Malicious Insider Threat
A Malicious Insider Threats occur when an insider uses their privileged access to a company’s resources and harms that organization’s data, systems, or IT infrastructure. Malicious insider events include stealing …
Vishing
Vishing is the fraudulent practice of making phone calls or leaving voice messages pretending to be from reputable companies in order to have individuals give out personal information, up to …
Smishing
Smishing is another form of phishing, where a hacker sends a malicious text or SMS message trying to trick someone into giving them sensitive information. Smishing can be more dangerous …
Spear-Phishing
Spear-Phishing is a form of phishing attack that targets a specific person or organization, seeking access to sensitive information. Similar to phishing, this is done through spoofing emails that appear …
Whaling
Whaling refers to malicious hacking that targets high-ranking executives. Similar to phishing, whaling is where the hacker hunts for data that they can use, but they focus on high-ranking bankers, …
Administrator Rights
Administrator Rights is the highest level of permission given to a computer user. A user with admin rights (privileges) allows them to access anything within the system or network they …
Least Privilege
Business ownes may feel as though the principle of Least Privilege only applies to government Spooks, however, a simple example – removing administrator rights from all desktop users at a company – could be the difference between ransomware compromise and no incident at all.
Need to Know
Need to Know often gets applied to Classified Top Secret information. However, understanding how it applies could provide insights in how to better protect your SMB’s data and spot errors, omissions, and potentially malicious insiders.
Attack Surface
The Attack Surface in cyber security is the sum of all of the points, or “attack vectors” where a hacker can try and input data into or take out data …
Security Operations Center (SOC)
A Security Operations Center (SOC) is the continuous monitoring of information that enables security professionals and others to see a continuous stream of real time snapshots of the state of …
Security Event and Incident Management (SEIM)
Security Event and Incident Management (SEIM) refers to cyber security products and services that provide real time analysis, monitoring, and alerting on security logs and generated by applications, hosts, …
Script Kiddie
A Script Kiddie, also known as a skiddie, or skid; is an unskilled individual who uses scripts or programs developed by other individuals to attack computer systems and networks as …
Organized Crime
Organized Crime refers to a category of hackers that may be transnational, national, or local in geography. They operate like a centralized enterprise but are run by criminals who engage in …
Social Media Bots
In addition to Malware Bots that do the bidding of a hacker, there are also social media “bots”. These bots refer to automated social media accounts that publish lots of …
Nation State Hackers
Nation State hackers are the best of the best. Their attacks are evolving and are not often seen or discussed in the day-to-day world because attribution of an attack to …
Security Operations
Security Operations refers to the actions that go on within a Security Operations Center. Those within the Security Operations Center are concerned with the day-to-day monitoring of access and security …
Cloud Computing
Cloud Computing is a model for enabling on-demand network access to a shared pool of configurable computing capabilities or resources (e.g., networks, servers, storage, applications, and services) that can be …
Computer Network Defense
Computer Network Defense is the actions taken to defend against unauthorized activity within computer networks. Some examples of network defenses are firewalls, demilitarized zones (DMZs), Virtual Private Networks (VPNs), and …
Built-In Security
Built–In Security is a set of principles, practices, and tools to design, develop, and evolve information systems and software that enhance resistance to vulnerabilities, flaws, and attacks. A simple example …
Authorization
Related Terms: Access Control, Access Control Mechanism, Authentication Source: OASIS SAML Glossary 2.0; Adapted from CNSSI 4009 What Does This Mean for my SMB? It’s vital to ensure that your …
Authentication
Authentication is the process of verifying the identity or other attributes of an entity (user, process, or device). Entering in log in credentials to gain access to a website is …
Bug
A Bug is an unexpected and relatively small defect, fault, flaw, or imperfection in an information system or device. These small defects or faults are generally due to human error when …
Access Control Mechanism
An access control mechanism is a security safeguard (i.e., hardware and software features, physical controls, operating procedures, management procedures, and various combinations of these) designed to detect and deny unauthorized …
Block List, Deny List
A Block List or Deny List, (deprecated: Blacklist), is a list of entities that are blocked or denied privileges or access. Hosts or applications that have been previously determined to …
Active Content
Active content is software that is able to automatically carry out or trigger actions without the explicit intervention of a user. When you are visiting a webpage on the Internet, …
Attack
An Attack is an attempt to gain unauthorized access to system services, resources, or information, or an attempt to compromise system integrity. In other words, the intentional act of attempting …
Attacker
An Attacker is an individual, group, organization, or government that executes an attack. Not to be confused with a vulnerability. An attack in the physical world might be someone who …
Data Loss
Data Loss is the result of unintentionally or accidentally deleting data, forgetting where it is stored, or exposure to an unauthorized party. Data loss is typically better than a data …
Decrypt
Decrypt is a generic term encompassing decode and decipher. Decrypting is the process of taking encrypted text or data and converting it back into text or data you can understand …
Decryption
Decryption is the process of transforming ciphertext into its original plaintext. This is done through a decryption process. Decryption transforms ciphertext into plaintext for an authorized user, in possession of …
Digital Forensics
Digital Forensics is the processes and specialized techniques for gathering, retaining, and analyzing system-related data (digital evidence) for investigative purposes. In the NICE Workforce Framework, cybersecurity work where a person: …
Cyber Criminals
Cyber Criminals are individuals or teams of people who use technology to commit malicious activities on digital devices or networks with the intention of stealing sensitive company information, personal data, …
Education and Training
In the NICE Workforce Framework, Education and Training in cybersecurity work is where a person conducts training of personnel within pertinent subject domains. Additionally, this individual develops, plans, coordinates, delivers, …
Encode
Encode is to convert plaintext to ciphertext by means of a code. This is done to prevent important information from getting into the wrong hands. Encoding scrambles letters and numbers …
Encrypt
Encrypt is the generic term encompassing encipher and encode, which means to convert plaintext to ciphertext by means of a code. This is done to protect important information from being …
Encipher
Encipher is to convert plaintext to ciphertext by means of a cryptographic system. This process is done to keep important information safe and only deciphered with the proper key. What …
Bot, Botnet, Bot Herder, and Bot Master
Bot(s) A Bot is a computer connected to the Internet that has been surreptitiously / secretly compromised with malicious logic to perform activities under remote the command and control of …
Denial of Service (DoS)
Denial of Service (DoS) is an attack that prevents or impairs the authorized use of information system resources or services. A DoS is simply when hackers try to prevent legitimate …
Distributed Denial of Service (DDoS)
Distributed Denial of Service (DDoS) attacks are a type of Denial of Service (DoS) attacks. A DDoS attack involves multiple connected online devices, collectively known as a botnet, which are used …
Data Breach
A Data Breach is the unauthorized movement or disclosure of sensitive information to a party, usually outside the organization, that is not authorized to have or see the information. What …
Data Exfiltration
Exfiltration is the unauthorized transfer of information from an information system. The types of data commonly exfiltrated are Social Security Numbers, credit card information, passwords and email addresses. What Does …
Data Loss Prevention
Data Loss Prevention is a set of procedures and mechanisms to stop sensitive data from leaving a security boundary. This helps you hold onto your important data and information so …
Exploit
An exploit is a technique to breach the security of a network or information system in violation of security policy.This strategy takes advantage of the application or systems flaw so …
Exploitation Analysis
Exploitation Analysis is cybersecurity work where a person: analyzes collected information to identify vulnerabilities and potential for exploitation. This is done to attempt to “fill in the gaps” in the …
Exposure
Exposure is the condition of being unprotected, thereby allowing access to information or access to capabilities that an attacker can use to enter a system or network. For example, an …
Firewall
A firewall is a capability to limit network traffic between networks and/or information systems. This is a hardware/software device or a software program that limits network traffic according to a …
Failure
A failure is the inability of a system or component to perform its required functions within specified performance requirements. For example, a computer shutting down unexpectedly would be considered a …
Hacker
A hacker is an unauthorized user who attempts to or gains access to an information system. This is someone who uses various methods to breach defenses and exploit weaknesses in …
Hash Value
A Hash Value is a numeric value resulting from a mathematical algorithm applied to a set of data such as a file. A common hash value is called the MD5 …
Hazard
A hazard is a natural or man-made source or cause of harm or difficulty. A hazard can be a threat to your business if realized such as water damage, a …