The cybersecurity dictionary
159 Views •Defence : the blocked addresses
155 Views •Who is watching while you work
147 Views •Risk analysis : a score, and why
143 Views •The crisis room: the button never to press
142 Views •The help centre and the explanation bubbles
140 Views •Opening a support ticket
139 Views •Exclusions : silencing what is normal at your site
137 Views •The dashboard : ten seconds to know
137 Views •Your three habits, and what comes next
136 Views •My organisation : companies and licences
134 Views •Signing in : and what if I lost my password
133 Views •Who it is for
133 Views •Companies : the administrative record
133 Views •Vulnerabilities : the updates that are missing
133 Views •Creating your workspace and accepting the terms
133 Views •The equipment list : your machines
132 Views •Playbooks : ready-made responses
127 Views •Installing the agent on a machine
127 Views •Backups : verified, not just launched
127 Views •The cybersecurity dictionary
Fifty words, and what they change for you
Cybersecurity speaks in acronyms. They intimidate, and that is their main flaw: a director who cannot follow a report stops reading it. Here is what you will come across, explained plainly, each with its practical consequence for your business.
Keep this page bookmarked. It is the reference for the day a report, an insurer or a customer asks you something you have no word for.
1. What you see on your screens
| The word | What it means, and what it changes |
|---|---|
| Agent | The small program installed on each machine, reporting what it observes. It blocks nothing by itself: it reports. A machine without an agent is a machine you know nothing about. |
| SCA Security Configuration Assessment |
A measure of your settings against a recognised good practice. The Security Center gives you a percentage per machine. A workstation at 45 % has not been hacked: it is badly configured, which is easier to fix and cheaper the sooner you do it. |
| FIM File Integrity Monitoring |
Watching sensitive files: if a system file changes without an update to explain it, you are told. That is how an intrusion that succeeded gets spotted. |
| CVE | The worldwide reference number of a known software flaw, published by its vendor. "CVE-2026-1234" means the same flaw everywhere. It is fixed by an update, rarely by anything else. |
| CVSS | The severity score of a CVE, from 0 to 10. Above 7, fix within the week; above 9, within the day. Below 4, it can wait for your next maintenance window. |
| Severity | Four levels: low, medium, high, critical. The vast majority of your lines will be low or medium, and that is the sign of a healthy estate. |
| IOC Indicator of Compromise |
A trace that signals a compromise: an address contacted, a recognised file, a signature. One IOC proves nothing; three that corroborate each other deserve a phone call. |
| False positive | An alert describing something normal at your site. Declare it once and it goes quiet. A tool that cries wolf is a tool nobody watches: declaring false positives is a security act, not a convenience. |
| MITRE ATT&CK | The worldwide catalogue of attack techniques. When an alert quotes "T1566", it names precisely which technique was recognised. Mostly useful when explaining an incident to an insurer. |
| Compliance | Following a recognised good practice, measured as a percentage. A score is not a security grade: it measures the gap between your settings and a baseline. |
2. What threatens you
| The word | What it means, and what it changes |
|---|---|
| Phishing | A message impersonating a trusted party to make you click, pay or hand over a password. It is the entry point for most business incidents, far ahead of anything else. |
| Spear phishing | The same, written for you: your name, your supplier, your current file. You will not spot it by the spelling, because there are no mistakes. Only a verification call exposes it. |
| CEO fraud | A fake message from management asking for an urgent, confidential transfer. The urgency and the secrecy are the attack. No internal rule should allow either to be bypassed. |
| Ransomware | A program that encrypts your files and demands a ransom. What saves you is not the antivirus: it is an offline, tested backup the attacker cannot reach. |
| Exfiltration | Data theft by copying it out. Often silent and weeks ahead of the encryption: by the time the ransom note arrives, the data has already left. |
| Spoofing | Passing for someone else: sender address, domain name, phone number. SPF, DKIM and DMARC exist precisely to make it hard on your own domain. |
| Backdoor | A hidden access left by an attacker to come back. This is why an incident is not closed when the machine works again: it closes when you have checked what remains. |
| Privilege escalation | Moving from an ordinary account to an administrator one. Most attacks start small and grow: that movement is what monitoring looks for. |
| DDoS | Saturating a service to make it unavailable. Not a theft, a blockage. Sometimes a diversion while something else happens elsewhere. |
| Attack surface | Everything of yours reachable from outside. Every open port, every published service counts. Reducing it costs less than defending it. |
3. What protects you
| The word | What it means, and what it changes |
|---|---|
| Encryption | Making data unreadable without the key. A stolen encrypted disk is an unusable disk. Without it, a lost laptop becomes a data breach you must declare. |
| MFA | A password plus something else: a code, an app, a physical key. The best effort-to-protection ratio available today. A stolen password is no longer enough. |
| SSO | One identity for several tools. Fewer passwords to remember, and above all: a departure is cut off in one move instead of eight possible oversights. |
| Hardening | Removing from a machine what it does not need: unused services, default accounts, old protocols. The least visible and most rewarding work in security. |
| Least privilege | Everyone holds only the rights they need, and not one more. When an account is compromised, this principle decides how far the damage spreads. |
| Segmentation | Separating networks so one compromised machine does not open everything. The workshop till has no business on the same segment as the accounts. |
| 3-2-1 backup | Three copies, on two different media, one of them off site. The rule that survives ransomware, fire and human error, because none of the three reaches all of them. |
| Tested restore | A backup you have checked reads back. A backup never restored is not a backup: it is an intention. |
| Firewall | The filter deciding what comes in and goes out. It protects from the outside, not from what is already inside. |
| Patch | The update that fixes a known flaw. Most successful attacks exploit a flaw fixed months earlier. |
4. What the law asks of you
| The word | What it means, and what it changes |
|---|---|
| GDPR | The European regulation on personal data. It requires you to know what data you hold, why, and for how long. A breach is declared within 72 hours. |
| NIS 2 | The European directive extending cybersecurity obligations to many mid-sized companies, including by knock-on effect: your customer subject to NIS 2 will ask you for evidence. |
| ISO 27001 | The international standard for security management. An expensive certification, rarely necessary for a small business, but whose principles are worth knowing. |
| ENISA / national agency | The European and national cybersecurity agencies publish free, remarkably clear guidance, and their recommendations carry weight in a dispute. |
| CIS Benchmark | A baseline of safe settings, system by system. It is what the Security Center measures when it gives you a compliance percentage. |
| Cyber insurance | Insurance covering the incident. Insurers now demand evidence: MFA, tested backups, monitoring. A documented compliance score weighs on your premium. |
5. The security trade
| The word | What it means, and what it changes |
|---|---|
| SOC | The team and tools watching continuously. The Security Center is your SOC: you do not have to hire a night shift to know what happens on your machines. |
| SIEM | The tool gathering logs from all your machines to look for correlations. An alert rarely comes from one event: it comes from a sequence. |
| EDR / XDR | Detection on endpoints (EDR), extended to network and mail (XDR). An antivirus recognises what it knows; an EDR notices abnormal behaviour, even unseen before. |
| CISO | The person accountable for information security. In a small business this is rarely a post: it is a hat, often worn by the owner or their provider. |
| Penetration test | An audit where a professional genuinely tries to break in, with your written authorisation. It tells you what an attacker would find. Useful once the basics are in place, wasted before. |
| Vulnerability scan | An automated sweep listing known flaws. Shallower than a penetration test, far cheaper, and enough to start. |
| DevSecOps | Handling security during development rather than after. Relevant if you have software built for you: ask your provider the question. |
| Playbook | A written procedure prepared in advance for a type of incident. Its value lies in existing beforehand: nobody improvises well at three in the morning. |
| Business continuity plan | What you do to keep working during the incident. Distinct from the recovery plan, which says how to get back to normal afterwards. |
| Zero Trust | Trusting nothing by default, even inside the network. A posture, not a product: be wary of anyone selling it in a box. |
You do not have to memorise this page. It exists to be consulted the day a word stops you, in a report, an insurer's email or a quote. Three of them do deserve to stay in mind, because they decide nearly everything: MFA, tested backup, and patching.
Rating
0
0
Commenting is not enabled on this course.