The 100 words of cybersecurity

A simple backup rule: 3 copies of your data, on 2 different types of media, with 1 kept off-site.

Belinda

Microsoft’s directory service, which centralises the accounts, passwords and permissions of most corporate Windows networks: whoever controls it controls the whole network.

Nestor

A highly organised group of attackers, often linked to a state, that quietly gains long-term access to a targeted network to spy, steal secrets or prepare sabotage.

All the points through which an attacker can try to get into your information systems or extract data from them: internet-facing services, applications, accounts, devices, suppliers and people.

How much information testers receive before an audit: nothing (black box), a user account or partial documentation (grey box), or everything, source code included (white box).

The team that defends the information system day to day: monitoring, detecting attacks, responding to them and hardening configurations.

A network of infected computers, servers or connected devices that an attacker controls remotely and makes act together without their owners knowing.

An attack that systematically tries large numbers of passwords until it finds the right one, either online against a login service or offline against stolen password hashes.

A programming error in which software writes more data than a memory area can hold, overwriting neighbouring data, which can crash the program or let malicious code run.

A programme in which an organisation invites security researchers to look for flaws within a defined scope, and rewards them for each valid vulnerability reported.

The business continuity plan (BCP) keeps essential activities running during a crisis; the disaster recovery plan (DRP) explains how to restart IT systems and recover data after a disaster.

A scam in which a fraudster poses as a senior executive, supplier or lawyer to get an employee to make an urgent, confidential bank transfer to an account the fraudster controls.

A certificate is a digital identity card that binds a public key to a name (website, person, machine); PKI is the system that issues, verifies and revokes these certificates.

The three core goals of information security: confidentiality (only authorised people can access the data), integrity (the data is not wrongly altered) and availability (it is there when you need it).

Belinda

The Chief Information Security Officer: the person who sets an organisation’s cybersecurity strategy, steers its security risks and advises senior management.

Belinda

A professional certification from ISC2, one of the most widely recognised in the world, attesting to proven experience and a broad view of information security.

The infrastructure an attacker uses to steer compromised machines remotely: sending orders, retrieving data, deploying further tools.

An automated attack that tries large numbers of username and password pairs stolen elsewhere against a site, betting that people reuse the same passwords.

An attack that makes a logged-in user’s browser silently send a legitimate-looking request (changing an email address, making a transfer, deleting data) to a site where they have an open session.

A web application flaw that lets an attacker inject JavaScript into a page viewed by other users, and so act inside their browser on their behalf.

A team dedicated to responding to security incidents for a given constituency (a company, a sector, a region, a country), which warns, advises and coordinates the response.

A unique public identifier given to a known vulnerability (for example CVE-2021-44228), so that everyone can talk about the same flaw without ambiguity.

A scoring system from 0 to 10 that measures the technical severity of a vulnerability, based on criteria such as how easy it is to exploit and its impact on data and service.

A public catalogue of the types of design and coding mistakes that cause vulnerabilities, each type carrying a number (for example CWE-89 for SQL injection).

The EU regulation that sets cybersecurity requirements for all hardware and software products with digital elements sold in the EU, from design to the end of their support period.

The technical, organisational and human measures that protect computer systems, data and people against attacks, mistakes and failures.

Automated testing of a running application, sending it requests the way an attacker would in order to observe its reactions and detect exploitable flaws.

An attack that knocks a website or service offline by flooding it with requests sent simultaneously from thousands of machines.

A strategy that stacks several independent layers of protection, so that when one fails, the others make up for it.

An approach that builds security into every stage of developing and running software, instead of checking it only at the end, just before release.

The discipline of collecting, preserving and analysing digital traces (disks, memory, logs) to reconstruct what happened during an incident, rigorously enough for the evidence to stand up in court.

A cryptographic mechanism that proves who signed a document or piece of software and guarantees it has not been altered since.

The EU regulation, applicable since 17 January 2025, that requires the financial sector (banks, insurers, asset managers, payment institutions and others) to control its ICT risks and those of its providers.

The person who makes sure an organisation complies with the GDPR, advises it and acts as the point of contact for the data protection authority and the people whose data is processed.

The French digital risk analysis method published by ANSSI, which starts from an organisation’s essential missions and plausible attackers to build risk scenarios and a treatment plan.

Software installed on computers and servers that watches their behaviour, detects malicious activity and lets defenders isolate or clean up a machine remotely.

A process that makes data unreadable to anyone who does not hold the right key, to protect its confidentiality while it is stored or transmitted.

Belinda

A score published by FIRST that estimates, between 0 and 1, the probability that a published vulnerability (CVE) will be exploited in the next 30 days.

A program or technique that takes advantage of a specific vulnerability to make a system do something it should not: run code, bypass authentication, read data.

A device or piece of software that filters communications between networks according to rules: anything not explicitly allowed is blocked.

A testing method that bombards software with unexpected, malformed or random data to trigger crashes that reveal security flaws.

The EU regulation, applicable since 25 May 2018, that governs the use of personal data and requires every organisation to protect it with security measures appropriate to the risk.

A calculation that turns any piece of data into a fixed-size fingerprint that cannot practically be reversed, and that changes completely if the data changes even slightly.

Belinda

A decoy (fake server, fake account, fake file) deliberately planted to attract attackers: since no legitimate user should ever touch it, any interaction is a reliable alert.

A security header through which a website tells the browser to connect to it over HTTPS only, which stops an attacker from downgrading the connection to unencrypted HTTP.

The processes and tools that ensure every person or machine has the right access, to the right resources, at the right time, and loses it as soon as it is no longer justified.

Systems that analyse network traffic or a machine’s activity to spot attacks: an IDS raises alerts, an IPS also blocks.

The organised set of actions taken to detect an attack, limit the damage, drive the attacker out, restore operations and learn the lessons.

Belinda

A technical trace suggesting that a system has probably been compromised: a malicious IP address or domain, a file hash, a process name, a registry key.

The reference document, approved by senior management, that sets out an organisation’s security objectives, rules and responsibilities (known in France as the PSSI).

Malware built to quickly steal saved passwords, session cookies, cryptocurrency wallets and browser data, which are then sold on criminal marketplaces.

An access control flaw in which an application serves a resource (an invoice, a file, an account) based on its identifier alone, without checking that the user is entitled to see it.

The international standard that sets out the requirements for an information security management system (ISMS) and allows an organisation to have its approach certified by an independent body.

A public catalogue run by CISA, the US cybersecurity agency, listing the vulnerabilities that attackers are confirmed to have exploited.

The techniques an attacker uses to move from a first compromised machine to others on the network, until reaching the real targets.

The principle that every user, application or service receives only the rights strictly needed for its job, and only for as long as it needs them.

Any program designed to cause harm: stealing data, spying, encrypting or destroying files, or taking control of a device without its user knowing.

An attack in which someone secretly places themselves between two communicating parties to read, steal or alter what they exchange without either side noticing.

A free knowledge base, maintained by the US not-for-profit organisation MITRE, that describes the tactics and techniques attackers actually use, based on public observations.

A login that requires at least two proofs of identity of different kinds (something you know, something you have, something you are), so that a stolen password is no longer enough.

Nestor

A 2022 EU directive that requires thousands of organisations in 18 sectors to take cybersecurity measures, report significant incidents and hold their management directly accountable.

Belinda

Collecting and analysing publicly available information (websites, social media, public registers, published leaks) to understand a target.

Nestor

The reference ranking of the ten most critical categories of web application security risk, published by the OWASP Foundation and used worldwide to raise awareness and set requirements.

A password-free sign-in credential based on a pair of cryptographic keys: the private key stays on your device and is unlocked with your fingerprint, face or PIN.

The process of inventorying software, tracking published security patches and deploying them within timeframes that match the risk, without breaking production.

Belinda

A flaw that lets an attacker break out of the folder an application intended by manipulating a file name, in order to read or write sensitive files elsewhere on the server.

A simulated attack, carried out by authorised specialists, to find the weaknesses in a system before a real attacker exploits them.

Nestor

A scam that impersonates a trusted sender (a bank, a supplier, a colleague) by email, text message, phone call or QR code to trick the victim into clicking, handing over credentials or paying.

Nestor

A technique that probes a machine’s network “doors” to find out which ones are open and which services answer behind them.

New encryption and signature algorithms designed to withstand a future quantum computer capable of breaking RSA and the elliptic curves that protect the internet today.

Belinda

The stage of an attack where an intruder who got in with limited rights obtains higher ones, up to administrator level.

A set of controls that restricts, records and limits the use of the most powerful accounts (administrators, service accounts, emergency access), which are attackers’ favourite targets.

An attack that hides instructions in the text a generative AI processes (a message, web page, document or email) to make it ignore its own rules and act in the attacker’s interest.

Malware that encrypts an organisation’s data and demands a ransom to restore it, often also threatening to publish the stolen data.

Belinda

An exercise in which a team of authorised attackers imitates a realistic adversary over several weeks to test the organisation’s ability to detect and respond to an attack.

A vulnerability that lets an attacker run their own commands on a remote machine, usually over the network, which often amounts to taking control of it.

Remote access in which the compromised machine calls the attacker itself, which lets it slip past firewalls that block incoming connections.

The possibility that a threat exploits a vulnerability and causes harm, estimated by combining the likelihood of the event with the severity of its impact.

The RTO is the maximum acceptable downtime for a service; the RPO is the maximum amount of data, expressed as time, that you are prepared to lose when restoring.

A signed document setting out what a tester is allowed to do: target systems, dates, permitted and forbidden techniques, emergency contacts and what to do if something unexpected happens.

Nestor

Automated analysis of an application’s source code, without running it, to find security flaws before the code reaches production.

A detailed, machine-readable list of every component in a piece of software (libraries, versions, suppliers, licences), much like the ingredients list on a food product.

Analysis that lists the open source and third-party libraries an application uses, to flag those with known vulnerabilities or licence issues.

The way technical passwords, API keys, tokens and certificates used by applications are stored, distributed and renewed, without ever writing them in plain text in the code.

Nestor

A flaw that lets an attacker make the server itself send requests to addresses of the attacker’s choosing, including internal systems that are normally unreachable from the internet.

A tool that centralises logs from across the information system, correlates them and raises an alert when a combination of events gives an attack away.

A mechanism that lets you sign in once with an identity provider and then use several applications without typing a password again.

The team and tools that monitor the information system around the clock to detect security incidents, assess them and trigger the response.

Manipulation techniques that get a person to bypass security themselves: revealing a password, approving a payment, opening a door or installing software.

Nestor

An attack that slips database commands into an input field or URL in order to read, change or delete data the attacker should never be able to touch.

Nestor

An attack that compromises a trusted supplier, service provider or software component in order to reach all of its customers in turn.

A physical intrusion in which someone gets through an access-controlled door by closely following an authorised person, without badging in themselves.

Nestor

Any potential cause of an incident, whether an attacker, a piece of malware, a human error or a natural disaster, that could harm your systems or your data.

Information gathered and analysed about attackers (who they are, what they target, how they operate) to guide defence decisions.

A protocol that encrypts and authenticates exchanges between two machines, such as your browser and an HTTPS website, so that data cannot be read or altered in transit.

Malware disguised as a legitimate program or document that secretly opens a way in for the attacker once the victim installs it themselves.

A weakness in software, hardware, a configuration or a procedure that an attacker can exploit to gain unauthorised access or cause an unauthorised effect.

A filter placed in front of a website or API that inspects each web request and blocks those that look like attacks (SQL injection, XSS, abusive bots).

A security model that grants no default trust to any user or device, even inside the network, and checks every access request against identity, device health and context.

Belinda

A vulnerability exploited by attackers before the vendor knows about it or has released a patch, leaving defenders with “zero days” to prepare.