Cyber Security: Basic security terminologies
1. Definition
Cyber security is the practice of protecting computers, networks, programs and data from attack, damage, theft or unauthorised access. Its purpose is to keep systems trustworthy: data stays private, stays correct, and stays available when needed. Because every connected device is a potential entry point, security is a continuous process — not a product you install once.
2. Core Terminologies (the vocabulary of every exam question)
| Term | Meaning |
|---|---|
| Asset | Anything worth protecting — data, hardware, software, reputation, people |
| Vulnerability | A weakness that can be exploited (unpatched software, weak password, misconfiguration) |
| Threat | A potential cause of harm (a hacker, malware, a natural disaster) |
| Threat actor | The entity behind the threat (script kiddie, cybercriminal, insider, hacktivist, state-sponsored APT) |
| Exploit | A technique or code that takes advantage of a vulnerability |
| Attack surface | The total set of ways an attacker can try to enter a system (ports, apps, users, suppliers) |
| Risk | The likelihood × impact of a threat exploiting a vulnerability |
| Control / countermeasure | A safeguard that reduces risk (firewall, MFA, backup, training) |
| Breach | A confirmed incident where security was violated and data/systems were accessed |
| Malware | Malicious software: virus (needs a host and user action), worm (self-spreading), trojan (disguised as useful), ransomware (encrypts data for ransom), spyware (steals information), adware, rootkit (hides itself at a deep level), keylogger |
| Phishing | Fraudulent messages that trick users into revealing credentials or clicking malicious links; variants: spear phishing (targeted), vishing (voice), smishing (SMS), pharming (DNS redirection) |
| Social engineering | Manipulating people rather than machines (pretexting, baiting, impersonation) |
| DoS / DDoS | Denial of Service / Distributed DoS — flooding a service so genuine users cannot use it, often from a botnet (army of infected devices) |
| Man-in-the-Middle (MITM) | Intercepting and possibly altering communication between two parties |
| SQL injection / XSS / CSRF | Injecting SQL through input fields / injecting scripts into web pages / forcing a logged-in user's browser to perform an unwanted action |
| Zero-day | A vulnerability with no patch available yet — unknown to the vendor |
| Backdoor / RAT | A hidden way into a system / remote-access trojan for control |
| Firewall | Filters network traffic by rules between zones |
| IDS / IPS | Intrusion Detection / Prevention System — detects (and blocks) suspicious traffic |
| Antivirus / EDR | Signature- and behaviour-based malware detection on endpoints |
| VPN | Encrypted tunnel over an untrusted network |
| Encryption / Hashing / Digital signature | Confidentiality / integrity fingerprint (one-way) / authenticity and non-repudiation |
| Certificate and PKI | A trusted third party (CA) vouches for a public key |
| Authentication vs Authorization | Proving who you are vs what you are allowed to do |
| MFA / 2FA | Two or more independent factors (password + OTP/authenticator/biometric) |
| Least privilege | Give each user/process only the permissions it actually needs |
| Patching / hardening | Applying fixes / reducing the attack surface by disabling unnecessary services |
| Penetration testing / ethical hacking | Authorised simulated attacks to find weaknesses first |
| Honeypot | A decoy system designed to attract and study attackers |
| DLP | Data Loss Prevention — detects and blocks sensitive data leaving the organisation |
| SIEM / SOC | Central log correlation and alerting / the team and facility that monitors security 24×7 |
| Incident response | Prepare, detect, contain, eradicate, recover, and learn from an incident |
| Non-repudiation | The sender cannot later deny having sent the message (digital signature) |
| GDPR / DPDP Act 2023 | Data-protection regulations governing personal data and breach reporting |
3. Risk and the Security Equation
- If there is no threat, risk is zero (an isolated machine with no attacker).
- If there is no vulnerability, risk is zero (a perfectly patched, configured system).
- If the impact is negligible, the risk is low (a public marketing brochure leaked vs patient records).
Risk is managed by reducing any of the three factors — patching (vulnerability), monitoring/controls (threat), backups and segmentation (impact) — and by transferring it (insurance) or accepting it consciously.
4. Types of Threat Actors and Attack Vectors
Actors: script kiddies (curious, using ready-made tools), hacktivists (ideological), cybercriminals (money — ransomware, fraud, data sale), insiders (employees/contractors, often the hardest to detect), state-sponsored APTs (espionage, sabotage), competitors, and automated bots.
Vectors: phishing e-mail and messaging, malicious websites and drive-by downloads, unpatched software and operating systems, weak or reused passwords, misconfigured cloud storage and services, exposed remote-desktop/SSH, USB drives, supply-chain compromise, third-party vendors, insider abuse, physical access.
5. Defence in Depth (layered security)
- Perimeter — firewalls, IDS/IPS, secure VPN, network segmentation, zero-trust access.
- Endpoint — antivirus/EDR, patch management, disk encryption, device control.
- Identity — MFA, strong unique passwords/password manager, least privilege, privileged-access management, timely removal of ex-employees' accounts.
- Data — encryption at rest and in transit, classification, DLP, tested offline backups (the single best defence against ransomware).
- Application — secure coding, input validation, code review, dependency scanning, WAF.
- People and process — regular awareness training and phishing simulations; incident-response plan; logging and monitoring (SIEM/SOC); audits and compliance (ISO 27001, NIST CSF, PCI-DSS, IT Act 2000, DPDP Act 2023).
6. Exam Points
- Define cyber security and explain its goals — 5 marks, almost certain.
- Define vulnerability, threat, exploit, risk and countermeasure; state the risk formula with an example — 5 marks, very frequent.
- Differentiate virus, worm, trojan and ransomware — 5 marks, frequent.
- Define phishing, DDoS, MITM, SQL injection and zero-day — 5 marks.
- Differentiate authentication and authorization; what is MFA? — 3-5 marks.
- Explain defence in depth with its layers — 5-7 marks.
- What is non-repudiation and how is it achieved? — 3 marks.