Glossary
Security Jargon,Finally In Plain English.
From access control to zero trust, every term explained the way a trusted advisor would.
- Terms explained
- 120
- English, no jargon
- Plain
- No sign-up needed
- Free
ABCDEMPRSZ
Definition
Phishing-resistant MFA
Sign-in that a fake login page cannot steal, such as passkeys or FIDO2 security keys, because the credential is bound to the real website.
MFAPasskeysAccount takeover
Certified partner of
A to Z
120 Security Terms, One Sentence First
Each term opens with a one-sentence definition, then explains what it means for a Canadian business, with related terms and the service that covers it.
Terms starting with 3
Letter A
- Account takeoverATOAccount takeover (ATO) is when an attacker gains control of a legitimate user account, such as Microsoft 365, banking or a SaaS application, and uses it as if they were the owner.
- Adversary-in-the-middleAiTMAdversary-in-the-middle (AiTM) phishing is an attack that places a proxy between the victim and a real login service, capturing the password and the authenticated session cookie so the attacker can bypass ordinary MFA.
- AI governanceAI governance is the set of policies, roles and controls an organization uses to decide which AI tools may be used, with what data, for which purposes, and how the resulting risks are monitored.
- Alberta Personal Information Protection ActAlberta PIPAAlberta Personal Information Protection Act (Alberta PIPA) is Alberta's private-sector privacy law, which governs how organizations in the province handle personal information and requires notification of certain privacy breaches to the Information and Privacy Commissioner of Alberta.
- AntivirusAVAntivirus (AV) is software that detects, blocks and removes known malicious software, traditionally by comparing files against signatures of known malware.
- Application allowlistingApplication allowlisting is a security control that permits only approved software to run on a system and blocks everything else by default.
- Asset inventoryAn asset inventory is a maintained record of an organization's hardware, software, cloud services and data, including what each asset is, who owns it and how it is protected.
- Attack surface managementASMAttack surface management (ASM) is the continuous discovery and monitoring of an organization's internet-facing assets, such as domains, IP addresses, cloud services and exposed applications, to identify weaknesses from an attacker's point of view.
Letter B
- Baseline cyber security controlsBaseline cyber security controls are the Canadian Centre for Cyber Security's recommended minimum set of security practices for small and medium organizations, designed to address the most common cyber threats at reasonable cost.
- Breach recordA breach record is the documented log that organizations must keep of privacy breaches, such as PIPEDA's requirement to record every breach of security safeguards involving personal information for 24 months, and Quebec Law 25's confidentiality incident register.
- Business continuity planBCPA business continuity plan (BCP) is a documented strategy for keeping critical business functions running, or restoring them quickly, during and after a disruption such as a cyberattack, outage, fire or flood.
- Business email compromiseBECBusiness email compromise (BEC) is a fraud in which criminals use a hacked or impersonated business email account to trick staff, clients or suppliers into sending money or sensitive information.
Letter C
- Canadian Anti-Fraud CentreCAFCCanadian Anti-Fraud Centre (CAFC) is Canada's central agency for collecting information and intelligence on fraud and identity theft, jointly operated by the RCMP, the Competition Bureau and the Ontario Provincial Police.
- Canadian Centre for Cyber SecurityCyber CentreCanadian Centre for Cyber Security (Cyber Centre) is Canada's national authority on cyber security, part of the Communications Security Establishment, providing advice, guidance, threat assessments and incident support to governments, critical infrastructure, businesses and the public.
- Canadian Program for Cyber Security CertificationCPCSCCanadian Program for Cyber Security Certification (CPCSC) is a federal program requiring suppliers on certain Department of National Defence contracts to demonstrate that they protect sensitive unclassified government information, at a certification level set for each contract.
- CIS ControlsCIS Controls are a prioritized set of cybersecurity safeguards published by the Center for Internet Security that describe the most effective actions organizations can take to defend against common attacks.
- Cloud access security brokerCASBA cloud access security broker (CASB) is a security tool that provides visibility and control over how users access and use cloud applications, including discovering unsanctioned apps, enforcing policies and protecting data in SaaS services.
- Cloud security posture managementCSPMCloud security posture management (CSPM) is a category of tools that continuously assess cloud environments such as Azure, AWS and Google Cloud for misconfigurations, compliance gaps and risky settings.
- Commission d'accès à l'information du QuébecCAICommission d'accès à l'information du Québec (CAI) is Quebec's privacy and access to information regulator, responsible for overseeing compliance with Quebec's public and private-sector privacy laws, including Law 25.
- Conditional accessConditional access is an identity security feature, notably in Microsoft Entra ID, that grants, blocks or adds requirements to sign-ins based on conditions such as user, device health, location, application and risk level.
- Credential stuffingCredential stuffing is an automated attack in which criminals take usernames and passwords leaked from one breach and try them on other services, exploiting people who reuse passwords.
- Critical Cyber Systems Protection ActCCSPACritical Cyber Systems Protection Act (CCSPA) is federal legislation, enacted through Bill C-8 in June 2026, that imposes cyber security obligations on designated operators of vital services and systems in federally regulated sectors.
- Cross-site scriptingXSSCross-site scripting (XSS) is a web application vulnerability that lets an attacker inject malicious scripts into pages viewed by other users, which can steal session cookies, capture input or alter what the user sees.
- Cyber insuranceCyber insurance is an insurance policy that covers financial losses from cyber incidents, including incident response, legal advice, breach notification, data restoration, business interruption, cyber extortion and liability claims from third parties.
- CyberSecure CanadaCyberSecure Canada is a voluntary federal cybersecurity certification program for small and medium-sized organizations, run by Innovation, Science and Economic Development Canada (ISED), based on the Canadian Centre for Cyber Security's baseline controls.
Letter D
- Data exfiltrationData exfiltration is the unauthorized transfer of data out of an organization, whether by an external attacker, malware or an insider.
- Data loss preventionDLPData loss prevention (DLP) is a set of tools and policies that identify sensitive information and monitor or block it from being shared, copied or sent outside approved channels.
- Data poisoningData poisoning is an attack that corrupts the data used to train or inform an AI model, causing it to behave incorrectly, introduce hidden backdoors or produce manipulated outputs.
- Deepfake fraudDeepfake fraud is the use of AI-generated or AI-altered audio, video or images to impersonate real people, typically executives, suppliers or job candidates, in order to steal money, data or access.
- Digital forensicsDigital forensics is the collection, preservation and analysis of digital evidence from computers, networks, cloud services and mobile devices to determine what happened during a security incident.
- Distributed denial of serviceDDoSDistributed denial of service (DDoS) is an attack that overwhelms a website, application or network with traffic from many sources so that legitimate users cannot reach it.
- DKIMDKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages, allowing receiving servers to verify that the message came from the domain and was not altered in transit.
- DMARCDMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that tells receiving mail servers how to handle messages that fail SPF and DKIM checks for your domain, and sends you reports on who is sending email as you.
- Double extortionDouble extortion is a ransomware tactic in which attackers both encrypt a victim's systems and steal their data, then threaten to publish the data if the ransom is not paid.
- Dwell timeDwell time is the length of time an attacker remains undetected inside an organization's environment, from initial compromise until discovery.
Letter E
- Email security gatewayAn email security gateway is a service or appliance that filters incoming and outgoing email to block spam, phishing, malware and impersonation before messages reach users' inboxes.
- EncryptionEncryption is the process of converting readable data into an unreadable form using a cryptographic algorithm and key, so that only parties with the correct key can read it.
- Endpoint detection and responseEDREndpoint detection and response (EDR) is security software that continuously records activity on laptops, desktops and servers, detects suspicious behaviour and lets defenders investigate and respond remotely, for example by isolating a device.
- ExploitAn exploit is code, a technique or a sequence of actions that takes advantage of a vulnerability to make a system behave in a way its designers did not intend, such as running attacker code or bypassing authentication.
- Extended detection and responseXDRExtended detection and response (XDR) is a security platform that collects and correlates detection data across endpoints, email, identity, cloud applications and network sources to identify and respond to threats as connected incidents.
Letter F
- False positiveA false positive is a security alert that flags legitimate activity as malicious, such as an approved admin script detected as an attack or a genuine email marked as phishing.
- FIDO2FIDO2 is an open authentication standard from the FIDO Alliance and the W3C that enables phishing-resistant, passwordless sign-in using public key cryptography with security keys, built-in device authenticators or passkeys.
Letter I
- Immutable backupAn immutable backup is a backup copy that cannot be modified, encrypted or deleted for a set retention period, even by an administrator, protecting it against ransomware and malicious insiders.
- Incident responseIRIncident response (IR) is the organized approach an organization takes to detect, contain, investigate, eradicate and recover from a cybersecurity incident, and to learn from it afterwards.
- Incident response planIRPAn incident response plan (IRP) is a documented set of roles, contacts, procedures and decision rules that guides an organization through detecting, containing, recovering from and reporting a cybersecurity incident.
- Indicator of compromiseIOCAn indicator of compromise (IOC) is a piece of forensic evidence, such as a malicious IP address, domain, file hash or registry change, that suggests a system has been breached or targeted.
- InfostealerAn infostealer is a type of malware that harvests saved passwords, browser cookies, session tokens, cryptocurrency wallets and other data from an infected device and sends it to criminals.
- Initial access brokerIABAn initial access broker (IAB) is a cybercriminal who breaks into organizations, or obtains working access to them, and sells that access to other criminals such as ransomware affiliates.
- Insider threatAn insider threat is a security risk that comes from people with legitimate access, such as employees, contractors or partners, whether they act maliciously, carelessly or because their account has been compromised.
- Invoice fraudInvoice fraud is a scam in which criminals send fake invoices or alter genuine ones, usually changing the bank account details, so that a business pays the criminal instead of its real supplier.
- ISO/IEC 27001ISO 27001ISO/IEC 27001 is the international standard for an information security management system (ISMS), setting requirements for how an organization establishes, operates, monitors and improves the management of information security risk.
Letter L
- Lateral movementLateral movement is the set of techniques attackers use after gaining initial access to move from one system to others within a network, seeking higher privileges and valuable data.
- Least privilegeLeast privilege is the security principle that every user, application and system should have only the minimum access needed to do its job, for only as long as it is needed.
- Living off the landLOTLLiving off the land (LOTL) is an attacker technique that uses legitimate tools already present on a system, such as PowerShell, Windows Management Instrumentation or remote desktop, instead of custom malware, to avoid detection.
Letter M
- MalwareMalware is any software designed to harm, exploit or gain unauthorized access to a device, network or data, including viruses, worms, trojans, ransomware, spyware and infostealers.
- Managed detection and responseMDRManaged detection and response (MDR) is an outsourced security service in which a provider's analysts monitor an organization's endpoints, identities, cloud services and networks around the clock, investigate threats and take action to contain them.
- Managed security service providerMSSPA managed security service provider (MSSP) is a company that delivers outsourced security services, such as 24/7 monitoring, detection and response, vulnerability management, firewall management and compliance support, to client organizations.
- Mean time to detectMTTDMean time to detect (MTTD) is the average time between when a security incident begins and when the organization or its security provider identifies it.
- Mean time to respondMTTRMean time to respond (MTTR) is the average time between detecting a security incident and containing or resolving it, a key measure of a security team.
- MFA fatigueMFA fatigue is an attack in which someone who already has a user's password sends repeated multi-factor push notifications until the user approves one out of annoyance, confusion or habit.
- Microsoft Secure ScoreMicrosoft Secure Score is a measurement in the Microsoft Defender portal that rates an organization's Microsoft 365 and related security configuration and recommends improvements, each weighted by its estimated security impact.
- MITRE ATT&CKMITRE ATT&CK is a publicly available knowledge base of adversary tactics and techniques, based on real-world observations, that describes how attackers operate across each stage of an intrusion.
- Multi-factor authenticationMFAMulti-factor authentication (MFA) is a sign-in method that requires two or more independent proofs of identity, such as a password plus a code, app approval, security key or biometric, before granting access.
Letter N
- Network segmentationNetwork segmentation is the practice of dividing a network into separate zones with controlled traffic between them, so that a compromise in one area cannot easily spread to others.
- Next-generation firewallNGFWA next-generation firewall (NGFW) is a network security device that filters traffic based on applications, users and content, not just ports and IP addresses, and typically includes intrusion prevention, web filtering and threat intelligence.
- NIST Cybersecurity FrameworkNIST CSFNIST Cybersecurity Framework (NIST CSF) is a voluntary framework from the U.S. National Institute of Standards and Technology that organizes cybersecurity activities into core functions to help organizations understand, manage and communicate cyber risk.
- NIST SP 800-171NIST SP 800-171 is a U.S. National Institute of Standards and Technology publication that specifies security requirements for protecting controlled unclassified information held by non-federal organizations, such as defence contractors.
Letter P
- PasskeysPasskeys are passwordless sign-in credentials based on the FIDO2 standard, stored on a device or in a password manager and opened with a fingerprint, face or PIN, that are resistant to phishing because they only work on the legitimate website.
- Password managerA password manager is an application that generates, stores and fills strong, unique passwords for each account, protected behind a single master password or passkey and usually encrypted so the provider cannot read the contents.
- Password sprayingPassword spraying is an attack that tries a small number of common passwords, such as Spring2026 or Company123, against many user accounts at once to avoid triggering account lockouts.
- Patch managementPatch management is the process of identifying, testing, deploying and verifying software updates that fix security vulnerabilities and bugs across operating systems, applications, firmware and network devices.
- PCI DSSPCI DSS (Payment Card Industry Data Security Standard) is a global security standard, maintained by the PCI Security Standards Council, that applies to organizations that store, process or transmit payment card data.
- Penetration testingPenetration testing is an authorized, simulated attack in which skilled testers try to find and exploit weaknesses in systems, networks or applications to show how a real attacker could cause harm and how to fix it.
- Personal Information Protection and Electronic Documents ActPIPEDAPersonal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law for the private sector, governing how organizations collect, use and disclose personal information in the course of commercial activity.
- PhishingPhishing is a social engineering attack in which criminals send fraudulent messages, usually email, that impersonate a trusted organization or person to steal credentials, money or data, or to install malware.
- Phishing simulationA phishing simulation is a controlled exercise in which an organization sends realistic but harmless phishing messages to its own staff to measure how they respond and to provide immediate, targeted training.
- Phishing-resistant MFAPhishing-resistant MFA is multi-factor authentication that cannot be captured or relayed by a fake website, because the credential is cryptographically bound to the legitimate site's domain, as with FIDO2 security keys, passkeys and Windows Hello for Business.
- Privacy impact assessmentPIAA privacy impact assessment (PIA) is a structured analysis of how a project, system or process collects, uses, discloses and protects personal information, identifying privacy risks and the measures needed to reduce them.
- Privilege escalationPrivilege escalation is when an attacker or user gains higher access rights than they were granted, such as moving from a standard account to local administrator or domain administrator.
- Privileged access managementPAMPrivileged access management (PAM) is the set of tools and practices used to control, secure and monitor accounts with administrative permissions, such as domain administrators, cloud admins and service accounts.
- Prompt injectionPrompt injection is an attack on AI systems in which crafted text, either typed directly or hidden in content the AI reads, overrides the system's instructions and makes it reveal data or take unintended actions.
Letter Q
- Quebec Law 25Quebec Law 25 is the Quebec statute, formerly Bill 64, that modernized the province's private-sector privacy law, adding obligations such as a designated privacy officer, mandatory confidentiality incident reporting, privacy impact assessments and significant penalties.
- QuishingQuishing, or QR code phishing, is a phishing attack that uses a QR code to send the victim to a malicious website, often to steal Microsoft 365 or other credentials.
Letter R
- RansomwareRansomware is malicious software that encrypts an organization's files and systems and demands payment for the decryption key, often combined with theft of data and a threat to publish it.
- Ransomware as a serviceRaaSRansomware as a service (RaaS) is a criminal business model in which ransomware developers lease their malware, infrastructure and leak sites to affiliates who carry out attacks in exchange for a share of ransom payments.
- Real risk of significant harmRROSHReal risk of significant harm (RROSH) is the legal threshold under PIPEDA, and Alberta's PIPA, that determines when a privacy breach must be reported to the regulator and notified to affected individuals.
- Recovery point objectiveRPOA recovery point objective (RPO) is the maximum acceptable amount of data loss, measured in time, after a disruption, which determines how frequently data must be backed up or replicated.
- Recovery time objectiveRTOA recovery time objective (RTO) is the maximum acceptable amount of time a system, application or business function can be unavailable after a disruption before the impact becomes unacceptable.
- Red teamA red team is a group of security specialists who emulate real adversaries over an extended engagement to test an organization's ability to prevent, detect and respond to a realistic, goal-driven attack.
- Risk assessmentA risk assessment is a structured process for identifying threats and vulnerabilities, estimating the likelihood and impact of potential incidents, and prioritizing actions to reduce the most significant risks.
Letter S
- Security awareness trainingSecurity awareness training is an ongoing education program that teaches employees to recognize and respond to cyber threats such as phishing, social engineering and fraud, and to follow security practices in their daily work.
- Security information and event managementSIEMSecurity information and event management (SIEM) is a platform that collects, normalizes and stores log data from across an organization's systems, correlates events to detect threats and supports investigation and compliance reporting.
- Security operations centreSOCA security operations centre (SOC) is the team, processes and technology responsible for monitoring an organization's environment for cyber threats, investigating alerts and coordinating the response to incidents, typically around the clock.
- Security orchestration, automation and responseSOARSecurity orchestration, automation and response (SOAR) is technology that connects security tools and automates repeatable investigation and response steps through predefined workflows called playbooks.
- Shadow AIShadow AI is the use of artificial intelligence tools, such as chatbots, browser extensions, notetakers or coding assistants, by employees without the knowledge or approval of their organization.
- Shared responsibility modelShared responsibility model is the division of security duties between a cloud provider and its customer, in which the provider secures the underlying cloud infrastructure and the customer remains responsible for their data, identities, configurations and access.
- Single sign-onSSOSingle sign-on (SSO) is an authentication approach that lets users sign in once with one identity, such as a Microsoft Entra ID account, and then access multiple connected applications without separate passwords.
- SmishingSmishing, or SMS phishing, is a phishing attack delivered by text message, typically using a fake delivery notice, bank alert or account warning to lure the recipient to a malicious link.
- SOC 2SOC 2 is an attestation report, under standards from the American Institute of Certified Public Accountants (AICPA), in which an independent CPA firm examines a service organization's controls relevant to security, availability, processing integrity, confidentiality and privacy.
- SOC as a serviceSOCaaSSOC as a service (SOCaaS) is a subscription model in which a provider operates a security operations centre on behalf of a client, supplying the analysts, technology and processes for 24/7 monitoring, investigation and response.
- Social engineeringSocial engineering is the manipulation of people, rather than technology, to get them to reveal information, grant access or take actions that benefit an attacker.
- Spear phishingSpear phishing is a targeted phishing attack aimed at a specific person or small group, using personal or organizational details to make the message more convincing.
- SPFSPF (Sender Policy Framework) is an email authentication record published in DNS that lists which mail servers and services are authorized to send email on behalf of a domain.
- SQL injectionSQLiSQL injection (SQLi) is a web application vulnerability in which an attacker inserts database commands into input fields or requests, allowing them to read, change or delete data the application stores.
- Supply chain attackA supply chain attack is a cyberattack that compromises a trusted third party, such as a software vendor, IT provider or supplier, in order to reach that party's customers.
Letter T
- Tabletop exerciseA tabletop exercise is a facilitated, discussion-based simulation in which key staff walk through a realistic incident scenario to test their incident response plan, roles and decisions without affecting live systems.
- Threat huntingThreat hunting is the proactive, analyst-led search for attacker activity that has evaded existing security alerts, based on hypotheses about how adversaries operate.
- Threat intelligenceThreat intelligence is analyzed information about cyber threats, including attacker groups, their techniques, infrastructure and indicators, used to inform security decisions and improve detection and response.
- TyposquattingTyposquatting is the registration of domain names that closely resemble a legitimate brand's domain, using misspellings, swapped letters or different extensions, to deceive people for phishing or fraud.
Letter V
- Virtual chief information security officervCISOA virtual chief information security officer (vCISO) is a part-time, outsourced security executive who provides strategic leadership, risk management, compliance oversight and board reporting without the cost of a full-time hire.
- VishingVishing, or voice phishing, is a social engineering attack carried out by phone call or voicemail, in which criminals impersonate a trusted party to obtain information, access or money.
- Voice cloningVoice cloning is the use of AI to generate synthetic speech that imitates a specific person's voice, often from only a short sample of real audio.
- VulnerabilityA vulnerability is a weakness in software, hardware, configuration or process that an attacker could exploit to gain unauthorized access, disrupt systems or steal data.
- Vulnerability managementVulnerability management is the continuous process of discovering, prioritizing, fixing and verifying security weaknesses across an organization's systems, applications and configurations.
- Vulnerability scanA vulnerability scan is an automated assessment that checks systems, networks or applications for known security weaknesses such as missing patches, outdated software, weak configurations and exposed services.
Letter Z
- Zero trustZero trust is a security model that assumes no user, device or network location is trusted by default, so every access request is verified explicitly, granted with least privilege and monitored continuously.
- Zero trust network accessZTNAZero trust network access (ZTNA) is a remote access approach that connects users only to specific approved applications after verifying their identity and device, instead of placing them on the whole network as a traditional VPN does.
- Zero-dayA zero-day is a software vulnerability that is unknown to the vendor or has no available patch, so defenders have had zero days to fix it before it can be exploited.
No term matches that search. Try the abbreviation or a shorter word, search the knowledge base, or ask a certified specialist.