Governance Risk Compliance
NIST Cybersecurity Framework
A voluntary framework for organizing cybersecurity risk management outcomes.
The CyberGuard field guide
Cybersecurity,
explained clearly.
A practical dictionary for the language behind digital safety. Start with a question, follow a topic, or browse the full collection.
151 published definitions20 security topicsExamples and source links on every page
03 / THE INDEX
The dictionary, A to Z.
151 definitions in the library.
Network Security
Network Access Control
Network access control checks whether a device or user is allowed to join a network and may assign access based on identity or device state.
Network Security
Network Address Translation
Network address translation changes IP address information as packets cross a network boundary, often letting multiple private devices share public connectivity.
Network Security
Network Segmentation
Dividing a network into zones with controlled communication between them.
Cloud Security
Object Storage Bucket
An object storage bucket is a named cloud container for files or other objects, with settings that govern access, retention, and related controls.
Web Application Security
Open Redirect
An open redirect lets an attacker choose an untrusted destination for a link or redirect served by a legitimate site.
Network Security
Packet Inspection
Packet inspection is the examination of network packet headers, metadata, or payloads to classify traffic and apply monitoring or security policy.
Vulnerability Management
Patch Management
The process of testing, prioritizing, deploying, and verifying software updates.
Ethical Hacking
Penetration Testing
An authorized assessment that tests whether weaknesses can be exploited under agreed scope and rules.
Privacy Data Protection
Personally Identifiable Information
Information that can identify a person directly or when combined with other information.
Phishing Social Engineering
Phishing
A deceptive message or site intended to trick someone into disclosing information or taking an unsafe action.
Incident Response
Playbook
A security playbook is a documented set of steps, decision points, and responsibilities for handling a recurring security scenario.
Network Security
Private IP
A private IP address is an address from a range reserved for use within private networks rather than routing directly on the public Internet.
AI Security
Prompt Injection
Instructions embedded in untrusted content that try to redirect an AI system away from its intended task.
Network Security
Proxy Server
A proxy server is an intermediary selected by a client to make requests to another service on the client's behalf.
Network Security
Public IP
A public IP address is an Internet address intended for globally reachable routing, subject to network policy and address allocation.
Malware
Ransomware
Malware used to deny access to data or systems and demand payment or another concession.
Malware
Ransomware as a Service
Ransomware as a service is a criminal operating model in which a ransomware developer or operator supplies tools and infrastructure to affiliates who conduct attacks.
Business Cybersecurity
Recovery Point Objective
Recovery point objective is the target point in time to which data must be recoverable after a disruption, expressing acceptable potential data loss.
Business Cybersecurity
Recovery Time Objective
Recovery time objective is the target maximum time to restore a service or process after a disruption before the outage causes unacceptable impact.
AI Security
Retrieval Augmented Generation Risk
Retrieval augmented generation risk is the possibility that retrieved documents or embeddings mislead an AI answer, cross access boundaries, or expose sensitive data.
Network Security
Reverse Proxy
A reverse proxy is an intermediary that receives client requests as the public-facing endpoint and forwards them to one or more backend services.
Core Cybersecurity
Risk Assessment
A structured evaluation of possible harm, likelihood, and existing safeguards.
Incident Response
Root Cause Analysis
Root cause analysis is the structured effort to identify the conditions that allowed an incident to occur and to prevent similar failures.
Malware
Rootkit
A rootkit is software or a set of techniques used to conceal malicious presence or activity by changing what a system reports to defenders.
Web Application Security
SQL Injection
Injection of untrusted input into a database query so it changes the intended query behavior.
Web Application Security
Same Origin Policy
The same-origin policy is a browser rule that limits how scripts from one origin interact with content from another origin.
Cloud Security
Secret Management
Secret management is the controlled storage, distribution, use, and rotation of credentials and other sensitive application values.
Business Cybersecurity
Security Awareness Training
Security awareness training teaches people how to recognize, avoid, and report security risks they may encounter in their work.
Incident Response
Security Information and Event Management
A system that collects and analyzes security events from multiple sources.
Incident Response
Security Operations Center
A security operations center is a team and working function that monitors security signals, investigates alerts, and coordinates response to suspected incidents.
Incident Response
Security Orchestration Automation and Response
Security orchestration, automation, and response connects security tools and repeatable workflows to help teams triage alerts and carry out approved response steps.
Web Application Security
Server-Side Request Forgery
A flaw that lets an attacker induce a server to send a request to an unintended destination.
Cloud Security
Serverless Function
A serverless function is code run on demand by a cloud service without the customer managing the underlying server process.
Web Application Security
Session Hijacking
Session hijacking is the unauthorized use of another person's active session, often through a stolen or exposed session identifier.
Cloud Security
Shared Responsibility Model
A division of security duties between a cloud provider and its customer.
Phishing Social Engineering
Social Engineering
Manipulating people to make them disclose information or perform actions they otherwise would not.
Phishing Social Engineering
Spear Phishing
Phishing tailored to a particular person, role, or organization.
Malware
Spyware
Software that secretly collects information or monitors activity without proper authorization.
Business Cybersecurity
Supply Chain Security
Supply chain security manages cyber risks introduced through products, software, services, and organizations an enterprise depends on.
Incident Response
Tabletop Exercise
A tabletop exercise is a guided discussion of a simulated incident in which participants walk through decisions, roles, and communications without disrupting live systems.
Business Cybersecurity
Third Party Risk
Third-party risk is the possibility that an external organization or service affects a business's security, operations, compliance, or customers.
AI Security
Training Data Poisoning
Training data poisoning is manipulation of examples used to train or fine-tune a model to bias, degrade, or redirect its future outputs.
Network Security
Transmission Control Protocol
Transmission Control Protocol is a connection-oriented transport protocol that provides an ordered, reliable byte stream between applications.
Cryptography
Transport Layer Security
A protocol that protects the confidentiality and integrity of data exchanged over a network.
Malware
Trojan Horse
A Trojan horse is software that appears legitimate or desirable but performs an undisclosed malicious action when used.
Network Security
User Datagram Protocol
User Datagram Protocol is a lightweight transport protocol that sends datagrams between application ports without guaranteeing delivery or ordering.