Cybersecurity Glossary from A to Z — Cybersecurity

Cybersecurity Glossary — 128 definitions

All the terms defined in the 28 sections of the guide, listed in alphabetical order.
Tip: press Ctrl + F to search for a term on the page.

2FA / MFA: Second proof of identity after the password: code, app, physical key — the factor that saves you when the password leaks.
33700 / signal-spam: The reporting platforms: fraudulent SMS to 33700, phishing e-mails to Signal Spam / Phishing Initiative.
IT administration: The charter reminds you what IT can see (logs, filtering) and within what framework: transparency on both sides.
Spoofed sender address: The displayed name is free: “Your Bank” can hide pirate@lookout-domain.ru — only the full domain is trustworthy.
Security ambassador: The volunteer relay in the team: first point of contact for doubts, link with IT — often the role waiting for you when you finish this guide.
ANSSI: The French National Agency for the Security of Information Systems: France’s cyberdefense authority (cyber.gouv.fr), reference guides and alerts.
Antivirus / EDR: The tool that detects and blocks known malware and suspicious behavior (Microsoft Defender built into Windows is enough for most uses).
Authentication app: Generates temporary codes offline (Microsoft/Google Authenticator, 2FAS…): safer than SMS.
CEO fraud (FOVI): Fake Transfer Order: a fraudster impersonates an executive and demands an urgent, confidential transfer.
Dropped key attack: Leaving infected USB keys in a parking lot: a surprising proportion end up plugged in out of curiosity — tested and documented.
ANSSI certificate: The official recognition awarded on passing the MOOC: a real plus on a CV and a strong signal internally.
Legal bases: Consent is only one of six bases: contract, legal obligation, legitimate interest… — every processing must rely on one of them.
Zero-blame (on reporting): Punishing whoever reports their mistake kills detection: a healthy culture separates the error (human) from concealment (culpable).
BYOD: “Bring Your Own Device”: using personal devices for work, governed (or forbidden) by company rules.
Bcc (blind copy): Mass sending to external recipients is done in Bcc: putting the address list in clear view is a common breach.
IT charter: The document that sets the rules for using the company’s IT systems: tools, passwords, e-mail, Internet, remote work, sanctions.
Encryption: Making data unreadable without the key: the protection that survives the theft of the device or the file.
Encrypting a file/archive: Protecting a document or a zip with a strong password (office tools and 7-Zip/AES do it) for a one-off send or storage.
End-to-end encryption: Only the sender and the recipient can read (secure messaging): even the service operator sees nothing.
Full-disk encryption: BitLocker (Windows) / FileVault (Mac): the whole disk protected — the stolen laptop no longer gives anything away.
Encrypted key: Key protected by password/encryption (BitLocker To Go…): losing it does not become a data leak.
Security key (FIDO2/passkey): Physical USB/NFC key or passkey: the strongest level, immune to phishing — the future of authentication.
Tampered USB key: A key containing auto-run malware or tampered files: the “found” key is a classic attack vector.
CNIL: The French Data Protection Authority: the authority for personal data and GDPR (cnil.fr).
SMS code: Better than nothing, but vulnerable (SIM swapping, interception): reserve it for when there is no alternative.
Recovery codes: The backup codes provided at activation: print and store them safely — your way out if you lose the phone.
Forced secrecy: “Don’t tell anyone about this”: the absolute alarm signal — isolating the victim is the condition of the fraud.
Consent: One of the legal bases: free, specific, informed, unambiguous — and retractable as easily as it was given.
Security culture: When the right reflexes become team habits: report without shame, verify without embarrassment, lock without thinking.
Healthy doubt culture: Doubting is neither paranoia nor distrust: it is a professional standard, like double-checking a calculation.
Cybermalveillance.gouv.fr: The national platform assisting victims: online diagnosis, referral to service providers, reflex fact sheets.
Cybersecurity: All the practices that protect systems, data and people against computer attacks — at the office and while teleworking.
Typosquatting / lookalike domain: micros0ft.com, impots-gouv.net: almost-right addresses — a single-character mistake that traps the rushed eye.
Personal data: Any information relating to an identifiable person: name, e-mail, phone, IP address, photo, license plate, voice…
Sensitive data: Strengthened categories: health, opinions, religion, union membership, orientation, biometrics — processing is prohibited in principle except strict exceptions.
Double extension: “invoice.pdf.exe”: Windows sometimes hides the second one — always display file extensions.
Dual validation: The organizational countermeasure: any unusual transfer or change of IBAN requires a second validation through a different channel.
Right of access: “What data do you hold about me?”: the organization must answer, generally within one month.
Data subject rights: Access, rectification, erasure, objection, portability, restriction: any person can exercise them on DATA about them.
Retention period: Every data has an expiry date (applications: 2 years max unless agreed, prospects: 3 years after contact…): purging is part of the job.
Privacy screen: Physical filter or vigilance in open space/train: prying eyes are a discreet but real data leak.
Sending the password separately: The rule of encrypted exchanges: the file through one channel, the password through ANOTHER (never in the same e-mail).
Company-provided equipment: The professional workstation for work, nothing else: the family does not play on the company computer.
Mis-send: Sending a personal data file to the wrong recipient = a breach to handle (see 4.4), not a simple slip.
Dedicated workspace: Screen not visible to visitors, documents put away, locked session: office rules apply to the living room.
Leading by example: Security spreads by example: the manager who locks their session and verifies requests legitimizes everyone doing the same.
At-risk extensions: .exe, .scr, .js, .vbs, .bat: pure executables — but also .zip (which hides them) and macro-enabled Office documents (.docm, .xlsm).
Fake bank advisor: The typical scenario: “fraudulent transactions are in progress, confirm the cancellation” — in reality, you confirm THE fraudster’s transfers.
Fake access point (evil twin): A rogue hotspot named “Free_WiFi_Gare”: all your traffic goes through the attacker.
End of support: A system that no longer receives patches (old Windows, abandoned apps) becomes undefendable: replace it.
Continuous training: The threat evolves every six months: security is a subscription, not a diploma.
Vendor impersonation fraud: The “supplier” announces an IBAN change: the next payments go to the fraudster — the most common variant.
Data leak: Disclosure of internal or personal data — through an attack, a mis-send or bad sharing.
Password manager: Encrypted vault (KeePass — ANSSI-certified, Bitwarden, 1Password…): one master password, all the others unique and generated.
Access right / authorization: Each person only accesses the data they need: sharing an HR file “to the whole organization” is a breach in the making.
HTTPS: The encryption between your browser and the site (padlock): it protects the content even on a dubious network — check it is present.
Security incident: Hacked account, computer behaving abnormally, ransomware, fraud: any event that compromises (or seems to compromise) security.
Information (transparency): People must know who collects what, why, and for how long: information notices, privacy policies.
Informing the data subjects: If the risk is high (sensitive data, credentials…), the people concerned must also be notified.
Social engineering: Psychological manipulation (urgency, authority, trust) to obtain an action or information.
Isolate: Cut the network of the affected machine (Wi-Fi off, cable unplugged) WITHOUT turning it off: stop the spread while preserving evidence.
Ordinary whistleblowing: Reporting what you see (suspicious e-mail, abnormal IT behavior) is a team act: incidents detected early cost ten times less.
Authority lever: Impersonating an executive, the bank, an official service: people obey before they verify.
Urgency lever: “It’s urgent, do it now”: short-circuiting reflection — the #1 mechanism of frauds.
Malicious macro: The “Enable Content” of a received Office document: the click that launches the malware — Office blocks it by default, do not unblock it.
Human link: More than 80% of incidents involve a human action (click, weak password, manipulation): technology alone is never enough.
Malware: Generic term for malicious software: viruses, Trojans, spyware, ransomware.
Personal e-mail at work: Forwarding work files to your Gmail: a data leak in the literal sense — often forbidden by the charter.
Minimization: Only collecting and keeping what is necessary: the “just in case” file is the anti-model.
Automatic updates: The setting that applies patches without you: recommended everywhere (system, browser, applications).
Updating the charter: Charters evolve (telework, generative AI…): the version in force is the one to know.
Security update: The patch that closes a known vulnerability: every delay leaves the door open to… publicly documented attacks.
Strong password: Length first: CNIL recommends a passphrase of at least 12–14 characters — length beats complexity.
Never pay: The ransom guarantees nothing, funds crime and marks you as a good payer: the constant position of ANSSI and the authorities.
Do not turn off: Shutting down destroys useful evidence in volatile memory: isolate, do not power off — unless IT instructs otherwise.
CNIL 72-hour notification: The organization must notify the CNIL within 72 hours if the breach presents a risk to people: every hour of internal silence counts.
OSINT: The public information (social networks, website, directories) the attacker collects to tailor the attack.
Capture page: The fake login page (perfect copy of the real one) where you “give” your password to the attacker.
Mobile hotspot (4G/5G): Your phone as a modem: often safer than public Wi-Fi — the right reflex while traveling.
Passphrase: A sequence of words easy to remember, hard to guess: “Cheval!Tulipe7Nuage-Bleu” beats “P@ssw0rd”.
Extended security perimeter: When teleworking, your home becomes an extension of the office: box, Wi-Fi, physical desk all enter the perimeter.
Phishing: Fraudulent message (e-mail, SMS…) imitating a trusted third party to steal credentials or data — the #1 vector.
Tampered attachment: A file that runs malicious code when opened: ransomware enters massively this way.
Legal complaint: Fraud, hacking, extortion: filing a complaint (police station or THESEE online filing for certain e-scams) triggers the investigation and supports insurance.
Clean desk policy: No sensitive documents or password sticky notes in view: tidiness is a security measure.
Preserving evidence: Screenshots, original e-mails, timestamps: the file that will support the analysis, the complaint and the insurance claim.
Pretexting: A credible scenario built with real information (website, LinkedIn, out-of-office) to lull suspicion.
Tampered QR code (quishing): A QR code is a link you cannot hover over: same rules of suspicion, especially when stuck up in public spaces.
Ransomware: Encrypts your files and demands a ransom. Modern variant: double extortion (threat of publishing the stolen data).
Ransomware: Software that encrypts the company’s data and demands a ransom: the #1 threat to French organizations.
Call back on a known number: Verify with the requester via an ALREADY-KNOWN number (internal directory) — never the one given in the request.
Controlled callback: THE universal countermeasure: hang up and call back yourself on the official number (back of the bank card, official website).
Breach register: Every breach, even minor, is documented internally: it is an obligation and a useful memory.
3-2-1 rule: 3 copies of your data, on 2 different media, including 1 off-site (or offline): the standard recommended by ANSSI.
Controller / DPO: The organization decides (controller); the Data Protection Officer (DPO) advises and monitors — your GDPR contact.
Reuse: The capital sin: one hacked site = all your accounts using the same password are compromised (credential stuffing attack).
GDPR: The European regulation (2018) governing all personal data processing — with fines of up to 4% of worldwide turnover.
Security ritual: The regular 5 minutes (team meeting, posting, quiz) that keep vigilance up: security is maintained like a muscle.
RPO (acceptable loss): How many hours/days of work are you willing to lose? The answer dictates the backup frequency.
Offline backup: A disconnected copy (unplugged drive): the only one ransomware cannot encrypt.
SecNumacadémie: ANSSI’s free MOOC: the reference cybersecurity training, with a certificate (detailed in 5.5).
Work/personal separation: One universe per area at home: separate accounts, e-mails, devices and passwords — a compromise does not contaminate the other.
Individual session: One account per person, never a shared session: traceability and accountability depend on it.
Shadow IT: Using non-validated tools for work (personal WeTransfer, personal Gmail, home USB key): convenient… and outside any security control.
Reporting: Doubts are shared: a reported suspicious e-mail protects the whole organization (report button or forward to IT).
Internal reporting: Your organization’s channel (button, address, referent): ALWAYS the first reflex for anything work-related.
Immediate internal reporting: YOUR role: alert the DPO/IT as soon as you spot it — analysis and notification are their job, speed is yours.
Warning signs: Urgency, confidentiality, unusual request, too-good-to-be-true gain, threat: each one alone justifies the verification pause.
Smishing: SMS phishing: fake parcels, fake Crit'Air sticker, fake CPF account, fake bank alert — with a tampered link.
Spear phishing: Targeted, personalized phishing (your name, your projects, your habits): much harder to spot than mass spam.
Removable media: Keys, external drives, SD cards: same rules — known provenance, antivirus scan, encryption for sensitive data.
Attack surface: Everything an attacker can enter through: accounts, e-mails, devices, applications… Every employee is part of it.
Internal phishing test: Fake phishing campaigns run by companies: training, not a trap — the click rate drops with practice.
Restore test: A backup is only worth what it restores: periodic testing is half the discipline.
Processing: Any operation on data: collect, store, consult, transmit, delete — your customer Excel file IS processing.
Residual personal use: Most charters tolerate a “reasonable” personal use of the tools — while precisely delimiting it.
Caller ID spoofing: The caller displays your bank’s REAL number: the displayed number no longer proves anything.
Legal value: Annexed to the internal rules, the charter is enforceable: failure to comply can ground a disciplinary sanction.
Security watch: Staying up to date: CERT-FR alerts (threat news), Cybermalveillance newsletters, the cyber section of your sector.
Verification through a separate channel: Confirming a request through ANOTHER means than the one it came from: suspicious e-mail → call; suspicious call → official e-mail.
Session lock: Windows + L when leaving your desk: the one-second gesture that blocks physical access to your data and e-mail.
Versioning: The version history (OneDrive/SharePoint do it natively): going back to the file before the incident or the mistake.
Data breach: Any incident affecting personal data: leak, unauthorized access, loss, destruction — including the e-mail to the wrong recipient.
Vishing: Phishing by phone: a very professional “bank advisor” or “technician” guides you… towards the fraud.
VPN: The encrypted tunnel that protects ALL your traffic: mandatory on an untrusted network — use the company one.
Company VPN: The systematic tunnel to the company network from home: the rule, not an option.
Hardened home Wi-Fi: Strong Wi-Fi password, WPA2/WPA3 encryption, changed box admin password: the three settings that matter.
Public Wi-Fi: Station, hotel, café: a network you share with strangers — including possible equipped snoopers.