Every business expanding its presence on digital platforms is at risk of multiple online attacks. Brand protection then becomes a priority to secure companies and their customers. To help you understand the basics of online protection, we’ve compiled a comprehensive list of all terms related to this field.
Cybersecurity Glossary
a type of digital identity theft in which a cybercriminal takes over a user’s online account. Most commonly financial accounts, but also applies to social media accounts.
a type of impersonation of a customer service account in social media. Usually in an attempt to obtain the customer’s details.
a senior-level executive in an organization in the IT or cyber security department. A CISO’s responsibilities include the design and implementation of a comprehensive security strategy, ensuring and maintaining adequate protection for the organization’s assets and technology, to mitigate and manage cyber security risks.
a cyberattack technique in which a user is tricked to click on what appears as a genuine URL that directs them to a malicious site, installs malware, or performs some other undesirable action.
a set of loosely or tightly connected computers that work together and can, for practical purposes, be treated as a single system.
a deliberate attempt to gain unauthorized access to system services, resources, or information, or an attempt to compromise system integrity. Cyber-attacks may target individuals or corporations alike. Most attacks attempt to steal financial and commercial information, reveal sensitive data, and sometimes, strictly destroy data or block access to a server.
(a.k.a threat agent, bad actor, hacker, fraudster, scammer) – a person who engages in criminal activity by digital means, computers, or the internet, targeting an individual, group, organization, or government.
Set of processes and technologies applied to protect online systems, networks, programs, devices, and data from cyber-attacks.
All the knowledge that is collected to understand the motives, behaviors, and targets of a cybercriminal.
The hidden part of the internet which can only be accessed with a VPN or Tor browser. It contains a range of websites, some of which are illegal.
Refers to the traceable trail of data, actions, and digital activity one leaves when using the internet.
The practice of protecting brands and businesses from online cyber-attacks.
a security risk that involves the release of internal and secure information into an insecure environment, thus being made accessible to external entities without authorization.
When sensitive data is unknowingly exposed to the public, from within an organization.
cybersecurity work where a threat hunter collects, processes, preserves, analyzes, and presents computer-related evidence in support of network vulnerability, mitigation, criminal, fraud, counterintelligence, or law enforcement investigations.
An online form of identity theft for committing fraud or cheating on another person’s identity in which someone pretends to be someone else.
measures taken to protect organizations from cyber threats, on all digital assets. It is the proactive approach cybersecurity specialists need to apply to enhance protection and prevention while mitigating risk.
The domain name system (DNS) is the way that Internet domain names are located and translated into Internet Protocol addresses.
An online attack in which the attacker impersonates a trusted domain to attract a victim.
– A type of a cyber-attack that overrides a computer’s TCP/IP settings to direct communication to a malicious server controlled by cybercriminals.
an attack by which an attacker takes over a domain by first blocking access to the domain’s DNS server and then putting his server up in its place.
registration of an Internet domain name without that domain being associated with any services such as e-mail or a website. This may have been done to reserve the domain name for future development, and to protect against the possibility of cybersquatting.
a tactic used by cyber criminals to build their infrastructure and launch attacks while remaining undetected. First, attackers steal and gather credentials for domain accounts. Using these stolen credentials, they log into the domain account and create subdomains that redirect traffic toward malicious servers, without the domain owner having any knowledge of this.
a type of corporation target fraud that involves an individual hacking into an organization’s email or creating a social media account and posing as a senior-level executive, often the CEO or CFO. By doing so, they cause target employees to take actions that lead to compromising the company.
The implementation of strategies to detect and takedown malicious activities.
a comprehensive approach to risk management that engages people, processes, and systems across an organization to improve the quality of decision-making for managing risks that may hinder an organization’s ability to achieve its objectives.
a type of fraud where an attacker poses as a trusted person or company to steal money or sensitive information from a company or individuals.
this is a security management system set up to actively protect computers and networks. It works by analyzing information from various areas of a computer/network o spot potential security breaches. These breaches can be either caused by intrusions (external attacks) or misuse (insider attacks).
a tactic used by cyber criminals to supply a false IP address that poses as a legitimate IP (see also Domain Spoofing)
A digital asset that represents real-world objects like art, music, in-game items, or video and can that can be purchased and sold online.
An NFT-crypto domain is a decentralized domain name that can be linked to a crypto wallet address and/or operating website domain.
Any use of the internet to fraud people. These scams are mostly carried out by cybercriminals for financial gain.
a user’s session is redirected to a fake website. This can be achieved by corrupting a DNS server on the Internet and pointing a URL to the fake website’s IP.
Phishing is a type of online attack often used to steal user data, including login credentials and credit card numbers by impersonating a trustworthy entity.
A risk assessment is a process to identify the potential risk associated with online activity and evaluate the probability of it happening.
a type of malware that is a form of extortion by holding a victim’s data hostage on their computer typically through robust encryption. This is followed by a demand for payment in the form of Bitcoin (an untraceable digital currency) to release control of the captured data back to the user. Usually, there is also a time limit for the ransom to be paid. There is no guarantee that the if the victim pays the ransom, he/she will get the decryption key.
The removal of an online threat.
a potential security violation that seeks to damage data, steal data, or disrupt digital life in general. If a threat becomes reality, it can cause a security breach or additional damages.
Intelligence collected about threat actors and their techniques and analyzing data into actionable information that relates to capabilities, opportunities, actions, and intent of adversaries in the cyber domain to meet a specific requirement determined by and informing decision-makers.
The process of proactively searching through networks to detect and isolate security threats, rather than relying on security solutions or services to detect those threats.
a type of cyber fraud registering or using a domain that’s similar to, but not typographically identical to another domain. The purpose of typosquatting is to direct Internet users who carelessly type a URL to the squatter’s site as opposed to the user’s intended destination.
a cyber-attack is a form of psychological manipulation used to persuade people to perform certain actions or give away sensitive information. Social engineering is often used to extract data and gain unauthorized access to information systems, either of a single, private user or those belonging to organizations.
a type of social engineering attack that is targeted to a particular individual or small set of individuals, using a very specific and personalized message, often an e-mail or text message.
An attack that relies on impersonating an authorized user on a network in a way that enables a malicious site or communication to pose as a trusted one. This way the attacker tries to gain access to sensitive data or infect the user’s system with malware.
A form of business email compromise in which a spoofed email appears to originate with a company’s chief executive. Is a form of spear phishing attack which targets the executives, key holders, and others of a company’s leadership team.
A form of phishing that uses voice calls instead of email. The attacker often falsifies their caller-ID to trick the victim into believing they are receiving a phone call from a legitimate or trustworthy source such as a bank, retail outlet, law enforcement, or charity.
It is a phishing scam that operates through text messages.
Manipulating people into performing actions or divulging confidential information using psychological tricks.
Refers to online attacks that are committed through social media such as Instagram, Twitter, or TikTok.