Security glossary

Plain definitions of the terms that appear in security marketing, written so you can tell which ones describe a real mechanism and which are decoration. Where a term is routinely over-claimed, the entry says what it does not mean as well as what it does.

Adware

Software that displays advertising you did not ask for, often bundled with a free download. Not always classified as malware, frequently unwanted, and a common reason a browser suddenly behaves oddly.

AES-256

A symmetric encryption algorithm with a 256-bit key, used almost universally for encrypting data at rest and inside VPN tunnels. Seeing it named tells you the maths is standard; it says nothing about whether the surrounding implementation, key handling or logging policy is sound.

Behavioural detection

Judging software by what it does once running — rewriting many files quickly, altering boot settings, contacting known command servers — rather than by what it looks like. The layer with a realistic chance against genuinely new malware, and the one most likely to raise a false alarm.

Botnet

A network of compromised machines controlled remotely and rented out, typically for sending spam or overwhelming a target with traffic. An infected machine in a botnet often shows no symptom its owner would notice.

Brute force attack

Trying passwords or keys exhaustively until one works. Long passwords defeat it arithmetically; rate limiting and account lockout defeat it practically.

Credential stuffing

Taking usernames and passwords leaked from one breached service and trying them automatically against many others. It works only where a password has been reused, which is why unique passwords matter more than complex ones.

Dark web

Parts of the internet reachable only through anonymising networks such as Tor. In security marketing the phrase is usually shorthand for the trading of leaked data, some of which happens on ordinary forums and chat channels rather than anywhere exotic.

Data breach

An incident in which data held by an organisation is accessed or disclosed without authorisation. Under GDPR, controllers must notify the supervisory authority within 72 hours of becoming aware of one where it poses a risk to individuals.

DNS

The Domain Name System, which translates a name such as example.com into an address a computer can connect to. Some security products filter at this level, blocking known malicious names before a connection is made.

End-to-end encryption

Encryption in which only the communicating parties hold the keys, so the service carrying the messages cannot read them. Distinct from encryption in transit, where the provider can read the content on its own servers.

Exploit

Code that takes advantage of a specific vulnerability. An exploit for a patched vulnerability is harmless to a patched system, which is the whole argument for installing updates promptly.

False positive

A safe file wrongly flagged as malicious. The figure printed beside every detection rate in an independent lab report, and left out of every marketing slide. A product that blocks everything, including your accounting software, is not a good product.

Fingerprinting

Identifying a browser by the combination of properties it reveals — fonts, screen size, extensions, rendering quirks — rather than by a stored cookie. Under EU rules it requires consent on the same basis as cookies, because it involves gaining access to information stored in your terminal equipment.

Firewall

A filter controlling which network connections are permitted. Operating systems have included a competent one for many years; third-party firewalls mainly add finer per-application control.

Heuristic analysis

Inspecting the structure of a file for traits that malicious code tends to share, without needing an exact match to a known sample. Catches variants of known families at the cost of some false positives.

HTTPS

HTTP carried over TLS, so traffic between your browser and the site is encrypted and the site's identity is checked against a certificate. Now the default across the web, which is why public Wi-Fi is considerably less dangerous than it was a decade ago.

Keylogger

Software or hardware that records keystrokes. Defeated in part by password managers, which fill credentials without typing them, and by second factors, which make a captured password insufficient.

Malware

The umbrella term for software written to cause harm: viruses, worms, trojans, ransomware, spyware and the rest. Useful as a category, unhelpful as a description of a specific problem.

Multi-factor authentication

Requiring more than one kind of evidence to sign in — something you know, something you have, something you are. Hardware security keys are the strongest widely available second factor because they verify the site's real address and will not authenticate to a lookalike.

Patch

A software update that fixes a defect, often a security vulnerability. Publishing one also tells attackers where the weakness was, which is why the interval between a patch and its exploitation keeps shrinking.

Phishing

Persuading somebody to hand over credentials, money or access by impersonating a party they trust. It defeats technical controls by asking a person to open the door, which is why recognising it is worth more than any product.

Ransomware

Malware that encrypts your files and demands payment for the key. Backups that are offline or versioned are the only reliable answer; paying funds the next attack and does not guarantee recovery.

Real-time protection

Continuous inspection of files as they are opened, written and executed, as opposed to scanning on demand. Never run two real-time scanners at once — they inspect each other and can slow a machine badly.

Sandbox

An isolated environment in which code runs without access to the rest of the system. Mobile operating systems sandbox every application, which is why no third-party app on iOS can scan another app's files.

Signature

A pattern identifying a known piece of malware. Fast and precise, and blind to anything not yet catalogued.

Social engineering

Manipulating people rather than software. The broader category that phishing belongs to, and the origin of most successful attacks on home users.

Spyware

Software that collects information about you without meaningful consent — browsing, keystrokes, location. The boundary with aggressive analytics is narrower than the industry finds comfortable.

Trojan

Malware disguised as something useful, relying on the user to install it willingly. Named after the horse, and as effective now as then.

Two-factor authentication

Multi-factor authentication with exactly two factors, typically a password plus a code or a hardware key. The single highest-value security setting available to a home user; enable it on your email account first, because email is the reset channel for everything else.

VPN

A virtual private network: an encrypted tunnel between your device and a server run by a provider, which then forwards your traffic. It hides your activity from the local network and your ISP, and it does not make you anonymous, block malware, or hide anything from the sites you log into.

Vulnerability

A defect that can be abused to make software do something it should not. Becomes dangerous when an exploit exists, and harmless again when the patch is installed.

Zero-day

A vulnerability being exploited before a patch exists, leaving defenders zero days of warning. The scenario behavioural detection exists for, and the reason signature matching alone is insufficient.

Zero-knowledge encryption

An arrangement in which the provider stores your data but cannot decrypt it, because the key is derived from a secret that never leaves your device. The reason a password manager provider cannot reset your master password: if it could, it could also read your vault.

Written by Oliver Cook. Definitions are general explanations for home users, not formal standards definitions. Product and company names are trademarks of their respective owners; this site is independent of all of them.