This cybersecurity glossary explains 50 security terms that business owners and managers meet most often, in plain English. Knowing them helps you understand advice from IT staff, read security reports and ask suppliers the right questions. The terms are grouped by topic: threats, defences, and risk and response.
Threats and attacks
- Malware: any software designed to harm a computer, steal data or give an attacker control. Viruses, worms, ransomware and spyware are all types of malware.
- Ransomware: malware that encrypts your files and demands payment for the key. Some groups also threaten to publish stolen data.
- Trojan: malware disguised as a useful program or file, such as a fake invoice or software update.
- Spyware: software that secretly records activity, such as keystrokes, passwords or browsing, and sends it to an attacker.
- Adware: software that shows unwanted advertising, often bundled with free downloads. Some adware also tracks users.
- Phishing: a message, usually email, that pretends to come from a trusted source to trick someone into clicking a link, opening an attachment or giving away a password.
- Spear phishing: phishing aimed at a specific person or business, using names and details that make it more convincing.
- Business email compromise (BEC): a scam where criminals use a hacked or fake business email account to request payments or change bank details on invoices.
- Social engineering: manipulating people, rather than systems, into breaking security rules. Phone calls pretending to be IT support are a common example.
- DDoS (distributed denial of service): an attack that floods a website or network with traffic from many sources so that real users cannot reach it.
- Brute-force attack: trying large numbers of passwords automatically until one works.
- Credential stuffing: using usernames and passwords leaked from one website to log in to other websites, relying on people reusing passwords.
- SQL injection: an attack that sends database commands through a website form or address to read or change data the site should protect.
- Cross-site scripting (XSS): an attack that puts malicious script into a web page so it runs in other visitors’ browsers.
- Zero-day: a software flaw that attackers exploit before the vendor has released a fix.
- Advanced persistent threat (APT): a long-running, targeted attack where an intruder stays hidden inside a network to steal data over time.
- Botnet: a network of infected computers or devices controlled by an attacker, often used for DDoS attacks and spam.
- Insider threat: a risk that comes from staff, contractors or partners who misuse their access, on purpose or by accident.
Defences and controls
- Authentication: checking that a user or device is who it claims to be, for example with a password, code or fingerprint.
- Authorisation: deciding what an authenticated user is allowed to do, such as read files but not delete them.
- Multi-factor authentication (MFA): requiring two or more types of proof to log in, such as a password plus a code from a phone app. Also called two-factor authentication (2FA).
- Access control: the rules and tools that decide who can use which systems and data.
- Least privilege: giving each person only the access they need for their job, and no more.
- Zero trust: a security approach that verifies every user and device on every request, instead of trusting anything inside the office network.
- Password manager: an application that creates and stores strong, unique passwords, so staff do not reuse or write them down.
- Firewall: hardware or software that allows or blocks network traffic based on set rules.
- Web application firewall (WAF): a firewall designed for websites. It inspects web requests and blocks attacks such as SQL injection and XSS before they reach the site.
- Antivirus: software that detects and removes known malware on computers and servers.
- Endpoint detection and response (EDR): security software on laptops, desktops and servers that watches for suspicious behaviour, not just known malware, and helps respond to it.
- Intrusion detection system (IDS): a tool that monitors networks or servers for signs of an attack and raises alerts.
- Encryption: turning data into unreadable code that can only be read with the right key, so stolen data is useless to the thief.
- SSL/TLS: the protocol that encrypts traffic between a browser and a website. It is what puts “https” and the padlock in the address bar. TLS is the modern version of SSL.
- VPN (virtual private network): an encrypted connection between a device and a network, often used to give remote staff secure access to company systems.
- Email authentication (SPF, DKIM and DMARC): DNS records that prove which servers may send email for your domain, sign messages and tell receiving servers what to do with fakes.
- Patch management: the process of applying software updates promptly to fix security flaws.
- Backup: a copy of data kept separately so it can be restored after deletion, hardware failure or ransomware. Keep at least one copy off-site and test restores.
Risk, testing and response
- Threat: anything that could cause harm, such as a criminal group, a malware campaign or a power cut.
- Vulnerability: a weakness that a threat could use, such as an unpatched plugin or a weak password.
- Exploit: code or a technique that takes advantage of a vulnerability.
- Attack surface: all the points where an attacker could try to get in, including websites, email accounts, remote access tools and staff devices.
- Risk assessment: identifying what could go wrong, how likely it is and how much damage it would do, so you can decide where to spend on security.
- Vulnerability scanning: automated checks of systems and websites for known weaknesses.
- Penetration testing: an authorised, simulated attack carried out by security specialists to find weaknesses before criminals do.
- Breach: an incident where someone gains access to systems or data without permission.
- Incident response plan: a written plan for what to do when a security incident happens: who to call, how to contain it and how to recover.
- Disaster recovery: the process and tools for restoring systems and data after a major failure or attack.
- Security operations centre (SOC): a team that monitors an organisation’s systems for threats and responds to alerts, often around the clock.
- SIEM (security information and event management): software that collects logs from many systems and looks for patterns that suggest an attack.
- Security awareness training: teaching staff to spot phishing, handle data safely and report problems quickly.
- Data protection law: legislation that sets rules for handling personal information, such as Zimbabwe’s Cyber and Data Protection Act. Breaches can carry legal obligations.
Where to start
You do not need to master every term. For most small businesses, the first steps are MFA on email and admin accounts, prompt patching, tested backups, a password manager, staff awareness and a firewall in front of your website. Then write down what you would do if something went wrong.
How Tremhost can help
Tremhost provides managed security services and supplies ESET endpoint protection. For websites, Armor Guard puts your site behind Cloudflare Pro, with a web application firewall, DDoS protection and SSL configured and monitored by Tremhost. If your site has already been hacked, Armor SOS offers free same-day triage.
Frequently asked questions
What is the difference between a firewall and a WAF?
A network firewall controls which connections are allowed in and out, mostly by address and port. A WAF looks inside web requests and blocks attacks aimed at website code, such as SQL injection.
What is the difference between a threat and a vulnerability?
A vulnerability is a weakness in your systems. A threat is something that could use that weakness to cause harm. Risk is the combination of the two.
Is antivirus enough for a small business?
No. Antivirus is one layer. You also need MFA, updates, backups, email filtering and trained staff, because many attacks rely on stolen passwords or tricking people rather than on malware.
Next step
To protect your website with a configured firewall and DDoS protection, see Tremhost Armor Guard.
