Cybersecurity 101 Glossary

The selective restriction of access to systems, data, or resources based on defined rules and identities.

A security control that temporarily disables an account after a defined number of failed login attempts, blocking brute-force attacks.

An attack where a criminal gains control of a legitimate user's account and uses it as if they were the real owner.

Any resource that has value to your organisation and needs protection — including data, devices, software, systems, and people.

A comprehensive record of all IT assets — hardware, software, data, and cloud services — that an organisation owns or manages.

Evidence-based confidence that security controls are working as intended and risks are being managed appropriately.

The total set of points where an attacker could try to enter or extract data from your environment.

A chronological record of events and actions on systems or applications, used for security investigations, compliance, and accountability.

The process of verifying that someone is who they claim to be before granting access to a system.

The process of granting or denying specific permissions to an authenticated user based on their role or policy.

A second copy of your data, stored separately and protected, that can be restored if the original is lost, corrupted, or encrypted.

A managed service that automatically backs up your data to a secure, off-site cloud environment with predictable recovery options.

The planning and preparation that ensures critical business functions can continue — or be quickly restored — during and after a disruption.

A sophisticated scam where attackers impersonate executives, suppliers, or colleagues to trick employees into transferring money or revealing sensitive information.

A structured process for requesting, approving, testing, and implementing changes to IT systems while managing security and business risk.

A control point that sits between users and cloud apps to enforce security, compliance, and data protection policies.

Tools that continuously assess cloud environments for misconfigurations, compliance violations, and risky exposures.

Security tools designed to protect cloud workloads — such as virtual machines, containers, and serverless functions — from threats and misconfiguration.

An access control approach that grants or denies access based on real-time conditions such as location, device health, or user risk.

The practice of establishing, maintaining, and tracking the settings and baselines of systems so they remain secure and consistent.

A continuous programme that identifies, prioritises, validates, and reduces an organisation's most exploitable exposures.

A structured set of security controls, often organised by domain, that provides a repeatable way to assess and improve security posture.

An attack where a criminal steals a user's session cookie to impersonate them on a website or service without needing their password.

The unauthorised stealing of usernames, passwords, tokens, or other credentials used to access systems and data.

A UK government-backed certification scheme that sets out five basic technical controls to protect organisations against common cyber threats.

A structured process of identifying, analysing, and prioritising cyber risks so an organisation can decide how to treat them.

The practice of protecting systems, networks, data, and people from digital attacks, unauthorised access, and disruption.

An incident in which sensitive, confidential, or protected information is accessed, disclosed, or used by an unauthorised party.

An attack designed to delete, corrupt, or render data unusable rather than steal or encrypt it for ransom.

The unauthorised transfer of data from inside an organisation to an external destination controlled by an attacker.

Technology and processes that identify, monitor, and block the unauthorised transmission or exfiltration of sensitive data.

The principle that organisations should collect only the personal data they actually need and keep it only as long as necessary.

A systematic evaluation of how a project or process might affect personal data privacy, used to identify and mitigate risks before they occur.

A designated individual responsible for overseeing data protection strategy, ensuring compliance with privacy laws, and acting as a point of contact for regulators and individuals.

The policy and practice of keeping personal data for a defined period, then securely deleting or anonymising it when no longer needed.

The process of converting encrypted data back into its original, readable form using the correct key or password.

A security strategy that uses multiple layers of defence so that if one layer fails, others are still in place.

An attack that overwhelms a system, service, or network with traffic or requests, making it unavailable to legitimate users.

The plan, tools, and processes used to restore IT systems and data after a major disruption — whether cyber, physical, or human.

A security measure that blocks access to malicious, risky, or inappropriate websites by intercepting and filtering domain name system requests.

Malware that installs on a device simply because a user visited a compromised or malicious website, often without any deliberate action.

The process of converting readable information into an encoded form that can only be accessed with the correct key or password.

Any device that connects to your network and communicates with other systems — including laptops, desktops, servers, mobiles, and tablets.

Software on laptops, servers, and devices that continuously monitors activity, detects suspicious behaviour, and can isolate threats automatically.

The practice of applying secure settings and removing unnecessary features from laptops, mobiles, and other endpoints to reduce their attack surface.

A condition where an asset is accessible or vulnerable to potential threats, increasing the likelihood of a successful attack.

Security that correlates signals across endpoints, email, identity, cloud, and network to detect threats no single tool would catch alone.

A security alert that incorrectly flags legitimate activity or files as malicious, causing unnecessary investigation and disruption.

A security device or service that monitors and controls incoming and outgoing network traffic based on predefined rules.

A European and UK regulation that governs how organisations collect, process, store, and protect personal data, with significant fines for non-compliance.

An interconnected set of IT resources — networks, servers, and shared services — that supports a range of applications and users under common security management.

A coordinated approach to aligning IT and security activities with business objectives, managing risk, and meeting regulatory obligations.

An email filtering technique that temporarily rejects messages from unknown senders, accepting them only when a legitimate mail server retries delivery.

Preventative controls and policies that automatically keep people, systems, and processes within safe and approved boundaries.

The process of reducing a system's attack surface by disabling unnecessary features, applying secure settings, and closing unused ports and services.

The idea that every employee can act as a defensive layer by recognising and reporting threats before they cause harm.

The policies and tools that ensure the right people have the right access to the right resources, at the right time.

Security capabilities focused on detecting and responding to threats that target user identities, credentials, and access mechanisms.

The structured process of preparing for, detecting, containing, eradicating, and recovering from a security incident.

A structured record of an organisation's information assets that documents what data exists, where it is stored, who owns it, and how it is protected.

A security risk that originates from within the organisation, whether from a malicious employee, a compromised account, or careless behaviour.

An internationally recognised standard for managing information security that sets out requirements for establishing, implementing, and continually improving an Information Security Management System.

The process of removing manufacturer restrictions on a device to gain elevated privileges, often exposing it to malware and untrusted apps.

A model that grants elevated permissions only when they are needed, for a limited time, and then removes them automatically.

Malware or hardware that records every keystroke a user types, typically to capture passwords, card numbers, or confidential messages.

The techniques attackers use to move from one compromised system to others within the same network after gaining initial access.

The legal reason under data protection law that allows an organisation to collect, use, and store personal data.

The security principle that users and systems should only have the minimum level of access necessary to perform their specific tasks.

Any software designed to harm, steal from, or take control of a system without the owner's permission.

An attack where an attacker secretly intercepts and possibly alters communication between two parties without their knowledge.

A service where security experts monitor your environment 24/7, investigate alerts, and respond to threats on your behalf.

The average time it takes for an organisation to identify a security threat or breach from the moment it occurs.

A security technique that divides a network into small, isolated zones so that a breach in one area cannot easily spread to others.

A login process that requires two or more proofs of identity — typically something you know, something you have, or something you are.

A security technology that checks devices before allowing them onto a network, ensuring only healthy, authorised endpoints can connect.

A web vulnerability that lets attackers send users to a malicious website by abusing a legitimate site's trusted redirect feature.

A tool that securely stores, generates, and autofills strong, unique passwords for different accounts.

A set of rules that define how passwords must be created, stored, and changed within an organisation to reduce credential-based attacks.

An attack that tries a small number of common passwords against many accounts, avoiding lockouts by spreading attempts over time.

The systematic process of acquiring, testing, and deploying software updates to fix security vulnerabilities and improve stability.

The malicious component of an attack that performs the harmful action — such as installing ransomware, stealing data, or creating a backdoor.

Any information that relates to an identified or identifiable individual, including names, emails, addresses, IDs, and online identifiers.

Any information that can identify a specific individual, either on its own or combined with other data.

A social engineering attack that tricks people into revealing credentials, transferring money, or installing malware — usually via email, text, or phone.

A controlled exercise that sends fake phishing emails to staff to measure and improve their ability to recognise and report real attacks.

A high-level statement of intent and principles that outlines what an organisation will do to manage security and protect its assets.

Specialised controls for accounts with elevated permissions — like admins — including vaulting, session monitoring, and time-bound access.

An account with elevated permissions that can make system-wide changes, manage users, or access sensitive data.

A step-by-step set of instructions that describes exactly how to carry out a specific task or activity in a consistent manner.

A phishing attack that uses a malicious QR code to direct a victim's phone to a fake website or credential-harvesting page.

Malicious software that encrypts your files or systems and demands payment to restore access, often combined with threats to leak stolen data.

The risk that remains after security controls and treatments have been applied.

The chance that a threat will exploit a vulnerability and cause harm to your business, combined with how bad that harm would be.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives.

A living document that records identified risks, their likelihood, impact, owners, and the actions planned to manage them.

Any unauthorised device connected to a network without IT approval, such as a laptop, USB dongle, or fake wireless access point.

A cloud-delivered model that combines networking and security services — like SD-WAN, ZTNA, and CASB — into one platform delivered close to the user.

The practice of setting up systems, devices, and software using security-focused settings that reduce exposure and prevent misuse.

A security service that enforces web access policies, filters malicious sites, and inspects web traffic for threats and data leakage.

A documented minimum set of security settings and controls that every system or service must meet before being used.

A specific safeguard or countermeasure designed to reduce risk, protect assets, or detect and respond to security events.

A platform that collects logs and events from across your IT estate, correlates them, and raises alerts on suspicious patterns.

The ongoing collection and analysis of security events from systems, networks, and applications to spot suspicious or malicious activity.

The team — and the facility — responsible for continuously monitoring, detecting, investigating, and responding to security threats.

Tools that automate repetitive security tasks and coordinate responses across multiple systems using predefined playbooks.

A cloud-based security model that delivers core security services — such as SWG, CASB, and ZTNA — from the edge, close to users.

The use of technology, software, or services inside an organisation without the IT or security team's knowledge or approval.

A system that lets users access multiple applications using one set of login credentials, managed by a central identity provider.

Manipulating people into breaking security rules or sharing sensitive information, rather than attacking the technology itself.

A collection of techniques, templates, and tools used to craft convincing social engineering attacks such as phishing, vishing, and pretexting.

Personal data that is more sensitive and requires extra protection under UK GDPR, such as health, race, religion, or biometrics.

A mandatory requirement that specifies how a policy must be implemented, often including measurable criteria and uniform methods.

An attack that targets an organisation by exploiting vulnerabilities in its suppliers, partners, or software providers rather than attacking directly.

Anything or anyone with the potential to cause harm to your systems, data, or people — from criminals to careless insiders.

Information about current and emerging threats — including attacker tactics, tools, and targets — used to inform security decisions.

A technique where attackers register domains that look like popular websites but contain common typos or misspellings to trap users.

A detection technique that uses machine learning and statistics to spot unusual patterns in how users and devices behave.

A weakness in software, hardware, configuration, or process that an attacker can take advantage of.

A targeted attack where criminals compromise a website they know their victims visit, then infect visitors with malware or exploit their browsers.

An attack that abuses a vulnerable XML parser to read files, scan internal systems, or execute commands on a server.

A group that focuses on the human and cultural side of security, bridging technical defences with user awareness, training, and communication.

A security model that assumes no user, device, or network is automatically trusted, and verifies every request before granting access.

A way of giving users access to specific applications based on identity and context, instead of placing them on the corporate network.