Introduction
Are you someone who knows that cyber security is a must for keeping your business safe, but you’ve been put off by complex terms which sound like you need the Deluxe Pro Turbo 2000 PhD in astro quantum forensics to understand what’s been said?
We hear you!
On a more serious note, the reality is that cyber security can come with with a lot of unfamiliar language, but we’re on your side to help you boost your knowledge by removing unnecessary roadblocks that can potentially hinder how well you protect what you’re working so hard to build.
This guide explains common terms in simple, everyday language which will allow you to identify what risks look like and the appropriate preventative measures. Trying to decode jargon? Not anymore.
Attacks, scams and malicious activity
| Term | Simple meaning |
|---|---|
| Phishing | Fake emails, messages or websites designed to trick you into giving away information, clicking a harmful link or approving something you should not. |
| Social engineering | Tricking or manipulating someone into giving away information, access or money. |
| Cyber attack | An attempt to gain access to, disrupt, damage or steal information from a computer, account or system. |
| Malware | Harmful software designed to steal information, damage systems or give an attacker access. |
| Ransomware | An attack that locks, encrypts or steals data and demands payment from the victim. |
| Infostealer | Harmful software designed mainly to steal information such as passwords, browser data and login details. |
| Botnet | A group of infected computers or devices that an attacker controls remotely, often to send spam, spread malware or overwhelm websites with traffic. |
| DDoS (Distributed Denial-of-Service) | An attack that floods a website or online service with traffic so that genuine users cannot access it. Often these attacks originate from many different sources at once, usually through large botnets. |
| Supply-chain attack | An attack that reaches you through a supplier, software provider or other organisation you depend on. |
| Business Email Compromise (BEC) | A scam where an attacker pretends to be a trusted person or organisation to persuade someone to send money or sensitive information. |
| Deepfake | Fake or altered video, audio or images made to convincingly imitate a real person. |
Passwords, accounts and access
| Term | Simple meaning |
|---|---|
| Credentials | The information or digital proof used to sign in, such as a username, password or access key. |
| Password attack | An attempt to gain access to an account by guessing, stealing or cracking a password. |
| Credential attack | An attempt to gain access to an account by guessing, stealing or misusing someone’s login details. |
| Credential stuffing | Using usernames and passwords stolen from one service to try to get into accounts on other services. |
| Brute-force attack | An attempt to get into an account by automatically trying large numbers of passwords or login combinations until one works. |
| MFA (Multi-Factor Authentication) | Using more than one way to prove who you are when signing in, such as a password and an authentication app. |
| Passkey | A way to sign in without a traditional password, usually using your device, fingerprint, face or PIN. |
| Zero Trust | A security approach where users and devices are checked before being given access rather than automatically being trusted. |
Protecting systems and information
| Term | Simple meaning |
|---|---|
| Firewall | A security control that decides which network connections are allowed and which should be blocked. |
| Encryption | Protecting information by turning it into a form that can only be read by someone or something with the right access. |
| VPN (Virtual Private Network) | A way of creating a protected connection between your device and another network or service. |
| Patch / patching | Updating software to fix known problems or security weaknesses. |
| Backup | A separate copy of important information that can be used if the original is lost, damaged or attacked. |
| Endpoint | A device connected to an organisation’s systems, such as a laptop, desktop, phone or server. |
Weaknesses and security risks
| Term | Simple meaning |
|---|---|
| Threat | Something that could cause harm to your systems, information or business. |
| Vulnerability | A weakness that an attacker could use to gain access or cause harm. |
| Zero-day | A newly discovered security weakness that may be attacked before a fix is available or widely installed. |
| Data breach | When information is accessed, exposed or stolen by someone who should not have access to it. |
Finding and responding to problems
| Term | Simple meaning |
|---|---|
| Penetration testing / Pen test | An authorised security test where specialists try to find weaknesses before attackers do. |
| Incident response | The steps an organisation takes to deal with a cyber security problem and return to normal. |
| Recovery | Restoring systems, data and business operations after something has gone wrong. |
| SOC (Security Operations Centre) | A team or service that watches for security problems and helps respond when they happen. |
| SIEM (Security Information and Event Management) | Technology that brings security information from different systems together so it can be reviewed for suspicious activity. |
AI and emerging technology
| Term | Simple meaning |
|---|---|
| AI security | Protecting AI systems and the information they use from misuse, attacks or unintended access. |
| Deepfake | Fake or altered video, audio or images made to convincingly imitate a real person. |
A simple way to think about it
A threat is something that could cause harm. A vulnerability is a weakness that could be used. A cyber attack is an attempt to use that weakness, and an incident is what happens when something actually goes wrong.
Security controls such as MFA, firewalls, encryption, patching and backups help reduce the chance of an attack succeeding or limit the damage if it does.