Cybersecurity Glossary

Defenses & Controls

The 3-2-1 strategy (three total copies, two on different storage media, one offsite) ensures business continuity after ransomware, hardware failure, or disaster. Many practitioners now advocate a 3-2-1-1-0 extension: one immutable copy and zero recovery errors confirmed by regular testing.

See also: Ransomware, Immutable Backup, Disaster Recovery (DR)

Defenses & Controls

An AUP sets clear boundaries around permissible use of organisational devices, networks, and data, covering personal use, password requirements, software installation, remote working, and social media. It provides the legal and disciplinary framework for responding to insider incidents and demonstrates due diligence to auditors and insurers.

See also: Information Security Policy, Security Awareness Training

Threats & Attacks

Account takeover occurs when an attacker gains control of a legitimate user account using stolen passwords, credential stuffing, phishing, or SIM swapping. Once inside, they can steal data, make fraudulent purchases, pivot to other systems, or sell access to other criminals.

See also: Credential Stuffing, Phishing, SIM Swapping

Threats & Attacks

Ad fraud is any scheme that manufactures fake advertising activity for money: malware that loads invisible adverts on a victim's device, bots that click ads no human ever sees, or code that silently rewrites affiliate links so the criminal collects the commission on a real purchase. It costs advertisers billions a year and often rides alongside other malware, since a compromised browser or device can be put to work committing fraud while it also steals data. For a business, the warning signs are unexplained browser slowdowns, adverts appearing where they should not, and sales credited to partners you never signed up. Behaviour-based endpoint protection and removing unwanted browser extensions are the practical defences.

See also: Malicious Browser Extension, Adware, Botnet

Threats & Attacks

APT actors, often nation-state groups or sophisticated criminal organisations, gain a foothold in a network and remain undetected for months or years while they exfiltrate data or pre-position for future disruption. They use custom tools, zero-days, and careful tradecraft to evade detection.

See also: Lateral Movement, Command-and-Control (C2), Zero-Day Vulnerability

Threats & Attacks

Adware automatically delivers advertisements to a device, usually without meaningful consent. While often considered nuisanceware rather than serious malware, aggressive adware can track browsing behaviour, redirect search results, slow devices, and deliver more dangerous payloads.

See also: Malware, Spyware

Threats & Attacks

In an agentic AI attack, a large language model is given a goal and the tools to act on it, and it chains together reconnaissance, credential theft, lateral movement, and a final payload on its own rather than following a human's step-by-step commands. The first fully documented case ran an entire ransomware operation, from exploiting an exposed server to encrypting a database and writing the ransom note, without a person typing a single command. These attacks tend to reuse ordinary, already-known techniques rather than anything novel, but automation lets an operator with little technical skill launch a complete intrusion cheaply and at speed. The defences are the same fundamentals that stop human attackers: patch exposed software promptly, remove default credentials, and keep secrets out of any environment an internet-facing tool can reach.

See also: Living Off the Land (LotL), Default Credentials, Prompt Injection

Infrastructure & Networks

An AI agent is a software system that uses a large language model to plan and execute multi-step tasks without requiring a human to approve every action. Agents can browse websites, call APIs, run code, manage files, and interact with desktop software. As organisations deploy agents to handle routine work, they introduce a new attack surface: an attacker who can influence what the agent reads or encounters can redirect its actions, a threat known as prompt injection. The practical defence is to limit what actions an agent can take, apply least-privilege principles to the account it runs under, and log everything the agent does.

See also: Prompt Injection, Remote Code Execution (RCE), Principle of Least Privilege (PoLP)

Defenses & Controls

An air-gapped system has no wired or wireless network connections whatsoever. Used to protect the most sensitive systems (industrial control systems, classified networks, offline backup storage) it eliminates remote attack vectors. Attacks against air-gapped systems require physical access or exploiting acoustic, electromagnetic, or optical side-channels.

See also: Network Segmentation, Operational Technology (OT) Security

Threats & Attacks

ARP (Address Resolution Protocol) poisoning sends forged ARP replies to associate the attacker's MAC address with a legitimate IP on the local network. This lets them intercept, modify, or drop traffic between two hosts: a classic man-in-the-middle technique on local area networks.

See also: Man-in-the-Middle (MitM), Network Segmentation

Infrastructure & Networks

An asset inventory records every device, application, data store, and cloud service, along with ownership, classification, and known vulnerabilities. It is the foundation of patch management, risk assessment, and incident response. Tools like network scanners and configuration management databases (CMDBs) automate discovery.

See also: Patch Management, Risk Assessment, IoT Security

Identity & Access

ABAC evaluates policies that combine multiple attributes (the user's department, clearance level, device compliance state, time of day, and resource sensitivity) to make fine-grained access decisions. It is more flexible than RBAC for complex environments but requires more policy management overhead.

See also: Role-Based Access Control (RBAC), Conditional Access, Zero Trust

Compliance & Regulation

Audit trails (also called audit logs) capture who did what, when, and from where across systems, applications, and databases. They are essential for detecting insider threats, investigating breaches, demonstrating compliance, and supporting legal proceedings. Logs must be tamper-resistant, retained for defined periods, and protected from deletion.

See also: Log Management, SIEM, GDPR

Threats & Attacks

An authentication bypass occurs when a system can be tricked into treating an attacker as a logged-in user without supplying a correct password or token. The cause is usually a logic error, a mishandled session cookie, or an endpoint that forgets to check who is calling it. Because these flaws grant access directly, they are prized for breaking into VPNs, admin panels, and management interfaces exposed to the internet, and they are often exploited within hours of disclosure. Prompt patching, multi-factor authentication, and keeping such interfaces off the public internet are the main defences.

See also: Account Takeover (ATO), Privilege Escalation, Multi-Factor Authentication (MFA)

Threats & Attacks

Authentication laundering abuses a trusted third-party service, such as a scheduling tool or URL redirector, whose own domain carries valid SPF, DKIM, and DMARC records. By sending phishing content through that service's real notification system, an attacker's message inherits real authentication passes, so it looks legitimate to filters built to catch spoofed senders even though the content itself is malicious. The technique has turned up in campaigns abusing services like Calendly's email notifications and Google's URL redirects to make phishing emails look routine. Because the sending infrastructure is legitimate, defenders need to look past whether a message passed SPF, DKIM, and DMARC and inspect its content and destination.

See also: Phishing, DMARC, Spear Phishing

Threats & Attacks

A backdoor is any covert way back into a compromised system: a secret account, a planted plugin, modified code, or a hidden network listener. Attackers install one early so they keep access even after the original flaw is patched or a password is changed. Backdoors are built to stay out of normal admin screens, so finding them usually means inspecting the server or its files directly rather than trusting the dashboard. Removing a single backdoor is rarely enough, since attackers commonly plant several.

See also: Web Shell, Trojan Horse, Remote Access Trojan (RAT)

Threats & Attacks

A banking trojan is malware built to capture the credentials and one-time codes used for online banking and payments, then use them to move money. On Android it usually abuses the Accessibility permission and shows fake login screens, called overlays, on top of real banking apps to grab passwords and card details, while reading SMS messages to intercept the codes banks send to approve transactions. Some variants also rewrite the clipboard to redirect cryptocurrency payments to the attacker. Installing apps only from official stores, refusing unexpected Accessibility requests, and using app-based approval rather than SMS codes are the main defences.

See also: Malware, Infostealer, Keylogger

Identity & Access

Biometric authentication matches a live scan against an enrolled template stored securely on device or server. It is highly convenient and resistant to password theft but raises privacy concerns around storage of biometric templates and can be spoofed with photos or 3D prints. Best deployed as one factor in an MFA combination rather than the sole authenticator.

See also: Multi-Factor Authentication (MFA), Passkeys

Defenses & Controls

Blue teams monitor infrastructure, hunt threats, respond to incidents, and harden defences. In purple-team exercises they collaborate with red teams to translate offensive findings directly into defensive improvements. A typical SMB blue team consists of outsourced MDR service analysts supported by internal IT staff.

See also: Red Team, Purple Team, Incident Response (IR)

Threats & Attacks

A botnet ('robot network') is a collection of compromised devices (PCs, servers, IoT devices) running malicious code that allows a central operator (botmaster) to issue commands. Botnets are used to launch DDoS attacks, send spam, mine cryptocurrency, or distribute ransomware at scale.

See also: Malware, Distributed Denial of Service (DDoS), Command-and-Control (C2)

Threats & Attacks

In a bring your own vulnerable driver attack, the intruder supplies a real, vendor-signed device driver that contains a known flaw, loads it onto the target, and exploits that flaw to run code at the kernel level. Because the driver carries a valid signature, Windows trusts it, which lets the attacker disable antivirus and endpoint protection, hide their tools, or tamper with the operating system from below where most defences sit. Ransomware crews favour the technique to blind security software in the minutes before they encrypt. The defences are to block known-vulnerable drivers using Microsoft's vulnerable driver blocklist, and to run endpoint protection that watches driver loads and behaviour rather than trusting a signature.

See also: DLL Side-Loading, Living Off the Land (LotL), Endpoint Detection & Response (EDR)

Threats & Attacks

In a browser-in-the-middle attack the attacker runs a real browser on their own infrastructure that loads the legitimate target website. A JavaScript library such as rrweb streams the live DOM to the victim's browser, so the victim sees and interacts with the real login page. Keystrokes and MFA codes relay back to the attacker's browser, where authentication completes. The resulting session token stays in the attacker's browser, not the victim's. Because MFA is completed on the attacker's side, standard time-based codes and push approvals are bypassed entirely. Unlike man-in-the-browser attacks, no malware on the victim's device is required; a phishing link is enough. Phishing-resistant methods such as passkeys and FIDO2 hardware keys are the most reliable defence, as they bind authentication to the legitimate origin.

See also: Man-in-the-Browser (MitB), Man-in-the-Middle (MitM), Phishing-as-a-Service (PhaaS), Multi-Factor Authentication (MFA)

Threats & Attacks

Brute force attacks automate the trial of millions of password combinations. Simple brute force tries every combination; dictionary attacks try common words; hybrid attacks combine dictionary words with numbers and symbols. Account lockout policies, MFA, and strong passwords are the primary defences.

See also: Password Spraying, Credential Stuffing, Multi-Factor Authentication (MFA)

Threats & Attacks

A buffer overflow occurs when a program writes past the end of a fixed-size block of memory, spilling data into adjacent memory it was never meant to touch. An attacker who controls what gets written can corrupt nearby data, change how the program runs, or in the worst case execute their own code. These bugs are a long-standing cause of critical vulnerabilities, and they often score above 9 on the CVSS scale when they can be triggered over a network without a login. They are frequently the end result of an integer overflow that miscalculates a buffer size. Because the flaw lives in how code handles memory rather than in any input you can filter, applying the vendor patch is the dependable fix.

See also: Integer Overflow, Out-of-Bounds Write, Remote Code Execution (RCE)

Defenses & Controls

Bug bounty programmes invite independent security researchers to test systems within defined scope rules and reward valid, undisclosed vulnerability reports with cash, credits, or recognition. They complement internal security testing by harnessing a global pool of researchers. Platforms such as HackerOne and Bugcrowd help manage the process.

See also: Responsible Disclosure, Penetration Testing

Defenses & Controls

A BCP identifies critical business processes, the resources required to sustain them, and step-by-step procedures for maintaining or rapidly restoring operations during a cyber incident, power outage, or natural disaster. It is broader than a disaster recovery plan, which focuses specifically on IT systems.

See also: Disaster Recovery (DR), Tabletop Exercise, Incident Response (IR)

Threats & Attacks

BEC attacks involve compromising or spoofing a business email account (typically a CEO, CFO, or trusted vendor) to trick employees into transferring funds or sensitive data. BEC is one of the costliest cyber threats to SMBs, often bypassing technical controls through social engineering alone.

See also: Phishing, Spear Phishing, Social Engineering

Defenses & Controls

Canary tokens are decoy files, credentials, URLs, or database records that have no legitimate use: if accessed, they fire an immediate alert. A Word document with an embedded web beacon, a fake admin credential in a config file, or a honeypot DNS record can all be canaries that detect breaches the moment an attacker starts exploring.

See also: Honeypot, Deception Technology, Incident Response (IR)

Compliance & Regulation

The California Consumer Privacy Act (CCPA), expanded by the CPRA, grants California residents the right to know what personal data is collected, request deletion, opt out of sale, and not be discriminated against for exercising these rights. It applies to for-profit businesses meeting certain size or data-processing thresholds, regardless of where they are based.

See also: GDPR, Data Retention Policy, Right to Erasure

Infrastructure & Networks

CAs issue X.509 digital certificates that bind a public key to an identity (a domain name, organisation, or person). When a browser connects to a website over HTTPS, it verifies the site's certificate was signed by a trusted CA. Certificate pinning, Certificate Transparency (CT) logs, and monitoring for rogue certificates add further assurance.

See also: Public Key Infrastructure (PKI), TLS (Transport Layer Security)

Defenses & Controls

The Known Exploited Vulnerabilities catalog, maintained by the US Cybersecurity and Infrastructure Security Agency, lists flaws that have been confirmed as actively exploited by real attackers rather than only theoretically dangerous. US federal civilian agencies are required by Binding Operational Directive 22-01 to remediate KEV-listed vulnerabilities within defined deadlines. Security teams outside government use the KEV catalog as a reliable, evidence-based signal for which vulnerabilities should jump the patching queue, since a KEV listing confirms exploitation is already happening.

See also: Patch Management, Vulnerability Scanning, NIST Cybersecurity Framework (CSF)

Threats & Attacks

ClickFix is an attack technique that gets the victim to run the attacker's code themselves. A web page, fake error, or bogus 'prove you are human' check tells the user to copy a line of text and paste it into the Windows Run box, PowerShell, or a terminal, where it downloads and runs malware. Because the victim performs the action, ClickFix sidesteps many security tools and needs no software vulnerability. It has become one of the most common ways to deliver loaders, information stealers, and ransomware. The defence is a simple rule for staff: never paste a command you did not write because a website told you to.

See also: Social Engineering, Phishing, Infostealer

Infrastructure & Networks

A CASB provides visibility and control over cloud application usage, approved and shadow IT. It can enforce data security policies, detect anomalous behaviour, block uploads of sensitive files to unsanctioned apps, and apply encryption or access controls to cloud-stored data. CASBs are a standard component of a SASE architecture.

See also: SASE (Secure Access Service Edge), Data Loss Prevention (DLP), Shadow IT

Infrastructure & Networks

Cloud security encompasses identity and access management, network security, data encryption, configuration hardening, logging, and compliance for IaaS, PaaS, and SaaS deployments. Common failures include publicly exposed storage buckets, overly permissive IAM policies, and insufficient logging. Cloud Security Posture Management (CSPM) tools scan for these misconfigurations.

See also: Shared Responsibility Model, Cloud Access Security Broker (CASB), Principle of Least Privilege (PoLP)

Defenses & Controls

Code signing uses a publisher's private key to create a cryptographic signature for software binaries and scripts. Operating systems and security tools verify the signature before execution. An unsigned or invalidly-signed binary raises an alert, making it harder for attackers to substitute trojanised versions of legitimate tools.

See also: Public Key Infrastructure (PKI), Supply Chain Attack

Threats & Attacks

Command injection occurs when an application passes unsanitised user input to an OS shell. The attacker inserts shell metacharacters (semicolons, pipes, or backticks) to append their own commands, which then run with the privileges of the web server or application process. OS command injection flaws routinely earn CVSS scores above 9.0 because they allow direct code execution, and they are often exploitable without authentication when the vulnerable function is exposed to the network. Input sanitisation, parameterised shell calls, and least-privilege process accounts are the primary mitigations.

See also: Remote Code Execution (RCE), SQL Injection (SQLi), Privilege Escalation

Threats & Attacks

Once malware infects a device it 'phones home' to a C2 server to receive instructions: download additional tools, exfiltrate data, pivot to other systems, or activate ransomware. Blocking outbound connections to known C2 infrastructure, via DNS filtering or firewall rules, is one of the main defences.

See also: Botnet, Malware, DNS Filtering

Defenses & Controls

CVSS assigns a numerical score to a vulnerability by weighing factors such as how easy it is to exploit, whether it requires authentication, what impact it has on confidentiality, integrity, and availability, and whether active exploitation has been observed. Scores from 0.0 to 3.9 are low, 4.0 to 6.9 medium, 7.0 to 8.9 high, and 9.0 to 10.0 critical. Security teams use CVSS scores to prioritise patching, but a high score does not automatically mean a vulnerability is being exploited: the CISA KEV catalog and vendor advisories provide the confirming signal that a score alone cannot give you.

See also: CISA KEV Catalog, Patch Management, Vulnerability Scanning

Identity & Access

Conditional access policies, available in platforms like Microsoft Entra ID, apply access rules based on contextual signals: 'require MFA if signing in from a new country', 'block access from non-compliant devices', 'only allow access to Salesforce from managed devices'. They implement Zero Trust at the authentication layer.

See also: Zero Trust, Multi-Factor Authentication (MFA), Mobile Device Management (MDM)

Defenses & Controls

A Content Security Policy is a set of rules a website sends to the browser telling it which sources of scripts, images, styles, and other resources are allowed. A well-built CSP blocks injected JavaScript from running and stops a page from sending data to unapproved domains, which makes it a strong mitigation against cross-site scripting and web skimming. Its weak point is the allow-list: if a trusted domain on the list can be abused to fetch attacker content, the policy can be sidestepped. Setting a strict policy and keeping the list of trusted sources as small as possible are what make it effective.

See also: Cross-Site Scripting (XSS), Formjacking, Web Application Firewall (WAF)

Identity & Access

Context-aware access goes beyond username and password by continuously evaluating trust signals at the time of each access request: device compliance status, user risk score, IP reputation, time, and behaviour anomalies. If risk increases mid-session (an unusual location, a new device), the system can require re-authentication or step-up MFA.

See also: Conditional Access, Zero Trust, Attribute-Based Access Control (ABAC)

Threats & Attacks

Credential harvesting is the bulk theft of login details so they can be reused or sold. Attackers gather them several ways: fake login pages that capture what victims type, infostealer malware that scrapes saved passwords from browsers, and cracking the password hashes found in stolen configuration files or breached databases. Harvested credentials feed account takeover, credential stuffing, and hands-on intrusions, and a single working set of administrator credentials can open an entire network. Unique passwords, multi-factor authentication, and modern password hashing all reduce the value of whatever attackers manage to collect.

See also: Credential Stuffing, Infostealer, Phishing

Threats & Attacks

Attackers take credentials leaked in one breach and automatically try them across hundreds of other services, exploiting password reuse. Because billions of credential pairs are freely available online, even a small reuse rate yields successful logins. MFA and unique passwords for every account defeat this attack.

See also: Brute Force Attack, Password Spraying, Multi-Factor Authentication (MFA)

Threats & Attacks

XSS attacks occur when a web application includes unvalidated user input in its output without proper encoding. An attacker can inject JavaScript that runs in other users' browsers, enabling session hijacking, credential theft, or redirecting victims to malicious sites. Content Security Policy (CSP) and output encoding are the main mitigations.

See also: SQL Injection (SQLi), Web Application Firewall (WAF)

Threats & Attacks

Cryptojacking malware or browser scripts co-opt CPU and GPU cycles to mine cryptocurrency for the attacker, causing slowdowns, increased electricity bills, and hardware wear. It is often silent and persistent. Endpoint protection and script-blocking browser extensions are effective defences.

See also: Malware, Botnet

Compliance & Regulation

Cyber Essentials is an NCSC-backed certification scheme requiring organisations to implement five core controls: boundary firewalls, secure configuration, user access control, malware protection, and patch management. Cyber Essentials Plus involves third-party technical verification. It is mandatory for UK government suppliers handling sensitive data.

See also: Patch Management, Security Hardening

Compliance & Regulation

Cyber insurance policies typically cover incident response costs, forensic investigation, legal fees, regulatory fines, ransom payments, business interruption losses, and notification costs. Insurers increasingly require evidence of security controls (MFA, EDR, patching cadence, DR testing) before offering cover, making cyber insurance applications a useful security audit.

See also: Incident Response (IR), Data Breach Notification, Ransomware

Defenses & Controls

Developed by Lockheed Martin, the Cyber Kill Chain models attacks in seven phases: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command-and-Control, and Actions on Objectives. Defenders use it to identify where controls can break the chain and stop an attack before it reaches its goal. MITRE ATT&CK provides a more granular technique-level view.

See also: MITRE ATT&CK, Threat Modelling, Incident Response (IR)

Defenses & Controls

Dark web monitoring services continuously search criminal marketplaces, paste sites, and hacker forums for email addresses, passwords, and data belonging to your organisation. When a match is found, you receive an alert enabling you to force password resets before attackers exploit the stolen credentials.

See also: Credential Stuffing, Data Breach Notification

Compliance & Regulation

Most jurisdictions require organisations to notify supervisory authorities (e.g., the ICO in the UK) within 72 hours of discovering a breach involving personal data. Individuals must also be notified if the breach poses a high risk to their rights and freedoms.

See also: GDPR, Incident Response (IR)

Compliance & Regulation

Data classification assigns labels (typically Public, Internal, Confidential, and Restricted) to data assets, enabling organisations to apply proportionate controls. Highly-classified data may require encryption at rest, strict access controls, and audit logging; public data may need none of these. Classification is a prerequisite for effective DLP policy.

See also: Data Loss Prevention (DLP), GDPR, Data Retention Policy

Threats & Attacks

Data exfiltration is the final stage of many attacks: stealing files, databases, emails, or credentials and sending them to external servers. Attackers use encrypted channels, cloud storage services, or DNS tunnelling to hide the transfer. DLP tools, egress filtering, and anomaly detection help identify and block exfiltration.

See also: Data Loss Prevention (DLP), Egress Filtering, Insider Threat

Threats & Attacks

Data extortion strips away the encryption step that defines ransomware: attackers break in, copy files, and threaten to post them publicly if payment is not made, while leaving systems running. Because nothing is locked, there is no obvious sign a breach has occurred, so victims often learn about it only when the attacker posts stolen samples on a leak site. The stolen material is typically intellectual property, financial records, or employee and customer data. Egress monitoring, file access logs, and dark web monitoring for your organisation's name are the most reliable early-warning controls.

See also: Data Exfiltration, Double Extortion, Ransomware

Defenses & Controls

DLP solutions inspect data in motion (network traffic), at rest (stored files), and in use (clipboard, print, screen capture) to identify sensitive information (PII, payment card data, intellectual property) and prevent it from leaving via email, USB, cloud upload, or other channels. They enforce data-handling policies and provide audit trails.

See also: Data Exfiltration, Data Classification, Egress Filtering

Compliance & Regulation

Under GDPR and similar frameworks, organisations must sign DPAs with any third-party vendor that processes personal data on their behalf: cloud providers, payroll processors, CRM vendors. DPAs specify the subject matter, duration, nature, and purpose of processing.

See also: GDPR, Data Protection Officer (DPO)

Compliance & Regulation

GDPR mandates a DPIA before undertaking processing likely to result in high risk to individuals: large-scale profiling, systematic monitoring, processing of special category data. A DPIA identifies the data flows, assesses proportionality, identifies risks, and documents measures taken to mitigate them. It must be consulted with the DPO.

See also: GDPR, Data Protection Officer (DPO), Risk Assessment

Compliance & Regulation

Under GDPR, organisations in certain categories (public bodies, those processing data at large scale, or those conducting systematic monitoring) must appoint a DPO. The DPO advises on data protection obligations, monitors compliance, acts as a contact point for data subjects and supervisory authorities, and must report independently to senior management.

See also: GDPR, Data Protection Impact Assessment (DPIA)

Compliance & Regulation

A data retention policy balances legal requirements to retain records (tax, employment, contracts) against data minimisation obligations under privacy law. Data kept longer than necessary increases breach exposure and regulatory risk. Automated retention schedules tied to data classification ensure consistent enforcement.

See also: Data Classification, Right to Erasure, GDPR

Threats & Attacks

A dead drop resolver is a way for malware to find its command-and-control server indirectly. Instead of hard-coding an address that defenders can block, the malware reads it from content posted on a trusted public service, such as a social media profile, a code repository, or, increasingly, data stored in blockchain transactions. Because the lookup points at a reputable service and the attacker can change the stored value whenever they like, the technique survives takedowns and slips past filters that only block known-bad domains. Blocking unexpected outbound connections, inspecting where redirects lead, and behaviour-based endpoint protection are the practical defences.

See also: Command-and-Control (C2), Supply Chain Attack, Malware Loader (Dropper)

Defenses & Controls

Deception platforms scatter realistic-looking fake credentials, servers, databases, and documents across the real environment. Any interaction with these decoys is a high-confidence alert. Legitimate users have no reason to access them. Unlike perimeter defences, deception detects attackers already inside the network.

See also: Honeypot, Canary Token, Threat Hunting

Threats & Attacks

Attackers use generative AI to clone a CEO's voice or create convincing video of an executive issuing instructions, such as authorising a wire transfer or providing credentials. As deepfake quality improves, traditional voice-based verification is no longer reliable. Out-of-band confirmation through a known number is essential for any unusual request.

See also: Business Email Compromise (BEC), Social Engineering

Threats & Attacks

Many servers, storage systems, and network appliances ship with a standard built-in login, sometimes as simple as admin/admin, meant to be changed during setup. When that step gets skipped, anyone who can reach the service can log in with credentials published in the vendor's own documentation. Attackers and automated scanning tools routinely check for default logins first, because it takes no exploit and no guessing, just a lookup. Object storage systems, admin consoles, and IoT devices are the most common offenders. Changing every default credential during setup and auditing internet-facing services for logins that were never touched are the practical defences.

See also: Authentication Bypass, Credential Stuffing, IoT Security

Defenses & Controls

Digital forensics applies rigorous evidence-handling procedures to recover, preserve, and analyse data from compromised systems (disk images, memory dumps, network logs) to reconstruct an attacker's actions, identify affected data, and support legal or disciplinary proceedings. Chain of custody documentation is critical for evidence admissibility.

See also: Incident Response (IR), Audit Trail, Log Management

Defenses & Controls

A disaster recovery plan defines Recovery Time Objectives (RTO, how quickly systems must be restored) and Recovery Point Objectives (RPO, how much data loss is tolerable), and documents the technical steps to restore backups, failover to alternate infrastructure, and verify data integrity. Regular DR tests are as important as the plan itself.

See also: 3-2-1 Backup Rule, Business Continuity Plan (BCP), Immutable Backup

Threats & Attacks

DDoS attacks direct enormous volumes of traffic, often from botnets of thousands of compromised devices, at a target website, server, or network link until it can no longer respond to legitimate users. Volumetric attacks exhaust bandwidth; application-layer attacks target server resources. Cloud-based scrubbing services and CDN providers offer protection.

See also: Botnet

Infrastructure & Networks

DKIM adds a cryptographic signature to the email header, generated using the sending domain's private key. Receiving mail servers look up the corresponding public key in DNS and verify the signature, confirming the message body and headers have not been tampered with in transit. DKIM works alongside SPF and DMARC to reduce spoofing.

See also: SPF (Sender Policy Framework), DMARC, Email Security

Threats & Attacks

DLL side-loading abuses the way Windows programs look for the code libraries (DLL files) they depend on. An attacker drops a trusted, signed application next to a malicious DLL with the name that application expects, so when the program runs it loads the attacker's code instead of the real library. Because the visible program is legitimate and signed, the activity blends in and can slip past tools that trust signed software. Loaders and information stealers use the technique to stay hidden. Application allow-listing and behaviour-based endpoint protection that watches what a process does, rather than whether it is signed, are the practical defences.

See also: Fileless Malware, Living Off the Land (LotL), Endpoint Detection & Response (EDR)

Infrastructure & Networks

Domain-based Message Authentication, Reporting and Conformance (DMARC) lets domain owners publish a policy of 'none' (monitor), 'quarantine' (spam folder), or 'reject' (block) for messages that fail SPF or DKIM alignment. It also provides aggregate and forensic reports on who is sending mail claiming to be from your domain, exposing impersonation attempts.

See also: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), Email Security

Infrastructure & Networks

A DMZ (also called a perimeter network) places public-facing servers (web servers, email gateways, DNS servers) in a firewall-separated zone that is accessible from the internet but isolated from the internal corporate network. If a DMZ server is compromised, the attacker cannot directly reach internal systems.

See also: Firewall, Network Segmentation

Infrastructure & Networks

DNS filtering intercepts DNS queries and blocks resolution of known-malicious domains (command-and-control servers, phishing sites, malware distribution points) before any connection is established. It is a lightweight, cost-effective control deployable in minutes using services such as Cisco Umbrella or Cloudflare Gateway.

See also: Firewall, Command-and-Control (C2), DNS Spoofing

Threats & Attacks

DNS cache poisoning inserts fraudulent DNS records into a resolver's cache, redirecting queries for legitimate domains to malicious IP addresses. Victims believe they are connecting to their bank or email provider but are handing their credentials to attackers. DNSSEC cryptographically signs DNS records to prevent spoofing.

See also: Man-in-the-Middle (MitM), DNS Filtering

Threats & Attacks

Domain shadowing is a DNS abuse technique where an attacker steals access to the control panel for a legitimate domain, then adds new subdomains that point to their own malicious servers. Because the subdomains sit under a trusted, established domain, they inherit its good reputation and slip past filters that block known-bad sites, while the real owner rarely notices because their own website keeps working normally. Protecting registrar and DNS provider accounts with strong, unique passwords and MFA, and reviewing your DNS records for entries you did not create, are the main defences.

See also: DNS Spoofing, Typosquatting, Phishing

Compliance & Regulation

The Digital Operational Resilience Act (DORA), effective January 2025, requires EU financial sector organisations (banks, insurers, payment providers, and their key ICT third-party providers) to implement robust ICT risk management, incident reporting, resilience testing, and third-party oversight. Its scope extends to ICT suppliers serving EU financial entities.

See also: NIS2 Directive, Third-Party Risk Management (TPRM), Business Continuity Plan (BCP)

Threats & Attacks

In a double-extortion attack, criminals first exfiltrate sensitive data, then encrypt it. Victims face two pressures: paying to restore access and paying to prevent public data leaks. Some groups operate 'leak sites' on the dark web where they publish victim data if ransoms go unpaid.

See also: Ransomware, Data Exfiltration

Threats & Attacks

A downgrade attack pushes a system to fall back on an outdated version of a protocol or program that has known weaknesses, instead of the secure current one. In encryption this means tricking two parties into negotiating a broken cipher; in software it means reverting an application to a release with an unpatched vulnerability. The attack often works because old versions are left installed or accepted for compatibility, so the weaker option is still reachable. Removing legacy versions outright, rather than running them beside the current build, and refusing insecure fallbacks are the main defences.

See also: Patch Management, Man-in-the-Middle (MitM), Authentication Bypass

Threats & Attacks

Drive-by download attacks exploit browser or plugin vulnerabilities to silently install malware without any user interaction beyond visiting a web page. Attackers compromise legitimate websites or buy advertising space on ad networks to distribute malware at scale. Keeping browsers and plugins updated and using ad blockers significantly reduces exposure.

See also: Malware, Zero-Day Vulnerability, Watering Hole Attack

Defenses & Controls

Egress filtering restricts what can leave the network. Blocking connections to unknown or suspicious destinations, limiting outbound ports to only what is needed, and proxying all outbound HTTP/S traffic reduces attackers' ability to exfiltrate data or communicate with command-and-control infrastructure.

See also: Data Exfiltration, Command-and-Control (C2), Firewall

Infrastructure & Networks

Email security combines gateway filtering (blocking malicious attachments and URLs before delivery), sender authentication (SPF, DKIM, DMARC), anti-spam heuristics, sandboxing of attachments, and impersonation protection. Email remains the primary delivery mechanism for cyber attacks; a layered email security stack is essential for every organisation.

See also: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC, Sandboxing

Infrastructure & Networks

Encryption converts plaintext into ciphertext using a cryptographic algorithm and key. At-rest encryption protects stored data (full-disk encryption on laptops, database encryption). In-transit encryption (TLS/HTTPS) protects data moving across networks. Encryption does not prevent data exfiltration but renders stolen data unreadable.

See also: TLS (Transport Layer Security), Full Disk Encryption (FDE), Public Key Infrastructure (PKI)

Defenses & Controls

EDR solutions record endpoint activity, detect suspicious behaviour using behavioural analytics, and can automatically quarantine infected devices or kill malicious processes. Unlike traditional antivirus, EDR focuses on detecting novel threats that bypass signature-based detection.

See also: Managed Detection & Response (MDR), SIEM, Fileless Malware

Threats & Attacks

Event Tracing for Windows is the built-in logging framework that feeds most Windows endpoint security products their view of process behaviour: what a program opens, injects into, or connects to. Malware that patches or disables ETW providers in memory does not need to fool an antivirus signature; it removes the data the security tool would have used to notice anything wrong in the first place. The technique has turned up in modern ransomware loaders that tamper with ETW early in the infection chain, before dropping their main payload, specifically to reduce forensic visibility. Endpoint tools that monitor their own telemetry health, and flag unexplained gaps in ETW data rather than trusting a quiet log, are the practical defence.

See also: Living Off the Land (LotL), Endpoint Detection & Response (EDR), Fileless Malware

Threats & Attacks

An evil twin is a fake wireless access point broadcasting the same SSID as a trusted network: a coffee shop, hotel, or office Wi-Fi. Devices configured to auto-connect join the rogue AP instead, letting the attacker intercept unencrypted traffic or serve fake login pages. Using a VPN on all untrusted networks defeats this attack.

See also: Man-in-the-Middle (MitM), VPN (Virtual Private Network)

Identity & Access

Identity federation extends SSO beyond a single organisation. Using protocols like SAML or OIDC, a user's identity from one organisation (the identity provider) is trusted by partner organisations (service providers) without the user needing separate accounts. Common in B2B scenarios, healthcare consortia, and university research networks.

See also: Single Sign-On (SSO), SAML (Security Assertion Markup Language), Identity Provider (IdP)

Threats & Attacks

Fileless malware uses legitimate OS tools (PowerShell, WMI, the Windows registry) to execute malicious code without dropping files that antivirus can scan. Because it leaves little or no disk artefact, signature-based detection is ineffective. Behavioural EDR solutions and disabling unnecessary scripting features are the best defences.

See also: Malware, Living Off the Land (LotL), Endpoint Detection & Response (EDR)

Infrastructure & Networks

Firewalls enforce rules (policies) that permit or block network traffic based on source, destination, port, and protocol. Next-generation firewalls (NGFW) add deep packet inspection, application awareness, intrusion prevention, and TLS inspection to traditional packet filtering.

See also: VPN (Virtual Private Network), Zero Trust, Egress Filtering

Infrastructure & Networks

Firmware sits between a device's hardware and its operating system, controlling how the hardware initialises and operates. Routers, cameras, printers, and other network devices all run firmware. When a manufacturer discovers a security flaw in firmware, it releases an update, but many devices run outdated versions for years because owners have no obvious prompt to update. Attackers target known firmware vulnerabilities to compromise devices in bulk. Checking for and applying firmware updates is as important as patching software applications.

See also: IoT Security, Patch Management, Botnet

Threats & Attacks

Formjacking (also called web skimming or Magecart attacks) involves planting a few lines of JavaScript in an e-commerce site's payment page that silently copies card details as customers type them. The data is sent to the attacker in real time, and victims see no indication of compromise. Regular integrity checks on third-party scripts and a strict Content Security Policy are the main mitigations.

See also: Supply Chain Attack, Cross-Site Scripting (XSS)

Infrastructure & Networks

Perfect Forward Secrecy ensures that even if a server's long-term private key is later compromised, previously recorded encrypted sessions cannot be decrypted. It achieves this by using ephemeral key exchange (typically ECDHE) to generate a fresh session key for each connection. Most modern TLS configurations include PFS cipher suites.

See also: TLS (Transport Layer Security), Encryption

Infrastructure & Networks

FDE (implemented via BitLocker on Windows, FileVault on macOS) encrypts every bit of a drive, protecting data if a device is lost or stolen. Without the decryption key, typically tied to login credentials or a TPM chip, the disk appears as random noise. FDE is a baseline control for all laptops and mobile devices.

See also: Encryption, Data Classification

Compliance & Regulation

The General Data Protection Regulation (GDPR) applies to any organisation processing personal data of EU residents, regardless of location. It mandates lawful bases for processing, breach notification within 72 hours, data minimisation, privacy by design, and grants individuals rights including erasure and portability.

See also: Data Breach Notification, Data Processing Agreement (DPA), Data Protection Impact Assessment (DPIA)

Identity & Access

Hardware security keys (FIDO2/WebAuthn compliant, e.g., YubiKey) perform a cryptographic challenge-response bound to the specific website's domain, making them immune to phishing. Even if a user is lured to a fake site, the key will not authenticate. They are the strongest MFA option available for accounts at high risk of compromise.

See also: Multi-Factor Authentication (MFA), Passkeys, Phishing

Compliance & Regulation

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities (healthcare providers, insurers, clearinghouses) and their business associates to implement administrative, physical, and technical safeguards for electronic protected health information (ePHI). Breaches affecting 500+ individuals must be reported to the HHS and media within 60 days.

See also: Data Breach Notification, Audit Trail

Defenses & Controls

A honeypot mimics a real server, database, or service but contains no real data. Any connection to it is suspicious by definition. Honeypots gather intelligence about attacker tools and techniques, provide early warning of internal reconnaissance, and waste attackers' time on worthless targets.

See also: Deception Technology, Canary Token, Threat Hunting

Identity & Access

IGA combines identity lifecycle management (provisioning, changing, and deprovisioning access) with governance (access reviews, role mining, policy enforcement, and audit reporting). It answers the critical questions: does every employee have only the access they need? Are ex-employees still in the system? Are access rights reviewed periodically?

See also: Role-Based Access Control (RBAC), Principle of Least Privilege (PoLP), Offboarding

Identity & Access

An IdP (e.g., Microsoft Entra ID, Google Workspace, Okta) is the authoritative source for user identities. Applications delegate authentication to the IdP rather than managing their own user databases. Centralising identity in a single IdP with enforced MFA dramatically reduces the attack surface compared to many independent authentication systems.

See also: Single Sign-On (SSO), Federated Identity, SAML (Security Assertion Markup Language)

Defenses & Controls

Immutable backups use object-lock storage (WORM: write once, read many) to prevent ransomware or malicious insiders from encrypting or deleting backup data. They matter most against ransomware: even if production systems are fully encrypted, the immutable backup provides a known-clean restore point.

See also: 3-2-1 Backup Rule, Ransomware, Disaster Recovery (DR)

Defenses & Controls

A formal IR plan defines roles, communication channels, and step-by-step procedures for the six IR phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Having a plan before an incident dramatically reduces response time, cost, and reputational damage. SMBs should also maintain relationships with external IR retainers.

See also: Digital Forensics, Business Continuity Plan (BCP), Tabletop Exercise

Threats & Attacks

An information disclosure vulnerability, also called sensitive data exposure, lets an attacker read data an application was meant to keep private: API keys, passwords, configuration files, internal paths, or other users' records. These flaws often score only medium on the CVSS scale because they do not directly run code, but the leaked material frequently powers a more serious follow-up attack, for example using exposed credentials to break in elsewhere. Many are exploitable without any login, by requesting the wrong endpoint. Restricting access to sensitive endpoints, keeping secrets out of responses, and rotating any credential that may have been exposed are the core defences.

See also: Credential Harvesting, Path Traversal, Data Exfiltration

Compliance & Regulation

An information security policy (ISP) expresses senior management's commitment to protecting information assets, defines scope, assigns responsibilities, and establishes the high-level rules from which detailed standards, procedures, and guidelines are derived. ISO 27001 requires a formal ISP as a foundational control.

See also: ISO 27001, Acceptable Use Policy (AUP), Risk Assessment

Threats & Attacks

An infostealer is a category of malware focused on rapidly extracting high-value data (login credentials, browser cookies, SSH keys, API tokens, cryptocurrency wallets, and messaging-app session data) and sending it to attacker-controlled infrastructure. Unlike ransomware, infostealers cause no visible disruption, making them difficult to detect. Stolen data is typically sold on criminal markets or used directly for account takeover and lateral movement into corporate environments.

See also: Malware, Credential Stuffing, Data Exfiltration

Threats & Attacks

IABs compromise organisations (typically through phishing, exploiting exposed remote-access tools, or buying stolen credentials) and then auction that access on dark-web marketplaces to ransomware groups or other criminals. They have professionalised the 'intrusion' step of cybercrime, lowering the bar for groups who previously lacked the skills to break in.

See also: Ransomware-as-a-Service (RaaS), Credential Stuffing

Threats & Attacks

Serialization turns a program's in-memory objects into a format that can be stored or sent; deserialization reverses the step to rebuild them. Insecure deserialization happens when an application trusts serialized data that an attacker controls and reconstructs it without validation, which can let the attacker run their own code, tamper with application logic, or escalate privileges. Because the flaw fires during the rebuild itself, these bugs frequently earn critical CVSS scores and are exploited soon after disclosure, particularly in internet-facing enterprise software. The defences are to avoid deserializing untrusted input, restrict and validate the object types that may be rebuilt, and apply vendor patches promptly.

See also: Remote Code Execution (RCE), Command Injection, Web Shell

Threats & Attacks

Insider threats can be malicious (disgruntled employees stealing data), negligent (employees clicking phishing links or misconfiguring systems), or compromised (accounts taken over by external actors). Effective controls include least privilege, user behaviour analytics, offboarding procedures, and separation of duties.

See also: Data Exfiltration, Principle of Least Privilege (PoLP), Separation of Duties (SoD)

Threats & Attacks

An integer overflow happens when arithmetic produces a result bigger than the fixed-size variable meant to hold it, so the value wraps around to something much smaller, often near zero. Code that then uses the wrapped figure to size a memory buffer or check a limit makes the wrong decision, which is how integer overflows turn into buffer overflows and out-of-bounds writes. Attackers trigger them by supplying a very large length or count value, and the resulting memory corruption can crash the program or, in the worst case, allow remote code execution. The bug lives in how the program handles arithmetic rather than in any input you can filter, so a vendor patch is the real fix and keeping software updated is the practical defence.

See also: Buffer Overflow, Out-of-Bounds Write, Remote Code Execution (RCE)

Defenses & Controls

An IDS passively analyses traffic or system logs for signatures of known attacks or anomalous behaviour and generates alerts for investigation. Network-based IDS (NIDS) inspects packet flows; host-based IDS (HIDS) monitors individual device logs. Unlike an IPS, an IDS does not block traffic automatically.

See also: Intrusion Prevention System (IPS), SIEM, Threat Hunting

Defenses & Controls

An IPS sits inline in the network path and can automatically drop malicious packets, reset connections, or quarantine source IPs when it detects an attack signature or anomaly. Modern next-generation firewalls typically include IPS functionality. Tuning is critical: overly aggressive rules cause false positives that block legitimate traffic.

See also: Intrusion Detection System (IDS), Firewall, Web Application Firewall (WAF)

Infrastructure & Networks

IoT devices are frequently shipped with default passwords, unpatched firmware, and no update mechanism. Once on a network they can become entry points into internal systems or be conscripted into botnets. The main controls: segment IoT onto separate VLANs, change default credentials immediately, disable unused features, and maintain a device inventory.

See also: Network Segmentation, Asset Inventory, Botnet

Compliance & Regulation

ISO/IEC 27001 provides a systematic framework for managing information security risks through a set of policies, processes, procedures, and controls. Certification requires an accredited third-party audit and demonstrates to customers and partners that security is managed rigorously. Annex A lists 93 control categories covering policies, organisation, HR, physical, technology, and supplier security.

See also: Risk Assessment, Information Security Policy, Vendor Risk Management (VRM)

Identity & Access

JIT access eliminates standing privilege by requiring users to request elevated access for a specific task and time window. Once approved, permissions are granted and automatically revoked after the window expires. This reduces the risk from compromised admin accounts and limits the blast radius of insider threats.

See also: Privileged Access Management (PAM), Principle of Least Privilege (PoLP), Zero Trust

Threats & Attacks

Keyloggers capture everything typed on an infected device (passwords, credit card numbers, messages) and transmit logs to the attacker. Software keyloggers are delivered as malware; hardware keyloggers are physical devices inserted between keyboard and computer. EDR solutions and physical security reviews can detect both types.

See also: Malware, Spyware, Remote Access Trojan (RAT)

Threats & Attacks

After compromising one machine, attackers use legitimate credentials, remote administration tools, or exploits to spread to other systems, searching for higher-privilege accounts, high-value data, or domain controllers. Network segmentation, least privilege, and monitoring for unusual authentication events limit lateral movement.

See also: Privilege Escalation, Network Segmentation, Principle of Least Privilege (PoLP)

Threats & Attacks

LotL attacks avoid introducing custom malware by abusing tools already present on the system (PowerShell, WMI, certutil, PsExec, Mimikatz in memory), making them hard to distinguish from normal admin activity. Defenders respond with application whitelisting, reducing unnecessary built-in tool access, and behavioural analytics.

See also: Fileless Malware, Privilege Escalation

Infrastructure & Networks

Centralised log management aggregates event logs from firewalls, servers, endpoints, and applications into a searchable repository. Logs provide the evidence trail for incident investigation, support regulatory compliance (PCI DSS, GDPR, ISO 27001 require log retention), and feed SIEM detection rules. Retention periods typically range from 90 days to one year.

See also: SIEM, Audit Trail, Incident Response (IR)

Threats & Attacks

A logic bomb is code intentionally inserted into software to execute a malicious function when a defined condition is met: a date, a login, a file deletion, or the removal of an employee from the HR system. They are often planted by malicious insiders or delivered via trojans.

See also: Malware, Insider Threat

Threats & Attacks

Browser extensions run inside the browser with permission to read and change the pages a user visits, which is exactly what an attacker needs to harvest passwords, copy session cookies, or silently alter what the user sees. Some extensions are malicious from the start; others begin life as a legitimate tool, gain millions of installs, then turn hostile after the original author sells the project or pushes a remote-controlled update that needs no store review. Because the code can be switched on from the developer's server, an add-on can sit dormant and harmless for months before it starts stealing. The defences are to install only extensions you need, review the permissions they request, remove ones you no longer use, and prefer managed allow-lists on company devices.

See also: Supply Chain Attack, Infostealer, Data Exfiltration

Threats & Attacks

Malware is an umbrella term for malicious software including viruses, worms, trojans, spyware, adware, ransomware, and rootkits. It can disrupt operations, steal data, spy on users, or provide attackers with persistent access to compromised systems.

See also: Ransomware, Trojan Horse, Spyware, Rootkit

Threats & Attacks

A loader, also called a dropper, is lightweight malware that does little on its own: it runs early, pulls a second-stage payload from an attacker's server, launches it, and often deletes itself to muddy the trail. Splitting the attack this way lets criminals slip a tiny, innocuous-looking loader past defences and then deliver whatever they like next, whether an information stealer, a remote access trojan, or ransomware. Loaders are commonly planted through malicious software packages, phishing attachments, and ClickFix-style scams. Behaviour-based endpoint protection that watches what a process does, rather than trusting how it looks, is the most reliable defence.

See also: Malware, Infostealer, Command-and-Control (C2)

Threats & Attacks

Malware-as-a-service packages a working piece of malware, an information stealer, a loader, or a remote access tool, into a product that other criminals pay to use, often a few hundred dollars a month with extra fees for each fresh build. The operator maintains the code, the control servers, and the updates, while affiliates handle the break-ins, which lets people with little technical skill run capable attacks. The model is what turns a single malware family into tens of thousands of infections worldwide, and it is why law-enforcement takedowns aim at the shared servers and domains rather than individual users. Strong unique passwords, multi-factor authentication, and behaviour-based endpoint protection blunt the stolen data and payloads these services trade in.

See also: Infostealer, Ransomware-as-a-Service (RaaS), Malware Loader (Dropper)

Threats & Attacks

MitB attacks inject malicious code into a web browser, allowing the attacker to modify web pages, intercept form submissions, and alter transactions as they happen, even when the connection is HTTPS-protected. The user sees their intended transaction while the attacker changes the destination or amount.

See also: Man-in-the-Middle (MitM), Trojan Horse

Threats & Attacks

In a MitM attack, the attacker positions themselves between a client and server, relaying and optionally modifying traffic while both parties believe they are communicating directly. Common variants include ARP poisoning on LANs, evil-twin Wi-Fi hotspots, and SSL stripping. TLS with certificate pinning and VPNs are primary defences.

See also: ARP Poisoning, Evil Twin Attack, TLS (Transport Layer Security)

Defenses & Controls

MDR providers give SMBs access to a 24/7 security operations centre (SOC) without the cost of building one in-house. They combine technology (EDR, SIEM, threat intelligence) with human analysts who investigate alerts and contain incidents.

See also: Endpoint Detection & Response (EDR), SIEM, Security Operations Centre (SOC)

Threats & Attacks

A memory leak occurs when software allocates memory and then fails to clear or free it correctly after use. In a security context, leftover data from a previous request can remain in that memory and be read by a subsequent one, inadvertently exposing credentials, session tokens, or other private content to whoever comes next. Unreleased memory can also accumulate until the system runs out of resources, causing crashes that can be exploited for denial of service. The Heartbleed flaw in OpenSSL and the Squidbleed flaw in the Squid proxy are both memory-leak vulnerabilities that exposed session data across user boundaries. Patching is the primary defence, and for infrastructure components like proxies and TLS libraries that means applying vendor updates promptly.

See also: Information Disclosure, Use-After-Free (UAF), Patch Management

Defenses & Controls

Where traditional network segmentation divides networks into large zones, microsegmentation applies east-west access controls at the individual server, VM, or container level. Even if an attacker compromises one workload, they cannot communicate with adjacent systems without explicit policy permission.

See also: Network Segmentation, Zero Trust

Defenses & Controls

MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) catalogues hundreds of real-world attacker techniques organised by tactic (e.g., Initial Access, Persistence, Lateral Movement). Security teams use it to map detections, measure coverage gaps, describe incidents in a standard language, and benchmark threat-hunting programmes.

See also: Cyber Kill Chain, Threat Hunting, Threat Intelligence

Identity & Access

MDM solutions (Microsoft Intune, Jamf, etc.) allow IT teams to enforce device encryption, PIN requirements, and remote wipe on mobile devices accessing corporate resources. They can block jailbroken devices, push certificates and VPN profiles, and selectively wipe corporate data while leaving personal data intact.

See also: Conditional Access, Zero Trust, Full Disk Encryption (FDE)

Defenses & Controls

MFA combines something you know (a password), something you have (a hardware token or phone), and/or something you are (biometrics) to verify identity. Even if a password is stolen, MFA prevents attackers from logging in without the second factor. It is the single highest-impact control SMBs can deploy.

See also: Password Manager, Hardware Security Key, Zero Trust

Identity & Access

The need-to-know principle supplements least privilege with a focus on information: even if someone has permission to access a system, they should only see the specific data relevant to their current task. It is a cornerstone of classified information handling and is equally applicable in commercial environments handling sensitive customer or financial data.

See also: Principle of Least Privilege (PoLP), Data Classification, Role-Based Access Control (RBAC)

Infrastructure & Networks

NAC solutions enforce policies at the point a device connects to a network, wired or wireless. They can verify that a device has up-to-date antivirus, an approved configuration, and belongs to an authenticated user before allowing full network access. Non-compliant devices are quarantined or redirected to a remediation VLAN.

See also: Zero Trust, Network Segmentation, Endpoint Detection & Response (EDR)

Infrastructure & Networks

NAT allows multiple devices on a private network to share a single public IP address by translating addresses in the IP packet header. As a side effect it provides some implicit security by hiding internal IP addressing from the internet, but NAT should not be relied upon as a security control: a dedicated firewall is required.

See also: Firewall, DMZ (Demilitarised Zone)

Defenses & Controls

Network segmentation uses VLANs, firewalls, and access control lists to separate different parts of an organisation's network (finance, production, IoT, guests) so that lateral movement is restricted. An attacker who compromises a workstation in the guest VLAN cannot reach financial servers or manufacturing control systems.

See also: Microsegmentation, Firewall, Zero Trust

Compliance & Regulation

The Network and Information Security 2 (NIS2) Directive broadened the original NIS Directive's scope to include medium and large organisations in 18 'essential' and 'important' sectors. Requirements include risk management measures, incident reporting within 24 hours, and supply chain security obligations.

See also: GDPR, Data Breach Notification, Third-Party Risk Management (TPRM)

Compliance & Regulation

The NIST CSF organises security practices into five functions: Identify, Protect, Detect, Respond, and Recover (v2.0 adds Govern). Each function contains categories and subcategories with specific controls. Although originally aimed at US critical infrastructure, it is widely adopted globally as a maturity and gap-assessment tool.

See also: ISO 27001, Risk Assessment, Incident Response (IR)

Identity & Access

A non-human identity is any credential used by software rather than a person: service accounts, API keys, OAuth tokens, and the integrations that link one cloud tool to another. These identities usually hold broad, standing access to data and run in the background, yet they are watched far less closely than employee logins and are often created and then forgotten. Attackers increasingly target them, because a stolen token already carries permission and needs no password or MFA code. Inventorying every integration, granting each one only the access it needs, and rotating or expiring credentials on a schedule are the main defences.

See also: OAuth 2.0, Privileged Access Management (PAM), Principle of Least Privilege (PoLP)

Identity & Access

OAuth 2.0 allows users to grant third-party applications limited access to their resources on another service, without giving the third party their password. For example, 'Sign in with Google' uses OAuth to share only your name and email with a third-party app. Misconfigured OAuth implementations are a common source of account hijacking vulnerabilities.

See also: SAML (Security Assertion Markup Language), Single Sign-On (SSO), Identity Provider (IdP)

Identity & Access

Offboarding is a high-risk window: departing employees, especially those leaving under strained circumstances, may attempt to exfiltrate data or retain access after leaving. A secure offboarding checklist covers: immediate disabling of all accounts, revocation of VPN and physical access, transfer of data from personal accounts, and recovery of devices and access tokens.

See also: Identity Governance & Administration (IGA), Insider Threat, Principle of Least Privilege (PoLP)

Infrastructure & Networks

OT security protects hardware and software that monitors or controls physical processes, manufacturing, utilities, building management systems. OT systems were historically isolated but are now increasingly internet-connected. Unlike IT, OT availability often trumps confidentiality, and patches may require extended maintenance windows or are unavailable for legacy systems.

See also: Air Gap, Network Segmentation, IoT Security

Infrastructure & Networks

OSINT gathers intelligence from public sources (company websites, LinkedIn, social media, domain registrations, GitHub repositories, job adverts, leaked databases) to build a profile of a target. Attackers use OSINT to prepare phishing lures, identify technology stacks, and discover employee details. Defenders use OSINT to understand their own exposure and take down leaked information.

See also: Spear Phishing, Threat Intelligence

Threats & Attacks

An out-of-bounds write happens when software writes more data, or writes further along, than the block of memory it reserved allows. The overflow lands in adjacent memory the program never meant to touch, and an attacker who controls what gets written can use it to corrupt data, redirect how the program runs, or escalate privileges. In the operating system kernel these bugs are especially dangerous, because the corrupted memory can be shared across the whole machine, as seen in the page-cache flaws of the Dirty Pipe family. The bug lives in how code handles memory rather than in any input you can sanitise, so a vendor patch is almost always the real fix. Keeping the operating system and its kernel updated is the practical defence.

See also: Use-After-Free (UAF), Memory Leak, Privilege Escalation

Threats & Attacks

A packet sniffer captures the raw data travelling across a network link and reconstructs it for inspection. Legitimate engineers use sniffers to debug networks, but planted on a compromised router, firewall, or switch, the same tool lets an attacker passively harvest usernames, passwords, and session tokens from traffic that passes through, without ever touching the endpoints sending it. Because sniffing is passive, it leaves few signs beyond unusual processes or unexpected outbound connections on the device doing the capturing. Encrypting traffic end to end, segmenting networks so a single compromised device cannot see unrelated traffic, and monitoring network appliances for unauthorised processes are the main defences.

See also: Man-in-the-Middle (MitM), Credential Harvesting, Data Exfiltration

Identity & Access

Passkeys (FIDO2/WebAuthn) replace passwords with a public/private key pair: the private key stays securely on the user's device (protected by biometrics or PIN), and the public key is stored by the website. There is nothing to steal or phish. Major platforms (Apple, Google, Microsoft) support passkeys in their operating systems and browsers.

See also: Hardware Security Key, Biometric Authentication, Multi-Factor Authentication (MFA)

Defenses & Controls

Password managers eliminate the need to remember passwords, enabling employees to use long, unique credentials for every account without reuse. They typically integrate with browsers and mobile devices and can alert users when credentials appear in data breaches.

See also: Multi-Factor Authentication (MFA), Credential Stuffing

Threats & Attacks

Unlike brute force attacks that hammer one account with many passwords, password spraying tries a single common password (e.g., 'Summer2024!') against thousands of accounts simultaneously. This avoids lockout thresholds while still succeeding against users with weak passwords. MFA eliminates the risk.

See also: Brute Force Attack, Credential Stuffing, Multi-Factor Authentication (MFA)

Defenses & Controls

Patch management involves identifying, acquiring, testing, and deploying software updates across all systems on a defined schedule. Unpatched software is one of the leading causes of breaches; most successful attacks exploit vulnerabilities for which patches have been available for months or years.

See also: Zero-Day Vulnerability, Vulnerability Scanning

Threats & Attacks

Path traversal, also called directory traversal, happens when an application builds a file path from user input without checking it, so an attacker can supply sequences like '../' to climb out of the intended directory and reach files elsewhere on the server. Depending on the application's permissions, this can expose configuration files and credentials, or in the worst cases let an attacker write files and bypass authentication on network appliances. The flaws often need no login and are exploited with ordinary HTTP requests, which is why they routinely score high on the CVSS scale. Input validation, resolving paths before use, and running services with least privilege are the main defences.

See also: Command Injection, Authentication Bypass, Remote Code Execution (RCE)

Compliance & Regulation

PCI DSS is a set of security standards mandated by card networks (Visa, Mastercard, etc.) for any business that processes, stores, or transmits payment card data. Requirements span network segmentation, encryption, access control, vulnerability management, and regular penetration testing.

See also: Encryption, Penetration Testing, Network Segmentation

Defenses & Controls

A penetration test ('pen test') tasks security professionals with attempting to breach an organisation's systems using the same techniques as real attackers, within agreed rules of engagement. Findings are reported with severity ratings and remediation guidance. Annual pen testing is a common compliance requirement.

See also: Vulnerability Scanning, Red Team, PCI DSS

Compliance & Regulation

Personally identifiable information includes obvious identifiers such as names, National Insurance or Social Security numbers, passport numbers, and driver's licence numbers, as well as data that identifies someone when combined with other details, such as a date of birth paired with a postcode. Privacy laws across most jurisdictions, including GDPR in the UK and EU and the CCPA in California, impose specific rules on how PII must be collected, stored, and protected, and require notification when it is compromised. For small businesses, the practical priority is to know which systems hold PII, limit who can access it, and ensure any vendors handling it have signed a data processing agreement.

See also: GDPR, Data Breach Notification, Data Classification

Threats & Attacks

Phishing attacks impersonate trusted entities (banks, cloud services, or colleagues) via email, SMS (smishing), or voice calls (vishing) to steal login credentials, financial data, or install malware. Spear phishing targets specific individuals using personalised details.

See also: Spear Phishing, Smishing, Vishing, Business Email Compromise (BEC)

Threats & Attacks

Phishing-as-a-service packages the work of running a phishing campaign (convincing fake login pages, hosting, and tooling) into a product that less-skilled criminals can rent, or in some cases use for free. Like ransomware-as-a-service, it lowers the barrier to entry and pushes up the volume of attacks aimed at consumers and small businesses. Operators profit from stolen credentials and from funnelling victims into other scams such as premium SMS fraud and fake investment offers. Phishing-resistant logins such as passkeys and regular staff awareness training are the most effective countermeasures.

See also: Phishing, Ransomware-as-a-Service (RaaS), Social Engineering

Threats & Attacks

Polymorphic malware rewrites its own code every time it replicates (changing variable names, instruction order, encryption keys, or file structure) while preserving its malicious function. Signature-based antivirus cannot detect new variants; behavioural analysis and EDR solutions that watch what code does rather than what it looks like are required.

See also: Malware, Fileless Malware, Endpoint Detection & Response (EDR)

Threats & Attacks

In a pretexting attack, the adversary invents a plausible backstory (posing as an IT support engineer, auditor, new employee, or delivery person) to gain the victim's trust and extract information or access. It is the narrative component of social engineering, often used to prime targets before requesting sensitive data.

See also: Social Engineering, Vishing

Identity & Access

Least privilege limits the blast radius of a compromised account by ensuring users, applications, and services only have the rights they need. It involves removing local admin rights from standard users, segmenting role-based access, and auditing permission grants regularly.

See also: Zero Trust, Role-Based Access Control (RBAC), Just-in-Time (JIT) Access

Threats & Attacks

After gaining initial access with a low-privilege account, attackers exploit vulnerabilities, misconfigurations, or stolen credentials to elevate their permissions to administrator or domain-admin level. Privilege escalation is a critical stage in most breaches. Least privilege, patching, and PAM reduce the attack surface.

See also: Lateral Movement, Principle of Least Privilege (PoLP), Privileged Access Management (PAM)

Identity & Access

PAM solutions vault, rotate, and monitor credentials for privileged accounts (domain admins, root accounts, service accounts), which are prime targets for attackers. Features include just-in-time access, session recording, and automatic password rotation to reduce standing privilege.

See also: Principle of Least Privilege (PoLP), Just-in-Time (JIT) Access, Zero Trust

Threats & Attacks

Prompt injection slips attacker-controlled instructions into content an AI system processes (an email, a document, a web page, a shared contact) so the model treats them as legitimate commands. Because language models cannot reliably separate trusted instructions from untrusted data mixed into the same input, an injected prompt can make an AI agent leak data, run code, or act on the attacker's behalf. The defences are to limit what the agent can do on its own, require human approval for sensitive actions, and treat every input it ingests as untrusted.

See also: Social Engineering, Data Exfiltration

Compliance & Regulation

Protected health information is any identifiable data about a person's health status, healthcare provision, or payment for healthcare created or received by a HIPAA-covered entity or its business associates. It includes names, Social Security numbers, dates of birth, addresses, diagnosis codes, treatment records, and health insurance information when they can be linked to an individual. Because PHI is both sensitive and attractive to identity thieves, HIPAA requires covered entities and their business associates to implement technical, physical, and administrative safeguards. A breach affecting 500 or more individuals must be reported to the HHS Office for Civil Rights within 60 days, and large breaches must also be disclosed to local media. For small healthcare-adjacent businesses, the practical starting point is knowing which systems hold PHI, signing a Business Associate Agreement with every vendor that touches it, and enforcing phishing-resistant authentication on accounts with access.

See also: HIPAA, Personally Identifiable Information (PII), Data Breach Notification

Infrastructure & Networks

A proxy server sits between a user's device and the internet, forwarding requests on the user's behalf. Businesses use proxies to filter web traffic, cache content, and inspect outbound connections for data loss. Attackers abuse them differently: by compromising third-party devices (routers, servers, consumer devices) and routing attack traffic through them, they hide their real location and make blocking by IP address ineffective. Proxy networks assembled from compromised devices are a staple of large-scale botnet operations.

See also: Botnet, Command-and-Control (C2), Egress Filtering

Infrastructure & Networks

PKI manages the creation, distribution, storage, and revocation of digital certificates and the key pairs they bind. It underpins HTTPS, email signing, code signing, VPN authentication, and smart card login. The certificates come either from an enterprise PKI or from a trusted commercial CA.

See also: Certificate Authority (CA), TLS (Transport Layer Security), Code Signing

Defenses & Controls

Purple-teaming breaks down the red vs. blue adversarial dynamic by having attackers and defenders run techniques side-by-side: the red team executes an attack, the blue team observes their detections (or lack thereof), and both immediately iterate on improving coverage. It turns red-team findings into defensive improvements faster.

See also: Red Team, Blue Team, MITRE ATT&CK

Threats & Attacks

Quishing (QR code phishing) embeds a malicious URL in a QR code, bypassing email link-scanning tools that cannot decode QR images. Attackers send QR codes in emails, place them over legitimate stickers in public spaces, or include them in physical mail. Users who scan are directed to credential-harvesting pages or drive-by download sites.

See also: Phishing, Drive-By Download

Threats & Attacks

A race condition happens when the result of an operation depends on the precise timing of separate steps that are assumed to run in order. An attacker who wins the 'race' can act in the gap between two steps, for example swapping a file after it is checked but before it is used, to gain access or privileges they should not have. These bugs are common in privilege-escalation exploits, where success can be intermittent because it relies on hitting the right moment. Because they live in how code is timed rather than in any input it receives, the fix is almost always a vendor patch, so keeping software updated is the practical defence.

See also: Privilege Escalation, Zero-Day Vulnerability, Use-After-Free (UAF)

Threats & Attacks

Ransomware is malicious software that encrypts a victim's files or locks their device, then demands a ransom payment, usually in cryptocurrency, in exchange for the decryption key. Modern ransomware families also exfiltrate data before encryption to enable double-extortion.

See also: Malware, Double Extortion, Ransomware-as-a-Service (RaaS), 3-2-1 Backup Rule

Threats & Attacks

RaaS operates like legitimate SaaS: a core development group builds and maintains ransomware infrastructure, then recruits affiliates who conduct actual attacks in exchange for a revenue share (typically 70-80% of paid ransoms). This has dramatically lowered the technical barrier to ransomware attacks and enabled a cottage industry of specialists.

See also: Ransomware, Initial Access Broker (IAB)

Threats & Attacks

Reconnaissance is the first stage of most attacks: mapping network addresses, identifying open ports and services, discovering software versions, and finding employee names and email patterns. Attackers conduct passive reconnaissance using public sources (OSINT) and active reconnaissance by probing the target's systems directly. Reducing internet-exposed services, monitoring for port scans, and keeping software version information out of public-facing responses all shrink the information available to an attacker during this phase.

See also: OSINT (Open-Source Intelligence), Cyber Kill Chain, Vulnerability Scanning

Compliance & Regulation

Article 30 of GDPR requires most organisations to maintain a RoPA listing each processing activity, its purpose, legal basis, categories of data and data subjects, recipients, retention periods, and technical/organisational security measures. It is a foundational document for demonstrating GDPR accountability and scoping DPIAs.

See also: GDPR, Data Protection Impact Assessment (DPIA), Data Classification

Defenses & Controls

Red teams conduct goal-oriented adversarial simulations, attempting to breach systems, exfiltrate data, or achieve specific objectives using the full range of attacker techniques including social engineering, physical intrusion, and zero-day-style exploitation. Unlike pen tests focused on finding vulnerabilities, red teams measure defensive capability under realistic attack conditions.

See also: Blue Team, Purple Team, Penetration Testing

Threats & Attacks

A RAT provides an attacker with covert administrative access to a compromised machine, allowing them to browse files, activate webcams, log keystrokes, exfiltrate data, or pivot to other systems on the same network.

See also: Trojan Horse, Malware, Command-and-Control (C2)

Threats & Attacks

Remote code execution is among the most serious vulnerability classes: it lets an attacker run commands of their choosing on a target server or device from across a network. The most dangerous RCE bugs are unauthenticated, needing no credentials and no user interaction, just network access, which is why they routinely score 9 or above on the CVSS scale and draw exploitation within hours of disclosure. Prompt patching and removing internet exposure of management interfaces are the primary defences.

See also: Zero-Day Vulnerability, Patch Management, Privilege Escalation

Infrastructure & Networks

Remote Desktop Protocol transmits the graphical interface of a remote Windows machine to the connecting device, giving the user full interactive control as if they were sitting in front of it. RDP is widely used by IT teams and remote workers, but exposing it directly to the internet on the default port (3389) is one of the most common ways ransomware groups and initial access brokers get a foothold in a network: they either brute-force weak credentials or exploit unpatched RDP vulnerabilities. Placing RDP behind a VPN or Zero Trust gateway and enabling multi-factor authentication on all RDP sessions are the standard mitigations for any business that needs it.

See also: VPN (Virtual Private Network), Brute Force Attack, Ransomware

Infrastructure & Networks

Remote monitoring and management tools let IT staff and managed service providers watch over, update, and control many computers from a single console. The same reach that makes them useful makes them attractive to attackers: ransomware crews and other intruders install or hijack RMM software to move through a network, push malware to every machine at once, and blend in with routine administration. Because the tools are legitimate and often allow-listed, their activity rarely looks suspicious. The defences are to restrict which RMM products may run, require multi-factor authentication on the consoles, and alert on any RMM tool that is not part of an approved set.

See also: Living Off the Land (LotL), Endpoint Detection & Response (EDR), Patch Management

Threats & Attacks

A residential proxy network sells access to real home IP addresses, letting paying customers route their traffic through someone else's internet connection. The home devices doing the routing, smart TVs, streaming boxes, routers, get enrolled through bundled software in free apps or hardware that ships with the code pre-installed, usually without a real consent screen. Criminals rent these networks specifically because security tools are built to trust ordinary residential traffic more than datacentre traffic, so a password-spray attempt or a stolen-credential login routed through a residential exit node can slip past IP-based blocking that would catch the same attack coming from a data centre. An enrolled device also becomes a doorway: outside traffic passing through it can reach other devices on the same home or office network. Avoiding unofficial streaming boxes, refusing apps that offer payment for 'sharing your bandwidth,' and treating residential-IP logins with unusual timing as worth a second look are the practical defences.

See also: Botnet, Credential Stuffing, Command-and-Control (C2)

Defenses & Controls

Responsible disclosure (or coordinated disclosure) establishes a framework where a researcher reports a vulnerability privately to the affected vendor, allows a reasonable time for a fix to be developed and deployed (typically 90 days), and only then publishes their findings. This balances the public interest in patching with preventing attackers from exploiting the gap.

See also: Bug Bounty Programme, Vulnerability Scanning

Compliance & Regulation

Also called the 'right to be forgotten', this GDPR right lets individuals ask organisations to delete their personal data when it is no longer needed for its original purpose, consent is withdrawn, or the data has been unlawfully processed. Organisations must respond within one month. Technical challenges include data spread across multiple systems, backups, and third-party processors.

See also: GDPR, Data Retention Policy, Data Processing Agreement (DPA)

Compliance & Regulation

A cybersecurity risk assessment identifies information assets, catalogues potential threats and vulnerabilities, estimates likelihood and impact, calculates risk scores, and prioritises mitigations. The output feeds a risk register and informs security investment decisions. ISO 27001, NIST CSF, and NCSC guidance all require regular risk assessments.

See also: ISO 27001, NIST Cybersecurity Framework (CSF), Threat Modelling

Identity & Access

RBAC groups permissions into roles (e.g., 'Finance Analyst', 'IT Admin') that map to job functions. Users are assigned roles rather than individual permissions, simplifying access management and reducing the risk of over-provisioning as staff change roles or leave the organisation.

See also: Principle of Least Privilege (PoLP), Attribute-Based Access Control (ABAC), Identity Governance & Administration (IGA)

Threats & Attacks

A rootkit modifies the operating system's core functions (kernel, drivers, or boot sector) to conceal its presence and that of other malware from standard security tools and task managers. Detecting rootkits typically requires booting from a clean external drive. Some rootkits survive OS reinstallation by residing in firmware.

See also: Malware, Fileless Malware

Identity & Access

SAML 2.0 is widely used for enterprise SSO, passing a signed XML assertion from the identity provider to a service provider confirming who the user is and what roles they hold. It is the dominant SSO protocol in enterprise and government environments. OIDC (based on OAuth 2.0) is increasingly preferred for modern applications.

See also: Single Sign-On (SSO), OAuth 2.0, Identity Provider (IdP)

Defenses & Controls

A sandbox executes suspicious files, email attachments, or URLs in a virtualised environment isolated from the real system. Security tools observe what the code tries to do (registry changes, network connections, file writes) to determine if it is malicious before allowing it to reach end users. Email gateways, web proxies, and EDR platforms use sandboxing.

See also: Endpoint Detection & Response (EDR), Fileless Malware

Infrastructure & Networks

SASE merges SD-WAN with cloud-native security services (ZTNA, CASB, SWG, NGFW, and DNS filtering) into a unified platform delivered from the cloud edge. Rather than backhauling remote worker traffic through a central data centre, SASE applies security closest to the user. It is particularly suited to distributed SMBs with hybrid workforces.

See also: Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), VPN (Virtual Private Network)

Threats & Attacks

Scareware presents pop-ups mimicking legitimate antivirus warnings, 'Your PC is infected with 47 viruses!', to panic users into purchasing useless 'security' software or calling premium-rate fake tech support numbers. The software often contains actual malware, and the support calls result in remote-access fraud.

See also: Malware, Social Engineering

Defenses & Controls

SSDLC (also called DevSecOps) embeds security into requirements, design, coding, testing, and deployment. Practices include threat modelling at design time, static code analysis (SAST), open-source dependency scanning (SCA), dynamic testing (DAST) against running applications, and security reviews before release. The goal is to find and fix security issues when they are cheapest to address.

See also: Threat Modelling, Vulnerability Scanning, Code Signing

Defenses & Controls

Security awareness programmes include interactive training, simulated phishing campaigns, and regular briefings to help employees identify social engineering, handle data responsibly, and follow secure procedures. Measurable reductions in phishing click rates are the primary success metric.

See also: Phishing, Social Engineering, Acceptable Use Policy (AUP)

Defenses & Controls

Security by Design means considering threats, attack surfaces, and mitigations during the initial architecture and design phase rather than patching them in later. Principles include minimising attack surface, failing securely, using defaults that are secure, and applying least privilege throughout. GDPR mandates 'privacy by design' as a specific application of this concept.

See also: Threat Modelling, Secure Software Development Lifecycle (SSDLC), GDPR

Defenses & Controls

Hardening applies CIS Benchmarks or vendor security guides to configure systems securely out of the box: disabling unused services and ports, removing default accounts, enforcing strong authentication, enabling logging, and applying minimum-privilege principles. Hardened systems present a smaller target than default configurations.

See also: Patch Management, Vulnerability Scanning, Principle of Least Privilege (PoLP)

Defenses & Controls

A SOC combines people, processes, and technology to provide 24/7 monitoring, detection, triage, and response. Analysts work with SIEM, EDR, and threat intelligence feeds to identify threats and contain incidents. SMBs can get SOC capabilities through an MDR provider instead of building one in-house.

See also: SIEM, Managed Detection & Response (MDR), Incident Response (IR)

Identity & Access

SoD reduces the risk of fraud and error by requiring at least two people to complete high-value actions, e.g., one person requests a payment, another approves it; one engineer deploys code, another reviews it. It is a core internal control for financial systems and is required by SOX, PCI DSS, and ISO 27001.

See also: Principle of Least Privilege (PoLP), Role-Based Access Control (RBAC), Insider Threat

Threats & Attacks

In an SSRF attack, the adversary gets a server to fetch a URL they choose. Because the request comes from the trusted server rather than the attacker, it can reach internal services that are not exposed to the internet, or carry stolen data past filters that only inspect the user's own browser. SSRF has become a common ingredient in cloud and AI-assistant attacks, where one component is persuaded to call another and the request inherits trust it should not have. Validating and allow-listing the destinations a server may contact, and blocking requests to internal address ranges, are the core defences.

See also: Data Exfiltration, Command Injection, Cross-Site Scripting (XSS)

Identity & Access

Service accounts authenticate applications, scripts, and services to databases, APIs, and other systems. They are high-value targets because they often hold elevated privileges, their credentials rarely rotate, and their activity is hard to distinguish from normal operations. Best practices: give service accounts the minimum permissions needed, rotate credentials regularly, and use managed identities or secrets managers.

See also: Privileged Access Management (PAM), Principle of Least Privilege (PoLP)

Identity & Access

Shadow IT creates security blind spots: data flows into unsanctioned apps (personal Dropbox, WhatsApp, free SaaS tools) where the organisation has no visibility, control, or backup. CASB tools can discover and control shadow IT usage; a culture of easy-to-use approved alternatives reduces the incentive for employees to go off-piste.

See also: Cloud Access Security Broker (CASB), Data Loss Prevention (DLP), Acceptable Use Policy (AUP)

Infrastructure & Networks

Cloud providers secure 'of the cloud' (physical facilities, hypervisor, managed services infrastructure); customers are responsible for security 'in the cloud': their data, identities, applications, and configurations. Misunderstanding this boundary, assuming the cloud provider is responsible for encrypting your data or backing it up, is a common cause of cloud security failures.

See also: Cloud Security, Data Processing Agreement (DPA)

Infrastructure & Networks

A SIEM aggregates log data from across an organisation's IT environment (firewalls, endpoints, servers, cloud services) and applies rules and analytics to detect suspicious patterns in near-real-time. It also stores logs for forensic investigation and regulatory compliance.

See also: Log Management, Managed Detection & Response (MDR), Threat Hunting

Threats & Attacks

A SIM swap attack tricks a mobile carrier's customer service representative, using personal information obtained from social media or data breaches, into porting the victim's phone number to an attacker-controlled SIM. The attacker then intercepts SMS-based MFA codes, enabling account takeover of bank accounts and email.

See also: Account Takeover (ATO), Social Engineering, Multi-Factor Authentication (MFA)

Identity & Access

SSO uses a centralised identity provider (IdP), such as Microsoft Entra ID or Okta, so users authenticate once and gain access to all connected applications without re-entering credentials. SSO improves security by funnelling all authentication through a single enforced MFA checkpoint.

See also: Multi-Factor Authentication (MFA), Identity Provider (IdP), SAML (Security Assertion Markup Language)

Threats & Attacks

Smishing messages impersonate banks, delivery services, or government agencies to create urgency and trick recipients into clicking malicious links or calling fraudulent numbers. Mobile users are often less suspicious of text messages than email. Never click links in unsolicited texts: go directly to the official website or app.

See also: Phishing, Vishing

Infrastructure & Networks

SOAR platforms connect security tools via APIs and automate high-volume, repetitive response actions (enriching alerts with threat intelligence, blocking IPs in the firewall, quarantining endpoints, or creating tickets), freeing analysts to focus on complex investigations. SOAR typically sits alongside a SIEM.

See also: SIEM, Incident Response (IR), Threat Intelligence

Compliance & Regulation

SOC 2 (System and Organisation Controls 2) is an AICPA auditing framework assessing a service provider's controls against five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Type I reports describe controls at a point in time; Type II assess their operating effectiveness over 6-12 months. It is commonly required by US enterprise customers.

See also: ISO 27001, Audit Trail

Threats & Attacks

Social engineering exploits human psychology (trust, authority, urgency, fear, and helpfulness) to bypass technical controls. It encompasses phishing, pretexting, baiting (leaving infected USB drives), tailgating (following someone through a secure door), and vishing. Security awareness training is the primary countermeasure.

See also: Phishing, Pretexting, Vishing, Security Awareness Training

Threats & Attacks

Unlike mass phishing campaigns, spear phishing uses personal information (job title, colleagues' names, recent transactions) gathered via open-source intelligence (OSINT) to craft convincing lures directed at a specific target, greatly increasing success rates.

See also: Phishing, Business Email Compromise (BEC), OSINT (Open-Source Intelligence)

Infrastructure & Networks

An SPF record is a TXT entry in DNS that lists IP addresses and mail servers permitted to send on behalf of a domain. When a receiving server gets an email, it checks SPF. If the sending IP is not listed, the message can be marked as spam or rejected. SPF alone is insufficient: it must be combined with DKIM and DMARC.

See also: DKIM (DomainKeys Identified Mail), DMARC, Email Security

Threats & Attacks

Spyware operates silently in the background, collecting browsing history, keystrokes, screenshots, microphone or camera feeds, and login credentials without the user's knowledge. It may be installed via malicious downloads, email attachments, or bundled with freeware. Commercial 'stalkerware' variants are marketed for domestic surveillance.

See also: Malware, Keylogger, Adware

Threats & Attacks

SQLi exploits web applications that build database queries by concatenating user input without sanitisation. An attacker can craft input that tricks the database into returning all records, bypassing authentication, modifying data, or deleting tables. Parameterised queries (prepared statements) entirely eliminate this vulnerability.

See also: Cross-Site Scripting (XSS), Web Application Firewall (WAF)

Threats & Attacks

Steganography is the practice of concealing information inside something that looks harmless, most often by tucking it into the spare bytes of an image, audio, or font file. Attackers use it to smuggle malicious code past security scanners that judge a file by its type rather than its contents: a PNG image or a WOFF2 font can render normally while a program hidden inside it is extracted and run. Because the carrier file appears legitimate, signature-based tools often miss it, which is why malware loaders and browser extensions increasingly hide their payloads this way. Behaviour-based endpoint protection that watches what code does, rather than what a file claims to be, is the dependable defence.

See also: Malware Loader (Dropper), Polymorphic Malware, Malicious Browser Extension

Threats & Attacks

Rather than attacking a well-defended target directly, threat actors compromise a trusted supplier (a software vendor, managed service provider, or hardware manufacturer) and use that access to reach the actual targets. The SolarWinds and 3CX incidents are prominent examples.

See also: Malware, Third-Party Risk Management (TPRM), Vendor Risk Management (VRM)

Defenses & Controls

Tabletop exercises bring together IT, management, legal, communications, and HR to walk through a scripted scenario (a ransomware outbreak, a data breach, a BEC fraud) to identify gaps in plans, responsibilities, and communication flows. They cost little to run and should be held at least annually.

See also: Incident Response (IR), Business Continuity Plan (BCP)

Compliance & Regulation

Every third party with access to your systems or data (cloud providers, payment processors, software vendors, cleaning companies with physical access) extends your attack surface. TPRM involves sending security questionnaires, reviewing certifications (ISO 27001, SOC 2), conducting contract due diligence, and monitoring for breaches in the supply chain.

See also: Vendor Risk Management (VRM), Supply Chain Attack, ISO 27001

Infrastructure & Networks

Threat feeds deliver machine-readable lists of known-malicious IP addresses, domains, file hashes, URLs, and patterns to security tools. SIEM rules, firewall block lists, and DNS filters consume feeds automatically to protect against known-bad infrastructure. Feed quality varies enormously: high false-positive rates from poor-quality feeds cause alert fatigue.

See also: Threat Intelligence, SIEM, DNS Filtering

Defenses & Controls

Threat hunting assumes that attackers are already present in the environment and tasks analysts with proactively looking for indicators of compromise or unusual behaviours (anomalous logins, unexpected processes, unusual network connections) that automated tools have missed. It requires deep data access, hypothesis-driven investigation, and analyst expertise.

See also: SIEM, Endpoint Detection & Response (EDR), MITRE ATT&CK

Defenses & Controls

Threat intelligence ranges from tactical (IOCs: malicious IP addresses, file hashes, domain names) to strategic (reports on threat actor campaigns and motivations). Commercial feeds, government sharing partnerships (e.g., NCSC, CISA), and industry ISACs provide current intelligence that can be operationalised in SIEM rules, EDR policies, and firewall block lists.

See also: SIEM, Threat Hunting, Threat Feed

Defenses & Controls

Threat modelling (using frameworks like STRIDE, PASTA, or LINDDUN) helps teams systematically identify what assets need protection, who might attack them and how, what controls are in place, and where gaps exist. Running it during system design is far cheaper than retrofitting security after a product is built.

See also: Secure Software Development Lifecycle (SSDLC), Security by Design, Risk Assessment

Infrastructure & Networks

TLS (and its predecessor SSL) establishes an encrypted channel between two communicating parties, protecting data from eavesdropping and tampering in transit. HTTPS uses TLS to secure web traffic. TLS 1.3 (current) improves performance and security over older versions; TLS 1.0 and 1.1 are deprecated. Certificate validity and cipher suite selection are the main configuration choices.

See also: Certificate Authority (CA), Public Key Infrastructure (PKI), Forward Secrecy (PFS)

Threats & Attacks

A traffic distribution system is the routing layer behind many web-based attacks. When someone lands on a compromised or malicious page, the TDS checks details like their country, device, browser, and IP address, then decides where to send them: a malware download, a phishing page, a scam, or a harmless site if they do not fit the target profile. This filtering helps attackers dodge security scanners and show their payload only to likely victims, and it is often rented out as a service between criminal groups. DNS filtering, web filtering, and endpoint protection that inspect where redirects lead are the practical defences.

See also: Drive-By Download, Malware Loader (Dropper), Phishing

Threats & Attacks

A trojan disguises itself as a harmless or useful program to trick users into installing it. Once active, it can steal data, download additional malware, or open a backdoor that lets attackers control the infected system remotely without the user's knowledge.

See also: Malware, Remote Access Trojan (RAT)

Threats & Attacks

Type confusion happens when a program is handed data of one type but handles it as another, for example treating a block of memory as a different kind of object than the one it holds. The mismatch lets an attacker read or write memory the program never meant to expose, and in the worst case redirect execution to run their own code. These bugs are common in web browser engines and other complex software that juggles many object types at speed, and they often lead to remote code execution when a victim does nothing more than view a malicious web page. The flaw lives in how the code handles memory rather than in any input you can filter, so applying the vendor patch promptly is the real fix.

See also: Use-After-Free (UAF), Buffer Overflow, Remote Code Execution (RCE)

Threats & Attacks

Typosquatters register domains that are common misspellings or homoglyphs of popular websites (e.g., 'gooogle.com', 'paypa1.com'). Victims who mistype a URL land on a fake site that harvests credentials, serves malware, or sells counterfeit goods. Brand monitoring services and registering common misspellings of your own domain are both protective measures.

See also: Phishing, DNS Spoofing

Threats & Attacks

A use-after-free vulnerability occurs when a program accesses memory that has already been deallocated. If an attacker can control what data occupies that memory location after the free, they can redirect program execution, escape security sandboxes, or achieve full code execution. UAF bugs are one of the most exploited vulnerability classes in browsers and operating systems, and they are the primary driver behind the industry shift toward memory-safe languages such as Rust. Keeping browsers and operating systems fully patched is the most effective defence for end users.

See also: Remote Code Execution (RCE), Zero-Day Vulnerability, Privilege Escalation

Compliance & Regulation

VRM covers the full vendor lifecycle: security assessment before onboarding, contractual security obligations in MSAs and DPAs, periodic re-assessment during the relationship, and secure offboarding when the contract ends. High-risk vendors, those with privileged access or processing sensitive data, warrant the most intensive scrutiny.

See also: Third-Party Risk Management (TPRM), Data Processing Agreement (DPA), Supply Chain Attack

Threats & Attacks

Vishing (voice phishing) uses phone calls to manipulate victims, often elderly individuals or employees under time pressure, into revealing credentials, authorising payments, or installing remote-access software. Caller-ID spoofing makes the call appear to come from a legitimate number. Never provide credentials or install software in response to an unsolicited call.

See also: Phishing, Pretexting, Social Engineering

Infrastructure & Networks

A VPN encrypts traffic between a user's device and a corporate network (or between two network sites), protecting data from interception on untrusted networks such as public Wi-Fi. Remote-access VPNs are a common way for SMBs to provide secure access for hybrid workers.

See also: Firewall, Zero Trust, Zero Trust Network Access (ZTNA)

Defenses & Controls

Vulnerability scanners (Nessus, Qualys, Rapid7, etc.) probe hosts for unpatched software, misconfigurations, weak credentials, and other known flaws using a regularly-updated database of CVEs. Authenticated scans (with credentials) provide deeper coverage than unauthenticated scans. Results should be triaged by severity and remediated on a defined schedule.

See also: Patch Management, Penetration Testing, Zero-Day Vulnerability

Threats & Attacks

Named after predators that wait near watering holes, these attacks infect websites that the intended victims are known to visit (trade association sites, industry forums, supplier portals), then silently deliver malware to visitors. Keeping browsers and plugins updated and using web filtering limits exposure.

See also: Drive-By Download, Zero-Day Vulnerability

Defenses & Controls

A WAF sits in front of web applications and inspects HTTP requests, blocking attacks such as SQL injection, cross-site scripting, path traversal, and application-layer DDoS. Cloud WAF services (Cloudflare, AWS WAF, Imperva) are cost-effective for SMBs. WAFs complement, but do not replace, secure coding practices.

See also: Intrusion Detection System (IDS), SQL Injection (SQLi), Cross-Site Scripting (XSS)

Threats & Attacks

A web shell is a small program an attacker uploads to a compromised web server, giving them a remote command channel: anyone who knows the right URL can run code on the server without logging in. From there they can read or change files, copy the database, plant more backdoors, inject card-skimming code, or redirect visitors. Web shells are a common goal of attacks against content management systems such as WordPress. File-integrity monitoring, least privilege for the web server process, and server-side malware scans help detect them.

See also: Backdoor, Remote Code Execution (RCE), Formjacking

Threats & Attacks

Wiper malware overwrites or deletes files, master boot records, or storage partitions with the explicit goal of making data unrecoverable, as opposed to ransomware that encrypts data for ransom. Wipers are frequently deployed by nation-state actors in geopolitical conflicts, often following a data-theft campaign, to cause maximum disruption or cover an attacker's tracks. Offline immutable backups are the only reliable defence, since wipers target online storage and connected backup destinations first.

See also: Malware, Ransomware, 3-2-1 Backup Rule

Threats & Attacks

Unlike viruses that require a host file, worms replicate autonomously across networks by exploiting vulnerabilities in operating systems or services. They can spread with extraordinary speed: WannaCry infected 200,000 machines across 150 countries in a single day in 2017. Network segmentation and rapid patching are the primary defences.

See also: Malware, Ransomware, Network Segmentation

Infrastructure & Networks

WPA3 (Wi-Fi Protected Access 3) introduces Simultaneous Authentication of Equals (SAE), replacing the vulnerable WPA2 Pre-Shared Key handshake, which was susceptible to offline dictionary attacks. It also provides forward secrecy per session and a simplified secure onboarding mode for IoT devices. All new Wi-Fi equipment should be configured for WPA3.

See also: Encryption, Evil Twin Attack

Identity & Access

Zero Trust replaces the implicit trust granted to users inside a corporate network perimeter with a 'never trust, always verify' posture. Every access request, regardless of location, is authenticated, authorised, and continuously validated. Core principles: least privilege, micro-segmentation, and strong identity.

See also: Multi-Factor Authentication (MFA), Principle of Least Privilege (PoLP), Conditional Access, Zero Trust Network Access (ZTNA)

Identity & Access

ZTNA replaces broad network VPN access with application-specific tunnels granted only after verifying user identity, device health, and context. Unlike a VPN that puts a user on the network where they can scan for other hosts, ZTNA provides access only to explicitly authorised applications, which sharply reduces the risk of lateral movement.

See also: Zero Trust, VPN (Virtual Private Network), SASE (Secure Access Service Edge)

Threats & Attacks

A zero-day is a security vulnerability in software or hardware that has been discovered by attackers before the vendor is aware of it. Because no patch exists, defenders have 'zero days' to react. Zero-days are highly prized and often sold on criminal markets.

See also: Patch Management, Vulnerability Scanning