13 Cybersecurity terms that every business leader should know about

Understanding technical security terms and concepts is one of the most consistent complaints we hear from clients. That’s why we strive to deliver service explanations and benefits in plain English. Unfortunately, some of the jargon is unavoidable, which is why we’ve compiled a list to help you understand some of the more common terms.

Brute force attack

One of the oldest cyberattack methods, a brute force attack uses automated programs to try all possible character combinations in an attempt to guess a password. Fortunately, passwords take exponentially longer to crack the more complex they are. An eight-character password takes a matter of hours to crack using a brute force program. A 12-character password would take 200 years.

Data breach

A data breach refers to a broad range of attacks designed to infiltrate a computer system to steal sensitive data. This may include intellectual property, personally identifiable information, or payment card details; basically, anything that has value and may be sold on the dark web.

DNS attack

The domain name system (DNS) is what we use to match digital computer addresses to web addresses, which are more user-friendly. A DNS attack exploits this system to trick victims into thinking they’re visiting one site when they’re really being redirected to a malicious website.

DDoS attack

Distributed denial-of-service (DDoS) attacks are usually carried out to cause widespread disruption. Many attacks are executed by infecting large networks with malware known as botnets. Every infected computer can then be remotely controlled to bombard and overwhelm a victim’s server with requests until it slows to a crawl or even goes offline altogether.

Firewall

A firewall is a digital equivalent to a fireproof wall or door in a building in that it keeps bad things out. A firewall resides between your network and the internet to monitor incoming traffic and proactively block malicious activity. It’s important to remember that a firewall only protects you from bad guys that originate outside the network. Anything that originates inside your network (e.g., a USB drive plugged directly into a computer) can’t be stopped by a firewall.

Intrusion detection and prevention system (IDS/IPS)

Intrusion detection and prevention goes beyond the basic capabilities of a firewall to provide an intelligent and customizable platform for enforcing company security policies. It uses rule-based detection methods and sends automated alerts to administrators when it catches a potential threat.

Malware

Malware, also known as malicious software, refers to any kind of program or code designed to disrupt operations, steal sensitive data or hold it to ransom. Some common examples are ransomware, viruses, trojans, botnets, worms, and spyware.

Managed security services

Many smaller organizations don’t have the necessary human, financial, or technical resources needed to protect their data. Instead of maintaining a costly in-house IT security department, they outsource the responsibility to a managed security services provider (MSSP), which can handle tasks remotely and on site when necessary.

Penetration testing

There’s no better way to test your technology infrastructure for vulnerabilities than by placing yourself in the shoes of cybercriminals. White-hat hackers use the same methods as criminals to do penetration tests to find complex vulnerabilities and perform detailed risk assessments.

Risk assessment

A risk assessment is typically the first thing businesses do to get an overall picture of the threat landscape and how it affects their operations. It serves to identify potential hazards, evaluate the possible impact on the business, and determine ways to reduce the threat.

Security operations center (SOC)

An SOC is a specialized facility that houses an information security team that’s responsible for monitoring and analyzing a business’s threat landscape on an ongoing basis. It’s a form of proactive support that smaller organizations often outsource to an MSSP.

Information security (InfoSec)

Often confused with cybersecurity, InfoSec refers exclusively to the processes designed for data security. It seeks to protect sensitive business information from modification, inspection, destruction, and disruption.

Social engineering attack

Social engineering attacks are carried out to exploit human weakness through manipulation, such as by masquerading as a legitimate operator like a colleague or business. These attacks are meant to dupe unsuspecting victims into giving away their private information without exploiting any IT vulnerabilities.

Zero-day exploit

Zero-day exploits are among the most dangerous of cyberattacks because they occur on the same day that the particular vulnerability is discovered, typically before the manufacturer has the chance to patch it.

OC-IT provides the security services and expertise today’s organizations need to use modern technology with confidence. Get started securing your data today with our free risk assessment.