use Case: A breach in one department’s network did not affect other areas because segmentation was in place. Containing the intrusion prevented access to critical systems and sensitive databases. This greatly reduced overall risk during the incident.
Use Case: A breach in one department’s network did not affect other areas because segmentation was in place. Containing the intrusion prevented access to critical systems and sensitive databases. This greatly reduced overall risk during the incident.
Network Forensics
Definition: Network forensics involves monitoring, capturing, and analyzing network traffic to investigate security incidents. It helps identify attack sources, data exfiltration routes, and malicious communications. This approach is vital for understanding complex intrusions.
Use Case: Analysts reviewed network traffic captures that showed data being sent to an unauthorized external server. Immediate action was taken to block the destination and isolate affected systems. The investigation led to updates in firewall rules.
Use Case: Analysts reviewed network traffic captures that showed data being sent to an unauthorized external server. Immediate action was taken to block the destination and isolate affected systems. The investigation led to updates in firewall rules.
P
Packet Inspection
Definition: Packet inspection analyzes data packets traveling across a network to identify potential threats or policy violations. It can inspect headers, metadata, and full payloads depending on system capabilities. This visibility helps detect malware, intrusions, and unusual behavior.
Use Case: Packet inspection detected malicious payloads hidden inside encrypted traffic. Security teams isolated the affected machines and blocked similar traffic patterns. This improved detection of advanced threats.
Use Case: Packet inspection detected malicious payloads hidden inside encrypted traffic. Security teams isolated the affected machines and blocked similar traffic patterns. This improved detection of advanced threats.
Patch Management
Definition: Patch management is the process of identifying, testing, and applying updates that fix security vulnerabilities in software and systems. Effective patching reduces exposure to known threats. It is one of the most important components of cyber hygiene.
Use Case: Patch management resolved several critical vulnerabilities that attackers had recently begun exploiting in the wild. Automated patch deployment ensured that all systems received updates promptly. This significantly reduced the risk of compromise.
Use Case: Patch management resolved several critical vulnerabilities that attackers had recently begun exploiting in the wild. Automated patch deployment ensured that all systems received updates promptly. This significantly reduced the risk of compromise.
Penetration Testing
Definition: Penetration testing is a controlled security assessment in which authorized experts simulate cyberattacks to identify vulnerabilities before they are exploited by real attackers. These tests evaluate system weaknesses, misconfigurations, and user related risks. Penetration testing helps organizations strengthen defenses through proactive discovery.
Use Case: A penetration test revealed a critical flaw in the organization’s authentication service that allowed unauthorized access. Developers quickly patched the issue and implemented additional logging to monitor future login attempts. The findings were also used to improve long term security planning.
Use Case: A penetration test revealed a critical flaw in the organization’s authentication service that allowed unauthorized access. Developers quickly patched the issue and implemented additional logging to monitor future login attempts. The findings were also used to improve long term security planning.
Phishing
Definition: Phishing is a social engineering tactic where attackers use deceptive emails or messages to trick individuals into revealing sensitive information or downloading malware. It exploits human trust rather than technical vulnerabilities. Phishing remains one of the most common methods used in cyberattacks.
Use Case: A company wide training program reduced phishing click rates by teaching employees how to identify suspicious emails. When a coordinated phishing campaign targeted staff, most users reported the messages instead of interacting with them. This prevented credential theft and minimized risk.
Use Case: A company wide training program reduced phishing click rates by teaching employees how to identify suspicious emails. When a coordinated phishing campaign targeted staff, most users reported the messages instead of interacting with them. This prevented credential theft and minimized risk.
Privileged Access Management (PAM)
Definition: Privileged Access Management secures high level administrative accounts by controlling, monitoring, and limiting how privileged credentials are used. It reduces the risk of misuse or theft of accounts with elevated permissions. PAM solutions add auditability and strengthen identity security across systems.
Use Case: PAM protected root accounts by storing credentials in a secure vault and enforcing session recording. When an administrator left the company, their privileged access was automatically revoked. This prevented unauthorized use of powerful accounts.
Use Case: PAM protected root accounts by storing credentials in a secure vault and enforcing session recording. When an administrator left the company, their privileged access was automatically revoked. This prevented unauthorized use of powerful accounts.
Proxy Server
Definition: A proxy server acts as an intermediary between users and external internet resources, filtering traffic and enforcing security policies. It helps mask internal IP addresses and block access to harmful websites. Proxy servers enhance privacy and reduce exposure to threats.
Use Case: The proxy server filtered out malicious URLs and prevented employees from accessing dangerous sites. Administrators reviewed proxy logs to identify unusual activity patterns. These insights helped tighten web access policies.
Use Case: The proxy server filtered out malicious URLs and prevented employees from accessing dangerous sites. Administrators reviewed proxy logs to identify unusual activity patterns. These insights helped tighten web access policies.
Password Hygiene
Definition: Password hygiene refers to best practices for creating, storing, and managing secure passwords. Strong password habits reduce the risk of unauthorized access. Good hygiene includes complexity, rotation policies, and avoiding reuse.
Use Case: After reinforcing password hygiene policies, employees adopted longer and more secure passwords. Attempts to break into accounts using reused credentials became ineffective. This significantly improved account security across the organization.
Use Case: After reinforcing password hygiene policies, employees adopted longer and more secure passwords. Attempts to break into accounts using reused credentials became ineffective. This significantly improved account security across the organization.
R
Ransomware
Definition: Ransomware is malware that encrypts data and demands payment in exchange for the decryption key. It disrupts operations and can lead to data loss if backups are not available. Ransomware attacks often spread quickly and target vulnerable systems.
Use Case: When several machines were encrypted by ransomware, the organization restored them using recent backups instead of paying the ransom. The security team traced the infection to a malicious email attachment. Improved filtering and employee training helped prevent similar incidents.
Use Case: When several machines were encrypted by ransomware, the organization restored them using recent backups instead of paying the ransom. The security team traced the infection to a malicious email attachment. Improved filtering and employee training helped prevent similar incidents.
Remote Code Execution (RCE)
Definition: Remote Code Execution is a serious vulnerability that allows attackers to run unauthorized commands on a remote system. Successful exploitation can lead to full takeover of the affected device. RCE flaws require immediate patching due to their high impact.
Use Case: Researchers discovered an RCE vulnerability in a web application that exposed sensitive company data. The IT team applied emergency patches and performed a full code review. These steps prevented attackers from exploiting the flaw.
Use Case: Researchers discovered an RCE vulnerability in a web application that exposed sensitive company data. The IT team applied emergency patches and performed a full code review. These steps prevented attackers from exploiting the flaw.
Risk Assessment
Definition: A risk assessment evaluates potential cybersecurity threats by analyzing their likelihood and potential impact. It helps organizations prioritize security improvements and allocate resources effectively. Regular assessments support compliance and strengthen overall security posture.
Use Case: The annual risk assessment identified outdated systems as the highest priority area for investment. Leadership allocated budget to replace legacy hardware and improve patching processes. This significantly reduced exposure to known vulnerabilities.
Use Case: The annual risk assessment identified outdated systems as the highest priority area for investment. Leadership allocated budget to replace legacy hardware and improve patching processes. This significantly reduced exposure to known vulnerabilities.
Role Based Access Control (RBAC)
Definition: Role Based Access Control assigns system permissions based on predefined job roles. This ensures users only receive the access needed to perform their responsibilities. RBAC improves consistency and reduces the risk of privilege misuse.
Use Case: Implementing RBAC simplified onboarding by automatically assigning appropriate access when new employees joined. The system removed unnecessary permissions when employees changed roles. This reduced the number of overprivileged accounts.
Use Case: Implementing RBAC simplified onboarding by automatically assigning appropriate access when new employees joined. The system removed unnecessary permissions when employees changed roles. This reduced the number of overprivileged accounts.
S
Sandbox
Definition: A sandbox is an isolated environment where suspicious files or code can run without affecting production systems. It allows analysts to safely observe malware behavior. Sandboxing helps identify threats that traditional scanning tools may miss.
Use Case: A suspicious file was executed in the sandbox, revealing that it attempted to modify system registry keys. Analysts used this information to create new detection rules. The sandbox prevented the malware from infecting live systems.
Use Case: A suspicious file was executed in the sandbox, revealing that it attempted to modify system registry keys. Analysts used this information to create new detection rules. The sandbox prevented the malware from infecting live systems.
Secure Coding
Definition: Secure coding is the practice of writing software that minimizes vulnerabilities through careful design, validation, and error handling. It focuses on preventing common issues such as injection, buffer overflows, and insecure data storage. Secure coding strengthens software from the inside out.
Use Case: Developers adopted secure coding standards and reduced the number of security bugs discovered during testing. Regular code reviews helped identify unsafe patterns early. These changes improved the overall quality and resilience of the software.
Use Case: Developers adopted secure coding standards and reduced the number of security bugs discovered during testing. Regular code reviews helped identify unsafe patterns early. These changes improved the overall quality and resilience of the software.
Secure Configuration
Definition: Secure configuration ensures that systems, applications, and devices are deployed with recommended security settings. It involves disabling weak features, applying best practices, and removing unnecessary components. Proper configuration reduces exposure to attacks.
Use Case: Secure configuration templates were applied to all new servers, reducing configuration drift. Regular audits confirmed compliance and identified minor issues before they became serious vulnerabilities. This helped maintain a consistent security standard.
Use Case: Secure configuration templates were applied to all new servers, reducing configuration drift. Regular audits confirmed compliance and identified minor issues before they became serious vulnerabilities. This helped maintain a consistent security standard.
Security Posture
Definition: Security posture represents the overall strength, readiness, and effectiveness of an organization’s cybersecurity defenses. It includes people, technology, processes, and response capability. A strong posture reduces the likelihood and impact of security incidents.
Use Case: The company improved its security posture by adding automated monitoring tools, expanding employee training, and updating outdated policies. External auditors noted a significant improvement in incident readiness. This increased leadership confidence in the overall security program.
Use Case: The company improved its security posture by adding automated monitoring tools, expanding employee training, and updating outdated policies. External auditors noted a significant improvement in incident readiness. This increased leadership confidence in the overall security program.
SIEM (Security Information and Event Management)
Definition: SIEM systems collect, correlate, and analyze log data from across an organization to detect suspicious activity. They centralize security monitoring and provide real time alerts. SIEM platforms play a key role in threat detection and incident response.
Use Case: The SIEM detected unusual login activity from an administrative account, triggering an immediate investigation. Analysts identified a compromised password and blocked the attacker’s access. This stopped the intrusion before critical data was reached.
Use Case: The SIEM detected unusual login activity from an administrative account, triggering an immediate investigation. Analysts identified a compromised password and blocked the attacker’s access. This stopped the intrusion before critical data was reached.
Social Engineering
Definition: Social engineering manipulates people into sharing confidential information or performing actions that compromise security. It targets human psychology instead of technical flaws. Attackers use tactics such as impersonation, urgency, and deception.
Use Case: Employees learned to identify common social engineering tactics during training sessions. As a result, they reported suspicious phone calls from individuals pretending to be IT staff. This prevented unauthorized access to multiple internal systems.
Use Case: Employees learned to identify common social engineering tactics during training sessions. As a result, they reported suspicious phone calls from individuals pretending to be IT staff. This prevented unauthorized access to multiple internal systems.
Spoofing
Definition: Spoofing occurs when attackers impersonate trusted individuals, systems, or addresses to deceive victims. Common forms include email spoofing, IP spoofing, and domain spoofing. Spoofing helps attackers bypass security controls and gain unauthorized access.
Use Case: Anti spoofing technologies prevented users from being redirected to fake login pages. Logs showed multiple blocked attempts to impersonate internal email addresses. This helped protect employees from credential theft.
Use Case: Anti spoofing technologies prevented users from being redirected to fake login pages. Logs showed multiple blocked attempts to impersonate internal email addresses. This helped protect employees from credential theft.
Spyware
Definition: Spyware is malicious software designed to secretly monitor user activity and gather information such as passwords or browsing habits. It can run silently in the background and send data to attackers. Spyware threatens both privacy and system integrity.
Use Case: Security scans detected spyware installed through a malicious email attachment. The device was immediately isolated and cleaned. Analysts determined that the attacker intended to steal login credentials.
Use Case: Security scans detected spyware installed through a malicious email attachment. The device was immediately isolated and cleaned. Analysts determined that the attacker intended to steal login credentials.
SSL and TLS Encryption
Definition: SSL and TLS are cryptographic protocols that secure data transmitted over networks by encrypting communication between systems. They ensure confidentiality and authenticity during data exchange. Modern security standards recommend using updated TLS protocols for optimal protection.
Use Case: The company renewed expired certificates to prevent browser security warnings on its website. Users regained confidence once the connection showed proper encryption indicators. The update also strengthened protection against man in the middle attacks.
Use Case: The company renewed expired certificates to prevent browser security warnings on its website. Users regained confidence once the connection showed proper encryption indicators. The update also strengthened protection against man in the middle attacks.
Supply Chain Attack
Definition: A supply chain attack targets third party vendors or services to infiltrate a larger organization. By compromising a trusted partner, attackers can bypass direct security defenses. This type of attack highlights the importance of vendor security management.
Use Case: A routine vendor review identified weak security controls in a software supplier’s environment. The company required the vendor to strengthen protections before continuing the partnership. This prevented potential infiltration through the vendor’s systems.
Use Case: A routine vendor review identified weak security controls in a software supplier’s environment. The company required the vendor to strengthen protections before continuing the partnership. This prevented potential infiltration through the vendor’s systems.
Security Awareness Training
Definition: Security awareness training educates employees about cybersecurity risks, safe digital behavior, and how to recognize threats. It strengthens the human element of security by reducing user related vulnerabilities. Regular training helps build a more resilient workforce.
Use Case: After mandatory training sessions, employees became more adept at reporting suspicious messages and system behavior. Phishing success rates dropped sharply. This demonstrated the positive impact of ongoing education.
Use Case: After mandatory training sessions, employees became more adept at reporting suspicious messages and system behavior. Phishing success rates dropped sharply. This demonstrated the positive impact of ongoing education.
T
Threat Hunting
Definition: Threat hunting is the proactive search for hidden or undetected cyber threats within an organization’s network. It relies on expert analysis, intelligence, and behavioral patterns rather than waiting for alerts. Threat hunting helps uncover sophisticated or stealthy attacks.
Use Case: The threat hunting team discovered dormant malware that had bypassed automated tools. Removing the threat prevented a future breach and improved detection rules. The findings were used to enhance overall monitoring.
Use Case: The threat hunting team discovered dormant malware that had bypassed automated tools. Removing the threat prevented a future breach and improved detection rules. The findings were used to enhance overall monitoring.
Threat Modeling
Definition: Threat modeling is a structured approach to identifying potential risks, attack methods, and system weaknesses during design and development. It helps teams anticipate how attackers might exploit vulnerabilities. Early modeling improves long term system security.
Use Case: Developers used threat modeling to identify insecure data flows in a new application. They redesigned the architecture to reduce risk and added additional authentication checks. This prevented security flaws from being introduced into production.
Use Case: Developers used threat modeling to identify insecure data flows in a new application. They redesigned the architecture to reduce risk and added additional authentication checks. This prevented security flaws from being introduced into production.
Token Based Authentication
Definition: Token based authentication verifies users using temporary, cryptographically generated tokens instead of passwords. Tokens are short lived and cannot be reused, reducing the risk of credential theft. This method is widely used in modern APIs and mobile applications.
Use Case: Token based authentication reduced unauthorized API calls by ensuring each request included a valid token. When attackers tried to reuse old tokens, the system rejected them automatically. This strengthened the security of customer integrations.
Use Case: Token based authentication reduced unauthorized API calls by ensuring each request included a valid token. When attackers tried to reuse old tokens, the system rejected them automatically. This strengthened the security of customer integrations.
Traffic Filtering
Definition: Traffic filtering blocks or restricts harmful, unwanted, or suspicious network traffic using predefined rules. It helps prevent unauthorized access and reduces attack attempts. Filtering can occur at firewalls, routers, or security gateways.
Use Case: Traffic filtering blocked thousands of malicious requests generated by automated bots. Administrators analyzed blocked traffic to better understand attacker methods. This information helped refine and improve network defenses.
Use Case: Traffic filtering blocked thousands of malicious requests generated by automated bots. Administrators analyzed blocked traffic to better understand attacker methods. This information helped refine and improve network defenses.
Trojan Malware
Definition: Trojan malware disguises itself as legitimate software to trick users into installing it. Once executed, it can steal data, install additional malware, or open backdoors. Trojans rely on deception rather than self propagation.
Use Case: A suspicious download was detonated in a sandbox and found to contain Trojan components designed to capture user credentials. Security teams blocked the file from the network and notified affected departments. This prevented a potential compromise.
Use Case: A suspicious download was detonated in a sandbox and found to contain Trojan components designed to capture user credentials. Security teams blocked the file from the network and notified affected departments. This prevented a potential compromise.
U
User Provisioning
Definition: User provisioning automates the creation, modification, and removal of user accounts across systems. It ensures consistent access levels and reduces security gaps caused by manual processes. Effective provisioning supports compliance and reduces human error.
Use Case: Automated provisioning assigned correct permissions to new employees on their first day. When staff left the company, their accounts were deactivated immediately across all platforms. This helped prevent forgotten or orphaned accounts from becoming security risks.
Use Case: Automated provisioning assigned correct permissions to new employees on their first day. When staff left the company, their accounts were deactivated immediately across all platforms. This helped prevent forgotten or orphaned accounts from becoming security risks.
V
Vulnerability Scan
Definition: A vulnerability scan identifies weaknesses, misconfigurations, and outdated software within systems and networks. It provides actionable insights that help teams improve security posture. Regular scanning is essential for detecting newly discovered threats.
Use Case: Weekly vulnerability scans uncovered outdated software components that required immediate patching. The security team prioritized fixes based on severity and potential impact. This proactive approach reduced the number of exploitable vulnerabilities.
Use Case: Weekly vulnerability scans uncovered outdated software components that required immediate patching. The security team prioritized fixes based on severity and potential impact. This proactive approach reduced the number of exploitable vulnerabilities.
Vulnerability Management
Definition: Vulnerability management is a continuous process of identifying, evaluating, prioritizing, and remediating security weaknesses across systems. It ensures that known vulnerabilities are addressed before attackers can exploit them. This discipline is essential for maintaining long term organizational resilience.
Use Case: The security team implemented an enhanced vulnerability management program that reviewed reports weekly and assigned remediation owners for each issue. Over several months, the number of high risk vulnerabilities dropped significantly. This improvement strengthened the organization’s overall security posture.
Use Case: The security team implemented an enhanced vulnerability management program that reviewed reports weekly and assigned remediation owners for each issue. Over several months, the number of high risk vulnerabilities dropped significantly. This improvement strengthened the organization’s overall security posture.
W
Web Application Firewall (WAF)
Definition: A Web Application Firewall monitors and filters traffic to web applications, protecting them from attacks such as SQL injection and cross site scripting. It analyzes HTTP requests and blocks malicious behavior before it reaches the application. WAFs provide a critical layer of defense for online platforms.
Use Case: During a surge of automated bot attacks, the WAF detected and blocked thousands of harmful requests. Developers used WAF logs to understand attacker patterns and improve application code. These enhancements reduced future threats and increased system stability.
Use Case: During a surge of automated bot attacks, the WAF detected and blocked thousands of harmful requests. Developers used WAF logs to understand attacker patterns and improve application code. These enhancements reduced future threats and increased system stability.
Whitelisting
Definition: Whitelisting allows only approved applications, users, or network traffic to interact with a system. By restricting access to a predefined list, it minimizes exposure to unknown or unauthorized threats. This approach strengthens security by reducing the attack surface.
Use Case: After implementing application whitelisting, unauthorized software installations declined dramatically. Employees attempted to install tools from unverified sources, but the system automatically blocked them. This ensured that only trusted applications ran on company devices.
Use Case: After implementing application whitelisting, unauthorized software installations declined dramatically. Employees attempted to install tools from unverified sources, but the system automatically blocked them. This ensured that only trusted applications ran on company devices.
Z
Zero Day Attack
Definition: A zero day attack exploits a vulnerability that is unknown to developers and has no available patch. These attacks are highly dangerous because they provide defenders with no prior warning. Zero day vulnerabilities are often used in sophisticated and targeted cyber campaigns.
Use Case: Security monitoring tools detected unusual activity on several endpoints that was later linked to a zero day exploit. The incident response team isolated affected machines and applied temporary mitigation steps. Vendors released a permanent patch shortly afterward, reducing long term risk.
Use Case: Security monitoring tools detected unusual activity on several endpoints that was later linked to a zero day exploit. The incident response team isolated affected machines and applied temporary mitigation steps. Vendors released a permanent patch shortly afterward, reducing long term risk.
Zero Trust Security
Definition: Zero Trust Security is a model that assumes no user, device, or network is inherently trustworthy and requires continuous verification for every access request. It emphasizes identity, device health, and strict segmentation. Zero Trust reduces unauthorized lateral movement and minimizes breach impact.
Use Case: The company deployed Zero Trust controls that required users to authenticate at every key action, even when using internal systems. When attackers attempted to move deeper into the network using stolen credentials, the system blocked them immediately. This prevented a potential data breach.
Use Case: The company deployed Zero Trust controls that required users to authenticate at every key action, even when using internal systems. When attackers attempted to move deeper into the network using stolen credentials, the system blocked them immediately. This prevented a potential data breach.
USA
Jamaica