About these definitions
Security conversations tend to fill up with abbreviations, which can leave non-specialists nodding along without being sure what was said. The entries below explain common terms in general language. They are educational definitions only: they are not security, legal or compliance advice, and they do not describe how to protect any specific organization. Decisions about real controls belong with qualified security and compliance professionals.
Identity and access
Identity. The digital representation of a person, device or application in a system, such as a user account.
Account. The record that lets an identity sign in and be given permissions. Accounts may belong to people, or to systems that talk to other systems, which are often called service accounts.
Authentication. Checking that someone or something is who it claims to be, typically with a password or other proof. It is distinct from authorization, and authentication and authorization are often confused despite answering different questions.
Authorization. Deciding what an authenticated identity is allowed to do, such as view a file, edit a record or approve a payment.
Access control. The collection of rules and mechanisms that apply authorization to systems and data.
Permission. A specific right to do something, for example to read or change one folder.
Role. A named set of permissions matched to a job function. Role-based access control assigns people to roles instead of giving rights one at a time, which can make permissions easier to manage and review.
Least privilege. The idea that identities should hold only the access needed for their work. The least privilege principle limits the damage possible if an account is misused or compromised, whether by mistake or on purpose.
Privileged account. An account with broad powers, such as an administrator account. Because the impact of misuse is larger, privileged accounts normally receive tighter controls and closer monitoring.
Identity and access management (IAM). The overall discipline and tooling for creating identities, giving them access, and removing it. A broad introduction appears in identity and access management material.
Provisioning and deprovisioning. Creating accounts and access when someone starts or moves, and removing them when they leave or no longer need them. The joiner mover leaver cycle describes these events across a working life.
Access review. A periodic check that people still need the access they hold, sometimes called recertification. Access reviews help catch rights that built up over time.
Segregation of duties. Splitting critical tasks between people so that no one person can complete a sensitive process alone, for example requesting and approving the same payment.
Proving who you are
Password. A secret string used to authenticate. Passwords on their own are widely regarded as a weak safeguard, which is one reason additional checks exist.
Multi-factor authentication (MFA). Requiring two or more different kinds of evidence, such as something known, something held and something that is part of the person. Multi-factor authentication is generally seen as a meaningful improvement over passwords alone, though it does not remove every risk.
Single sign-on (SSO). Signing in once to reach several systems. Single sign-on can make life easier for users and central management, and it also means the one sign-in deserves strong protection.
Biometrics. Authentication using physical traits, such as a fingerprint or face.
Session. The period during which a user stays signed in after authenticating.
Threats and weaknesses
Threat. Something that could cause harm, whether a person, an event or a piece of malicious software.
Vulnerability. A weakness that a threat could exploit, such as software with a known flaw that has not been updated.
Risk. The combination of how likely harm is and how serious it would be. Risk is about uncertainty and cannot be reduced to zero.
Malware. Software designed to cause harm, such as by stealing data or disrupting systems.
Ransomware. A type of malware that locks or encrypts data and demands payment to restore access.
Phishing. Messages that try to trick people into giving up information or taking an unsafe action, usually by pretending to be a trusted sender.
Social engineering. Manipulating people, instead of systems, to get access or information. Phishing is one form.
Insider risk. Harm that comes from people with legitimate access, whether through error or intent.
Breach or incident. An event in which data or systems are accessed or affected in an unauthorized way. Organizations typically have plans for how to respond, and some jurisdictions have notification duties that a legal adviser can explain.
Protecting data and systems
Encryption. Scrambling data so that only someone with the right key can read it. It may be applied to stored data, to data in transit, or both.
Patch. A software update that fixes a flaw. Patching is the routine of applying them.
Firewall. A control that filters network traffic according to rules.
Backup. A separate copy of data kept so it can be restored after loss or damage. A backup is only useful if restoring from it has been tried.
Defense in depth. Using several layers of safeguards so that no single failure leads to a complete breach.
Zero trust. An approach that avoids assuming that anything inside a network is trustworthy, and instead checks each access request. It is a design philosophy rather than a single product.
Oversight
Audit log. A record of events in a system, such as sign-ins and changes, kept so they can be reviewed later.
Monitoring. Watching systems and logs for unusual or unauthorized activity.
Security policy. A written statement of rules and expectations for protecting information and systems.
Compliance. Meeting the requirements of laws, regulations, contracts or internal rules. Being compliant is not identical to being secure, and the reverse is also true.
Business continuity. Keeping essential activities going, or restoring them, after a disruption. Business continuity planning and security overlap because many disruptions come from security events.
Bringing controls together under one team is one approach, often discussed under centralized IT security, but it brings its own trade-offs, including concentrating risk in fewer places. Which approach fits depends on the organization and is best settled with professional advice.