Glossary#

NIST’s Computer Security Resource Center Glossary is a useful reference for information security terms, acronyms, and organizations.

authentication#: Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system
CIS Controls#: A prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks
common vulnerabilities and exploits#: The generic name for known cybersecurity vulnerabilities that have been catalogued by the CVE program. There is one CVE Record for each vulnerability in the catalog.
Community Defense Model#: A set or real-world analyses used to design, prioritize, implement, and improve an enterprise’s cybersecurity program. See the CDM 2.0 release.
disinformation#: Information deliberately created to mislead, harm, or manipulate a person, social group, organization, or country
domain name system#: The system by which Internet domain names and addresses are tracked and regulated as defined by IETF RFC 1034 and other related RFCs.
encryption#: Any procedure used in cryptography to convert plain text into cipher text to prevent anyone but the intended recipient from reading that data
endpoint detection and response#: Security software that is deployed on workstations and servers, to collect technical data and analyze it for suspicious patterns and threats.
endpoint protection#: Safeguards implemented through software to protect end-user machines such as workstations and laptops against attack (e.g., antivirus, antispyware, anti-adware, personal firewalls, host-based intrusion detection and prevention systems, etc.)
generative artificial intelligence#: a technology that can create images, text, and videos with very little instruction from a user by learning patterns from very large datasets to predict the most likely response to a given prompt
hashing#: The process of using a mathematical algorithm against data to produce a numeric value that is representative of that data
Implementation Group#: The recommended guidance to prioritize implementation of the CIS Critical Security Controls (CIS Controls). They are based on the risk profile and resources an enterprise has available to them to implement the CIS Controls.
malinformation#: Information based on fact, but used out of context to mislead, harm, or manipulate
malicious domain blocking and reporting#: Technology that prevents IT systems from connecting to harmful web domains, helping limit infections related to known malware, ransomware, phishing, and other cyber threats
malware#: Malware is malicious software or software designed to perform malicious actions on a device. It can be introduced to a system in various forms, such as emails or malicious websites.
misinformation#: Information that is false but not created or shared with the intention of causing harm
multi-factor authentication#: An authentication system that requires more than one distinct authentication factor for successful authentication. Multi-factor authentication can be performed using a multi-factor authenticator or by a combination of authenticators that provide different factors. The three authentication factors are something you know, something you have, and something you are.
patching#: The act of applying a change to installed software – such as firmware, operating systems, or applications – that corrects security or functionality problems or adds new capabilities
ransomware#: A type of malware that blocks access to a system, device, or file until a ransom is paid
salting#: A non-secret value used in a cryptographic process, usually to ensure that the results of computations for one instance cannot be reused by an attacker
virtual private network#: Protected information system link utilizing tunneling, security controls, and endpoint address translation giving the impression of a dedicated line