Glossary of Cyber Security terms, definitions and acronyms

This is a program or set of programs designed to detect and destroy computer viruses, trojans, worms, and other malware. An example of this is Norton Antivirus, which scans your computer and files to look for known threats.

This is a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. The intention of an APT attack is usually to monitor network activity and steal data rather than to cause damage to the network or organization.

This is a security technique that regulates who or what can view or use resources in a computing environment. It’s a fundamental concept in security that minimizes risk to the business or organization. For example, in a file system, access control lists (ACLs) define who can access a file, while capability-based security defines what operations are allowed on a file.

This refers to a security-relevant chronological record, set of records, or destination and source of records that provide documentary evidence of the sequence of activities that have affected at any time a specific operation, procedure, or event. For example, financial transactions, scientific experiments, or security management activities.

This is software that automatically displays or downloads advertising material (often unwanted) when a user is online. While not necessarily malicious, adware can impact system performance and be annoying to the user.

This refers to the use of software, hardware, and procedural methods to protect applications from external threats. Secure coding, for instance, is an aspect of this and it involves writing code that’s resistant to injection attacks, buffer overflows, and other security vulnerabilities. Here’s a simple example of secure coding in Python against SQL Injection:

import sqlite3 def get_user(db, username): # Use parameterized queries to prevent SQL Injection cursor = db.cursor() cursor.execute(“SELECT * FROM users WHERE username=?”, (username,)) return cursor.fetchone()

In the context of cybersecurity, an asset is any data, device, or other component of the environment that supports information-related activities. Protecting these assets is the primary goal of any cybersecurity program.

This is a type of encryption where two different keys are used – a public key for encryption, and a private key for decryption. This is the fundamental technology behind SSL certificates and secure HTTP (HTTPS).

In the context of cybersecurity, anomaly detection refers to the process of identifying unusual behavior or patterns in network traffic or system behavior that might indicate a security threat. These anomalies deviate from what’s expected or what’s defined as ‘normal’ behavior. Anomaly detection can be based on various methods, including statistical methods, machine learning, and artificial intelligence. These methods involve creating a model of ‘normal’ behavior, often by analyzing large amounts of data over time, and then identifying any behavior that deviates significantly from this model.