Ntirety Cybersecurity Buzzwords

AD DS (Active Directory Domain Services)

A server function within Active Directory, the Microsoft developed service that lets administrators store and manage information about resources from a network and application in a distributed database.

Blockchain

A database that holds encrypted blocks of data and chains them together, making it difficult for hackers to make changes in the system.

CASB (Cloud Access Security Broker)

An on-premises or cloud-based security policy enforcement point that is placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as cloud-based resources are accessed.

DaaS (Desktop as a Service)

A cloud computing offering where a service provider delivers virtual desktops to end users over the internet, licensed with a per-user subscription.

EDR (Endpoint Detection and Response; also ETDR – Endpoint Threat Detection and Response )

A set of cybersecurity tools which are designed to detect and remove any malware from device endpoints or any other form of malicious activity on a network.

FERPA (Family Educational Rights and Privacy Act)

A federal law that secures the privacy of student education information.

GCP (Google Cloud Platform)

Cloud services offered by Google that provide data storage and analytics.

Hacker

A person that utilizes computers to gain unauthorized access to data.

IaaS (Infrastructure-as-a-Service)

A form of cloud computing that delivers fundamental compute, network, and storage resources on-demand, over the internet, and on a pay-as-you-go basis.

Kill Chain

A framework to understand the process of cyberattacks.

LAN (Local Area Network)

A collection of computers in a small area, such as an office or school.

Logs

A record of the events occurring within an organization’s systems and networks.

Machine Learning

Utilizing computer algorithms that learn through experience and analysis of large datasets to make predictions or decisions.

Malicious Insider

An internal threat to an organization that comes from a person within the organization, such as an employee, former employee, contractor, or business associate taking advantage of their security access to inflict harm on the organization. The threat may involve fraud, the theft of confidential or commercially valuable information, the theft of intellectual property, or the sabotage of computer systems.

Malware (also Malicious Software)

Any software intentionally designed to cause damage to a computer, server, client, or computer network.

Master Agent

A master agent works as a middleman between managed security service providers and clients to deliver the specialized security services clients need. Because they don’t work for any specific provider, they have no incentive to promote one over the other, which makes them a trustworthy source for managed security service contract procurement.

MDM (Mobile Device Management)

Security software that allows organizations to enforce company policy through the monitoring of employees’ mobile devices.

MDR (Managed Detection and Response)

A cybersecurity service that provides organizations with active monitoring, threat detection, and prevention.

MFA (Multi-Factor Authentication)

An electronic confirmation method that requires a user to provide two or more pieces of identification information in order to be granted access to a resource.

ML (Machine Learning)

A branch of artificial intelligence (AI) and computer science which focuses on the use of data and algorithms to imitate human learning, and process and analyze large datasets to make predictions or decisions.

MPS (Messages per Second)

A measurement of throughput used to understand the volume of logs that an environment generates that will need to be collected by the SIEM (security information and event management) tool for analysis and storage.

Next-Generation

A term often used in conjunction with firewalls to describe firewalls that have advanced features for enhanced security.

NFT (Non-Fungible Token)

Data that is stored on a blockchain that is unique and cannot be replaced.

NIDS (Network Intrusion Detection System)

A device that manages a network for suspicious activity.

NPS (Net Promoter Score)

A measure of customer loyalty focusing on word-of-mouth promotion, passiveness, or detraction.

NPS (Network Policy Server)

A service that helps a user manage network access authentication and authorization.

NIST (National Institute of Standards and Technology)

A United States agency whose mission is to “promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.” NIST offers cybersecurity standards, such as NIST 800-171, and maintains the most commonly used database for known vulnerabilities and their associated risks.

NoSQL (Not only Structured Query Language)

A database that stores and retrieves data using unique key values such as numbers or characters rather than rows and columns.

NTA (Network Traffic Analysis)

The process of intercepting, recording, and analyzing network traffic communication patterns in order to detect and respond to security threats.

OSI (Open Systems Interconnection)

Guidelines on how different computer systems should communicate with each other.

PaaS (Platform-as-a-Service)

A cloud computing offering that provides users with a cloud environment in which they can develop, manage and deliver applications.

PCI (Payment Card Industry)

Standards for electronic payment usage, such as credit or debit cards.

Penetration Test

An authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.

PHI (Protected Health Information)

Information in medical records about health status, provision of healthcare, or payment of healthcare that can be traced back to an individual.

Phishing

When an attacker tricks a user into revealing confidential information using false pretenses, usually through email.

PII (Personally Identifiable Information)

Information that can be traced to an individual’s identity.

POC (Proof of Concept)

Evidence from an experiment that shows the feasibility of a concept.

Ransomware

A form of malware that encrypts a victim’s files, followed by an attacker demanding ransom from the victim in order to regain access to their data.

RAT (Remote Access Tool/Trojan)

A type of malware that creates a backdoor for administrative control and unauthorized remote access to a victim’s machine. Attackers can use the exploited machines to perform various malicious activities, such as installing and removing programs, manipulating files, reading data from the keyboard, harvesting login credentials, and much more.

RBL (Real-Time Blacklist)

A list of IP addresses that are known for sending spam messages or emails.

Real-Time

Near instantaneous. And in security, this term is often used to describe intrusion prevention measures that can identify threats and stop them with little or no reaction time needed. 

SA (Solution Architect)

A solutions architect creates the overall technical vision for a specific solution to a business problem. They design, describe, and manage the solution. In many ways, this person builds the bridge between a business problem and the technology solution and outlines each of the phases and requirements required to make that solution work.

SaaS (Software-as-a-Service)

A cloud computing offering that provides users with access to a vendor’s cloud-based software that can be accessed through the web or API.

SASE (Secure Access Service Edge)

A technology used to deliver wide area network (WAN) and security controls as a cloud computing service directly to the source of connection rather than a data center.

Secure Remote Access

A service that allows client IT staff to establish secure connections with a remote, non-public computer network.

Security Posture Management

A service that continuously monitors cloud resources for security threats. Ntirety’s security experts will provide recommendations on improving security posture within the cloud.

Security Reporting

A service that provides metrics-based reporting of monthly or weekly events, granting visibility of trends and patterns, as well as common events and alarms within an infrastructure.

Serverless Function

A task (programmatic function) written by a software developer to perform a single action.

Service Level Agreement

A commitment between a client and a service provider to ensure clients are receiving the services they are entitled to.

SIEM (Security information and Event Management)

A platform that combines information management with event management to provide real-time analysis of security alerts generated by applications and network hardware. It is also used to log security data and generate compliance reports.

SmartResponse

Actions that are automated defensive or operational responses to triggered alarm rules.

SOAR (Security Orchestration, Automation, and Response)

Technologies that enable organizations to collect inputs monitored by a security operations team. For example, alerts from the SIEM system and other security technologies—where incident analysis and triage can be performed by leveraging a combination of human and machine power—help define, prioritize, and drive standardized incident response activities. SOAR tools allow an organization to define incident analysis and response procedures in a digital workflow format.

SOC (Security Operations Center)

A centralized unit staffed by expert security personnel that deals with security issues on an organizational and technical level.

SQL (Structured Query Language)

Domain specific language used in programming, management, and use of relational databases.

SSL (Secure Socket Layer)

A protocol for transmitting private information via the internet using a cryptographic system that uses two keys to encrypt data − a public key known to everyone, and a private or secret key known only to the recipient of the message.

TAM (Technical Account Manager)

A technical account manager is a customer service professional who teaches customers about how to use new products and services.

Triage and Incident Management

When the SOC (security operations center) examines incoming alarms to determine false positives from threats and create cases to notify the client of any identified threats.

Tuning

The process of configuring rules for alerts and notifications in a SIEM (security information and event management) to remove false positives in order to make alerts more meaningful and reduce noise.

UBA (User Behavior Analytics)

A cybersecurity process involving detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns—anomalies that indicate potential threats.

UCaaS (Unified Communications as a Service)

A cloud-based offering that offers a variety of communication functions, such as instant messaging or video conferencing.

URL Filtering

The monitoring and controlling of how users access the web over HTTP and HTTPS with the use of deep packet inspection.

User Acceptance Testing

Software tested by its intended audience to determine if it is completing its functions correctly.

vCISO Service (Virtual Chief Information Security Office Service)

A service performed by a cybersecurity expert who uses their vast cybersecurity and industry knowledge base to help organizations develop and manage an information security program that fits their business needs and goals.

VDI (Virtual Desktop Infrastructure)

A desktop environment that is hosted on a central server.

Virtual Firewall

A network firewall service or appliance running entirely within a virtualized environment that provides the usual packet filtering and monitoring provided via a physical network firewall.

VMware

A computer software company that provides cloud-based services allowing businesses to use multiple applications on one server.

VPN (Virtual Private Network)

A network that lets users send and receive data from public networks while hiding a user’s identity, making it more difficult for third parties to track online activity.

Vulnerability

A weakness which can be exploited by a cyberattack to gain unauthorized access to and/or perform unauthorized actions on a computer system.

Vulnerability Management

The process of minimizing risk created by vulnerabilities in an environment, often utilizing machine learning and automation to accelerate the process.

Vulnerability Scan

An automated system that looks for weaknesses within network devices or software applications.

WAAP (Web Application and API protection)

Unlike a traditional firewall, a WAAP is a highly specialized security tool specifically designed to protect web applications and APIs. It protects against common threats, such as DDoS attacks and bots.

WAF (Web Application Firewall)

The protection of web applications from potential attacks through filtering, monitoring, and blocking.

WAN (Wide Area Network)

A form of telecommunication that extends over a large geographical location.

WAR (Well Architected Review)

An architectural assessment based upon the Well-Architected Framework. The Well-Architected framework has been developed to help cloud architects build the most secure, high-performing, resilient, and efficient infrastructure possible for their applications.

Workstation Patching

The process of distributing and applying updates to PC software. These patches are necessary to correct errors or update functionality.

XDR (Cross-layered Detection and Response)

An advanced form of EDR (endpoint detection and response) that usually considers both endpoint and network security and is optimized for management through a SIEM (security information and event management).

Zero Day

A computer-software vulnerability previously unknown to those who should be interested in its mitigation, such as the vendor of the target software. Until the vulnerability is mitigated, hackers can exploit it to adversely affect programs, data, additional computers, or a network.

Zero Trust (also ZTNA – Zero Trust Network Access)

A strategic approach to cybersecurity that secures an organization by eliminating implicit trust and continuously validating every stage of a digital interaction, rooted in the principal of “never trust, always verify”.