Security Wise: Glossary of cyber security terminology

31 Mar 2022

Businesses are being urged to boost their defences against potential cyber-attacks linked to tensions between Russia and Ukraine. Regardless of risk, it’s always wise to adhere closely to a cyber-strategy.

One of the most important things for organisations of all sizes to ensure, is that the fundamentals of cyber security are in place to protect their work and mobile devices, networks, and systems. This is important under all circumstances but critical during periods of heightened cyber threats. Knowing the steps to take after experiencing a cyber-attack and how to respond can make all the difference in mitigating the damages.

Cyber security is a very expansive area and while not everything in cyber security is technical, over time the profession has developed and uses an extensive vocabulary of terms. Often, business owners feel overwhelmed when it comes to cyber-security because the language used to describe operations and threats is different from the language of the business world.

Consult our glossary for clear definitions of the most common cyber-terms and descriptions for many of the concepts associated with it.

Adware: Any software application that displays advertising banners while the program is running. Adware often includes code that tracks a user’s personal information and passes it on to third parties without the user’s authorisation or knowledge. If you gather enough of it, adware slows down your computer significantly.

Anti-virus Software: Software designed to detect and potentially eliminate viruses. Anti-virus software can also repair or quarantine files that have already been infected by virus activity.

Attachment: A file that has been added to an email which is often an image or document. It could be something useful to you, or something very harmful to your computer.

Authentication: Confirming the correctness of the claimed identity of an individual user, machine, software component or any other entity.

Authorisation: The approval, permission or empowerment for someone or something to do something.

Backdoor: Hidden software or hardware mechanism used to circumvent security controls.

Backup: File copies that are saved as protection against loss, damage or unavailability of the primary data.

Brute Force Attack: An exhaustive password-cracking procedure that tries all possibilities one by one.

Denial of Service Attack (DOS): The prevention of authorised access to a system resource or the delaying of system operations and functions. Often involves a large volume of data requests generated by a cyber-criminal.

Dictionary Attack: A password-cracking attack that tries all of the phrases or words in a dictionary.

Domain Hijacking: An attack in which an attacker takes over a domain by first blocking access to the domain’s DNS server and then putting his or her own server up in its place.

Domain Name System (DNS): The way that internet domain names are located. A website’s domain name is easier to remember than its Internet Protocol (IP) address.

Electronic Infections: Often called ‘viruses’, these malicious programs and codes harm your computer and compromise your privacy. In addition to traditional viruses, other common infections include worms and Trojan horses. They sometimes work in tandem to do maximum damage.

Encryption: A data security technique used to protect information from unauthorised inspection or alteration. Information is encoded so that it appears as a meaningless string of letters and symbols during delivery or transmission. Upon receipt, the information is decoded using an encryption key.

Evil Twins: A fake wireless internet hot spot that looks like a legitimate service. When victims connect to the wireless network, a hacker can launch a spying attack on their internet transactions, or just ask for credit card information in the standard pay-for-access deal.

Firewall: A hardware or software link in a network that inspects all data packets coming and going from a computer, permitting only those that are authorised to reach the other side.

Flooding: An attack that attempts to cause a failure in the security of a computer by providing more input, such as a large volume of data requests, than it can properly process.

Hacker: An individual who attempts to break into a computer without authorisation.

HTTPS: When used in the first part of a URL (http://), this term specifies the use of hypertext transfer protocol (HTTP) enhanced by a security mechanism such as Secure Socket Layer (SSL). Always look for HTTPS on the checkout or order form page when shopping online or when signing into a site and providing your username and password.

Keystroke Logger: A specific type of electronic infection that records victims’ keystrokes and sends them to an attacker. This can be done with either hardware or software.

Malware: A generic term for a number of different types of malicious code.

Man-In-the-middle Attack: An attack in which a cyber-criminal poses as an online bank or merchant and allows a victim to sign in over an SSL connection. The attacker then logs onto the real server using the client’s information and steals credit card numbers.

Phishing: Soliciting private information from customers or members of a business, bank or other organisation in an attempt to fool them into divulging confidential personal and financial information. People are lured into sharing usernames, passwords, account information or credit card numbers, usually by an official-looking message in an email or a pop-up advertisement that urges them to act immediately, often by clicking on a link provided.

Pharming: Redirecting visitors from a real website to a bogus one. A user enters what is believed to be a valid web address and is unknowingly redirected to an illegitimate site that steals the user's personal information. On the spoofed site, criminals may mimic real transactions and harvest private information shared by users. With this, the attacker can then access the real website and conduct transactions using the credentials of a valid user.

Shoulder Surfing: Looking over a person’s shoulder to get confidential information. It is an effective way to get information in crowded places because it’s relatively easy to stand next to someone and watch as he or she fills out a form, enters a PIN number at a cashpoint or types a password. Can also be done long-distance with the aid of binoculars or other vision-enhancing devices. To combat it, experts recommend that you shield paperwork or your keypad from view with your body or by cupping your hand. Also, be sure you password-protect your computer screen when you must leave it unattended, and clear your desk at the end of the day.

Skimming: A high-tech method by which thieves capture your personal or account information from your credit card, driving licence or even passport using an electronic device called a ‘skimmer’. Your card is swiped through the skimmer and the information contained in the magnetic strip on the card is then read into and stored on the device or an attached computer. Skimming is predominantly a tactic used to perpetuate credit card fraud, but is gaining popularity amongst identity thieves.

Social Engineering: A euphemism for non-technical or low-technology means—such as lies, impersonation, bribes, blackmail and threats—used to attack information systems. Sometimes telemarketers or unethical employees employ such tactics.

Spoofing: Masquerading so that a trusted IP address is used instead of the true IP address. A technique used by hackers as a means of gaining access to a computer system.

Spyware: Software that uses your internet connection to send personal information about you to a collecting device on the internet. It is often packaged with software that you download voluntarily, and even if you remove the downloaded program later, the spyware may remain.

Secure Socket Layer (SSL): An encryption system that protects the privacy of data exchanged by a website and the individual user. Used by websites whose URLs begin with HTTPS instead of HTTP.

Trojan Horse: A computer program that appears to be beneficial or innocuous, but has a hidden and potentially malicious function that evades security mechanisms. A keystroke logger, which records victims’ keystrokes and sends them to an attacker, and remote-controlled ‘zombie computers’ are examples of damage that can be done by Trojan horses.

URL Obfuscation: The use of phishing emails to guide recipients to fraudulent sites with names very similar to established sites. Fraudulent sites have a slight misspelling or other subtle difference in the URL, such as ‘monneybank.com’ instead of ‘moneybank.com’, to redirect users to share their personal information unknowingly.

Virus: A hidden, self-replicating piece of computer software, usually malicious logic, that propagates by inserting a copy of itself into and becoming part of another program. A virus cannot run by itself; to be active it requires that its host program be run. Often sent through email attachments.

Vishing: Soliciting private information from customers or members of a business, bank, or other organisation to fool them into divulging confidential information. People are lured into sharing usernames, passwords, account information or credit card numbers, usually by an official-looking message in an email or a pop-up advertisement that urges them to act immediately—but in a vishing scam, they are urged to call the phone number provided rather than clicking on a link.

Worm: A type of electronic infection that can run independently, can propagate a complete working version of itself onto other hosts on a network and may consume computer resources destructively. Once this malicious software is on a computer, it scans the network for another machine with a specific security vulnerability. When it finds one, it exploits the weakness to copy itself to the new machine, and then starts replicating from there, as well.

Zombie Computer: A computer controlled remotely with hidden code installed by a remote-access Trojan horse. Digital thieves then use robot networks of thousands of zombie computers to carry out attacks on other people and cover up their tracks. Authorities have a harder time tracing criminals when they use zombie computers.

 

Mitigate common attacks with the British Security Industry's (BSIA) new training offer.

 Skills for Security, in partnership with ID Cyber Solutions, is offering a new series of cybersecurity training courses that will give you and your team a great insight into being fully cyber secure across the board.

 On completion each user will achieve a CPD Skills for Security, ID Cyber Solutions and BSIA accredited certificate.

 

Consider the NCSC Cyber Essentials Scheme.

 Cyber Essentials is an effective, Government backed scheme that will help you to protect your organisation, whatever its size.

 

Consider Cover

Most standard property and liability policies have exclusions for cybercrime. This means it is vital for businesses to consider a standalone cyber-liability policy.

TH March has been providing insurance for the jewellery sector for 135 years. While the nature of criminal threats has changed during that time, we’ve adapted to stay ahead and ensure jewellers get the protection they need.

We have access to specialised insurers who can provide jewellers with expert advice, guidance and security strategies. This cover can include protection against a range of threats, including extortion, corporate ID theft and phishing. Should an attack occur, the business then receives cover to respond to the issue, including any legal or regulatory fees, as well as crisis communication and business interruption cover.

 With growing numbers of jewellers falling victim to these crimes, can you afford to take the risk of not protecting your business?

 To find out more about specialist insurance for jewellers from TH March, visit: www.thmarch.co.uk.

Source: SecurityWise