erms

The technical terms in this glossary are not comprehensive, they are intended only as a
basic aid to understanding the pages on this website. A much more
comprehensive Jargon Buster can be found on the government’s Get Safe Online
website.

Word/Term Definition

Controlling who has access to a computer or online service and the

Access control
information it stores.

Asset Something of value to a person, business or organization.

The process to verify that someone is who they claim to be when they
Authentication
try to access a computer or online service.

To make a copy of data stored on a computer or server to lessen the

Backing up
potential impact of failure or loss.

Bring your own The authorised use of personally owned mobile devices such as
device (BYOD) smartphones or tablets in the workplace.

High-speed data transmission system where the communications

Broadband
circuit is shared between multiple users.

Business continuity Preparing for and maintaining continued business operations

management following disruption or crisis.

Certification Declaration that specified requirements have been met.

Certification body An independent organization that provides certification services.

A payment card transaction where the supplier initially receives

payment but the transaction is later rejected by the cardholder or the
Chargeback
card issuing company. The supplier’s account is then debited with the
disputed amount.

Delivery of storage or computing services from remote servers online

Cloud computing
(ie via the internet).

A structure and series of requirements defined by the International

Common text Organization for Standardization, that are being incorporated in all
management system International Standards as they are revised.
 A computer or program that provides other computers with access to
Data server
shared files over a network.

Declaration of Confirmation issued by the supplier of a product that specified

conformity requirements have been met.

Segment of a network where servers accessed by less trusted users are

DMZ
isolated. The name is derived from the term “demilitarised zone”.

Encryption The transformation of data to hide its information content.

Communications architecture for wired local area networks based

Ethernet
uponIEEE 802.3 standards.

Hardware or software designed to prevent unauthorised access to a

Firewall
computer or network from another computer or network.

The comparison of actual performance against expected or required

Gap analysis
performance.

Someone who violates computer security for malicious reasons, kudos

Hacker
or personal gain.

The permanent storage medium within a computer used to store

Hard disk
programs and data.

The process of recognising a particular user of a computer or online

Identification
service.

Provision of computing infrastructure (such as server or storage

Infrastructure-as-a-
capacity) as a remotely provided service accessed online (ie via the
service (IaaS)
internet).

A declaration issued by an interested party that specified requirements

Inspection certificate
have been met.

Chat conversations between two or more people via typing on

Instant messaging
computers or portable devices.

Internet service
Company that provides access to the internet and related services.
provider (ISP)

Intrusion detection Program or device used to detect that an attacker is or has attempted
system (IDS) unauthorised access to computer resources.

Intrusion prevention Intrusion detection system that also blocks unauthorised access when
system (IPS) detected.
‘Just in time’ Manufacturing to meet an immediate requirement, not in surplus or in
manufacturing advance of need.

A virus or physical device that logs keystrokes to secretly capture

Keyboard logger
private information such as passwords or credit card details.

Communications link between two locations used exclusively by one

Leased circuit organization. In modern communications, dedicated bandwidth on a
shared link reserved for that user.

Local area network Communications network linking multiple computers within a defined
(LAN) location such as an office building.

Malware (ie malicious software) that uses the macro capabilities of

Macro virus common applications such as spreadsheets and word processors to
infect data.

Software intended to infiltrate and damage or disable computers.

Malware
Shortened form of malicious software.

A set of processes used by an organisation to meet policies and

Management system
objectives for that organisation.

Network firewall Device that controls traffic to and from a network.

Outsourcing Obtaining services by using someone else’s resources.

Making false representation that goods or services are those of another

Passing off
business.

Password A secret series of characters used to authenticate a person’s identity.

Software running on a PC that controls network traffic to and from

Personal firewall
that computer.

Personal
Personal data relating to an identifiable living individual.
information

Method used by criminals to try to obtain financial or other

confidential information (including user names and passwords) from
Phishing internet users, usually by sending an email that looks as though it has
been sent by a legitimate organization (often a bank). The email
usually contains a link to a fake website that looks authentic.

Platform-as-a- The provision of remote infrastructure allowing the development and

service (PaaS) deployment of new software applications over the internet.
 A small, easily transportable computing device such as a smartphone,
Portable device
laptop or tablet computer.

Server that acts as an intermediary between users and others servers,

Proxy server
validating user requests.

Restore The recovery of data following computer failure or loss.

Something that could cause an organization not to meet one of its

Risk
objectives.

Risk assessment The process of identifying, analysing and evaluating risk.

Router Device that directs messages within or between networks.

A virus or physical device that logs information sent to a visual

Screen scraper
display to capture private or personal information.

Security control Something that modifies or reduces one or more security risks.

Security information
and event Process in which network information is aggregated, sorted and
management (SIEM) correlated to detect suspicious activities.

Security perimeter A well-defined boundary within which security controls are enforced.

Computer that provides data or services to other computers over a

Server
network.

A mobile phone built on a mobile computing platform that offers

Smartphone more advanced computing ability and connectivity than a standard
mobile phone.

Software-as-a- The delivery of software applications remotely by a provider over the

service (SaaS) internet; perhaps through a web interface.

Malware that passes information about a computer user’s activities to

Spyware
an external party.

A set of organisations with linked resources and processes involved in

Supply chain
the production of a product.

An ultra-portable, touch screen computer that shares much of the

Tablet functionality and operating system of smartphones, but generally has
greater computing power.
Threat Something that could cause harm to a system or organization.

Threat actor A person who performs a cyber attack or causes an accident.

Obtaining evidence of identity by two independent means, such as

Two-factor
knowing a password and successfully completing a smartcard
authentication
transaction.

The short name, usually meaningful in some way, associated with a

Username
particular computer user.

The record of a user kept by a computer to control their access to files

User account
and programs.

Link(s) between computers or local area networks across different

Virtual private
locations using a wide area network that cannot access or be accessed
network (VPN)
by other users of the wide area network.

Malware that is loaded onto a computer and then run without the
Virus
user’s knowledge or knowledge of its full effects.

A flaw or weakness that can be used to attack a system or

Vulnerability
organization.

Wide area network Communications network linking computers or local area networks
(WAN) across different locations.

Wi-Fi Wireless local area network based uponIEEE 802.11standards.

Malware that replicates itself so it can spread to infiltrate other

Worm
computers.

Glossary
Terms
and
Concepts

Access - Differentiated by authorized and unauthorized. In order to gain access within the network, you
must have permission via a username and password. Use of someone else's username and password
constitutes unauthorized access.
Bandwidth - The amount of data that can be transmitted in a fixed amount of time. For digital devices,
the bandwidth is usually expressed in bits per second (bps) or bytes per second.
Enumeration - A hacking technique used to identify information about a system for the purpose of
discovering vulnerabilities within the network, actively connecting to the network and trying to identify
such things as valid user accounts, poorly protected resource shares, or other potential penetrable areas
of the system.
Firewall - A system designed to prevent unauthorized access to or from a private network. Firewalls can
be implemented in both hardware and software, or a combination of both. Firewalls are frequently used
to prevent unauthorized Internet users from accessing private networks connected to the Internet,
especially intranets. All messages entering or leaving the intranet pass through the firewall, which
examines each message and blocks those that do not meet the specified security criteria.
Hacking - A generic term for penetrating a computer or computer system with malicious intent. Includes
use of hacking tools to gain unauthorized access, damage system functionality, or the spreading of
viruses, worms, and other malicious software code.
Information Technology - computers, networks, systems, and peripherals used to create,
communicate, process, and store digital information.
Information Technology Ethics - The study of ethics and ethical behavior as it relates to the use of
Information Technology.
Integrity - (As in data integrity) Refers to the validity of data.
MP3 - A type of software compression used to compress music files at near-CD quality for easy
transmission over the Internet.
Network - A group of two or more computer systems linked together.
Script Kiddie - A person, normally someone who is not technologically sophisticated, who randomly
seeks out a specific weakness over the Internet in order to gain root access to a system without really
understanding what it is s/he is exploiting because the weakness was discovered by someone else. A
script kiddie is not looking to target specific information or a specific company but rather uses knowledge
of a vulnerability to scan the entire Internet for a victim that possesses that vulnerability.
System Administrator - An individual responsible for maintaining a computer network. Typical duties
include adding and configuring new workstations, System software installation, administering system
security policy, and general maintenance of the network. The system administrator is sometimes called
the sysadmin or the systems administrator. Small organizations may have just one system administrator,
whereas larger enterprises usually have a whole team of system administrators.
System Monitoring - DoD policy indicates that systems MAY be monitored. There are various software
packages (known as sniffers) on the market available to conduct monitoring. Things that can be
monitored are email traffic, internet website visits, programs ran on a particular machine, and chat room
conversations from AOL, ICQ, Yahoo Chat, and AOL Instant Messenger. Some software to monitor
Internet traffic can be alerted by programmable keywords, such as "terrorist," "nuclear bomb," or "jihad."
These programs alert System Administrators when they are triggered, so it does not require the active
surveillance by an individual.
Sysop - (System Operator) Anyone responsible for the physical operations of a computer system or
network resource. For example, a System Administrator decides how often backups and maintenance
should be performed and the System Operator performs those tasks.
Sniffer - A program and/or device that monitors data traveling over a network. Sniffers can be used both
for legitimate network management functions and for stealing information off a network. Unauthorized
sniffers can be extremely dangerous to a network's security because they are virtually impossible to
detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's
arsenal.