English for Cybersecurity: Essential Vocabulary & Phrases

"phishing"

A social engineering attack that uses deceptive emails or messages to trick recipients into revealing credentials or downloading malware

"The security team warned staff after a phishing campaign targeted employees with fake invoice emails."

"ransomware"

Malicious software that encrypts a victim's files and demands payment in exchange for the decryption key

"The hospital was forced to revert to paper records after ransomware encrypted its entire patient database."

"zero-day exploit"

An attack that takes advantage of a previously unknown software vulnerability before the vendor has issued a patch

"Attackers used a zero-day exploit in the browser to silently install spyware on target machines."

"man-in-the-middle attack"

An attack in which an adversary secretly intercepts and potentially alters communications between two parties

"The pen testers demonstrated a man-in-the-middle attack on the unencrypted hotel Wi-Fi network."

"SQL injection"

A code injection technique that inserts malicious SQL statements into an input field to manipulate a backend database

"The web application firewall blocked an SQL injection attempt targeting the login form."

"distributed denial-of-service"

An attack that floods a target server or network with traffic from multiple sources to make it unavailable to legitimate users

"A distributed denial-of-service attack took the online banking platform offline for over four hours."

"advanced persistent threat"

A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period

"Investigators attributed the breach to an advanced persistent threat group linked to a nation-state actor."

"supply chain attack"

An attack that targets a less-secure element in a software or hardware supply chain to compromise a downstream organisation

"The supply chain attack injected malicious code into a widely used software update package."

"firewall"

A security device or software that monitors and controls incoming and outgoing network traffic based on predetermined rules

"The administrator configured the firewall to block all inbound traffic on port 23 to prevent Telnet access."

"intrusion detection system"

A system that monitors network or system activity for malicious behaviour and generates alerts when threats are identified

"The intrusion detection system flagged an unusual outbound data transfer at 3 a.m. on Saturday."

"VPN"

Virtual Private Network — a technology that creates an encrypted tunnel over a public network to protect data and mask IP addresses

"All remote workers are required to connect through the corporate VPN before accessing internal systems."

"network segmentation"

The practice of dividing a computer network into smaller subnetworks to limit the spread of a breach and improve security

"Network segmentation ensured that the compromised HR system could not reach the financial servers."

"packet sniffing"

The capture and analysis of data packets passing through a network, used both for legitimate monitoring and malicious eavesdropping

"The attacker used packet sniffing on the open wireless network to capture unencrypted login credentials."

"demilitarised zone"

A physical or logical subnetwork that separates an internal network from untrusted external networks such as the internet

"The web server was placed in a demilitarised zone to isolate it from the internal corporate network."

"port scanning"

A reconnaissance technique that probes a target system's network ports to identify open services and potential vulnerabilities

"Log analysis revealed that an external IP had conducted port scanning against the public-facing infrastructure."

"TLS encryption"

Transport Layer Security — a cryptographic protocol that provides secure communications over a network by encrypting data in transit

"The developer updated the API to enforce TLS encryption after discovering that credentials were sent in plain text."

"triage"

The process of prioritising cybersecurity incidents or alerts based on severity and potential business impact

"The SOC analyst performed triage on the alert queue to separate critical breaches from false positives."

"containment"

Actions taken to limit the spread of a security incident and prevent further damage while the threat is investigated

"The incident response team isolated the infected workstation for containment before beginning forensic analysis."

"indicators of compromise"

Artefacts such as IP addresses, file hashes, or registry keys that suggest a system has been breached

"Threat intelligence feeds provided updated indicators of compromise that were loaded into the SIEM platform."

"forensic imaging"

The process of creating an exact bit-for-bit copy of a storage device to preserve digital evidence for investigation

"The forensic examiner created a forensic image of the server before the operating system was reinstated."

"mean time to detect"

The average time elapsed between the start of a security incident and its detection by the security team

"The security manager reported that mean time to detect had improved from 24 hours to 4 hours after deploying the new SIEM."

"playbook"

A documented set of predefined procedures that guides responders through the steps of handling a specific type of security incident

"The team followed the ransomware playbook, which specified exactly when to escalate to executive leadership."

"root cause analysis"

A systematic investigation conducted after an incident to determine the fundamental reason it occurred and prevent recurrence

"The root cause analysis revealed that the breach originated from an unpatched server exposed to the internet."

"post-incident review"

A structured meeting held after a security incident to evaluate the response, identify lessons learned, and improve future readiness

"During the post-incident review, the team identified gaps in communication between the IT and legal departments."

"scope of engagement"

A document defining which systems, networks, and methods are authorised for testing during a penetration test

"The client approved the scope of engagement listing the IP ranges the testers were permitted to target."

"reconnaissance"

The initial phase of a penetration test in which testers gather information about the target environment using passive and active techniques

"During reconnaissance, the team used OSINT tools to map the organisation's public-facing infrastructure."

"privilege escalation"

The act of exploiting a vulnerability to gain a higher level of access than was initially granted on a compromised system

"After gaining an initial foothold, the attacker attempted privilege escalation to obtain administrator rights."

"lateral movement"

Techniques used by attackers to progressively move through a network after initial compromise in search of high-value targets

"The red team demonstrated lateral movement from a compromised developer laptop to the production database server."

"exploit"

A piece of software, code, or technique that takes advantage of a vulnerability in a system to cause unintended behaviour

"The penetration tester used a known public exploit to compromise the outdated web server within minutes."

"red team"

A group that simulates real-world adversarial attacks to test an organisation's defences, detection, and response capabilities

"The red team exercise revealed that the security operations centre failed to detect the simulated intrusion for 72 hours."

"blue team"

The internal security team responsible for defending systems and responding to attacks, including those launched by the red team

"After the exercise, the blue team reviewed every alert they had missed and updated their detection rules accordingly."

"vulnerability assessment"

A systematic review of security weaknesses in an information system, identifying and classifying them by risk level

"The quarterly vulnerability assessment uncovered 14 critical issues in the e-commerce platform that required immediate patching."

"public key infrastructure"

A framework of policies, procedures, and technologies used to create, manage, distribute, and revoke digital certificates

"The organisation deployed a public key infrastructure to issue certificates to all employee devices."

"multi-factor authentication"

An authentication method requiring the user to present two or more verification factors to gain access to a resource

"After enabling multi-factor authentication, account takeover attempts dropped by over 90 percent."

"hashing"

The process of converting data of any size into a fixed-length string using a one-way mathematical function, commonly used to store passwords securely

"The developer used bcrypt hashing with a high work factor to protect stored user passwords."

"digital signature"

A cryptographic mechanism that verifies the authenticity and integrity of a message or document, proving it was created by a known sender

"The software update was signed with a digital signature so users could verify it had not been tampered with."

"end-to-end encryption"

A communication method where only the communicating users can read the messages, preventing interception by any intermediary

"The messaging application implemented end-to-end encryption so that even the service provider cannot read user messages."

"certificate authority"

A trusted entity that issues digital certificates used to verify the identity of websites and organisations on the internet

"The browser displayed a warning when the website's certificate had been issued by an untrusted certificate authority."

"least privilege"

A security principle that grants users only the minimum level of access rights required to perform their job functions

"The audit found several accounts violating least privilege by retaining admin rights they no longer needed."

"single sign-on"

An authentication scheme that allows a user to log in once and gain access to multiple related but independent systems

"The company rolled out single sign-on to reduce password fatigue and simplify IT management across 30 applications."

"risk assessment"

The process of identifying, analysing, and evaluating potential threats to an organisation's information assets

"The annual risk assessment ranked a cloud misconfiguration as the highest-priority vulnerability in the environment."

"data breach notification"

A legal obligation requiring organisations to inform affected individuals and regulators when personal data has been unlawfully accessed or disclosed

"Under GDPR, the company had 72 hours to submit a data breach notification to the supervisory authority."

"penetration testing requirement"

A compliance mandate that organisations must conduct regular authorised attacks on their systems to identify and remediate vulnerabilities

"PCI DSS includes a penetration testing requirement that mandates annual external and internal testing of cardholder data environments."

"security policy"

A formal document that defines an organisation's approach to protecting its information assets, including rules for acceptable use and access control

"The updated security policy required all employees to complete annual cybersecurity awareness training."

"audit trail"

A chronological record of system activities that provides documentary evidence of the sequence of events in an IT environment

"The auditor reviewed the audit trail to confirm that access to payroll data was limited to authorised personnel."

"business continuity plan"

A documented strategy describing how an organisation will maintain or quickly resume critical functions during and after a major disruption

"The business continuity plan specified that core banking services must be restored within four hours of any outage."

"vendor risk management"

The process of assessing and monitoring the cybersecurity posture of third-party suppliers that have access to organisational data or systems

"The procurement team added a vendor risk management questionnaire to the supplier onboarding process."

"data classification"

The process of organising data into categories based on sensitivity and the level of protection required

"The data classification policy designated customer financial records as highly confidential, requiring encryption at rest and in transit."