Fundamentals Security Terminology
Every field speaks its own language. Cybersecurity relies on a small set of words that appear in news reports, job descriptions, and tutorials. Learning these words early makes every later topic easier to follow.
Core Words Explained with a House
Imagine a family home. The house, the furniture, and the family photos hold value. A broken window latch offers a way inside, and burglars hunt for exactly that kind of weakness. Each part of this picture matches a security term.
| Term | Meaning | House Example |
|---|---|---|
| Asset | Anything valuable that needs protection | Furniture, photos, cash |
| Vulnerability | A weakness that attackers can use | A broken window latch |
| Threat | Anything that can cause harm | A burglar in the neighborhood |
| Threat Actor | The person or group behind a threat | The burglar |
| Exploit | A method that takes advantage of a weakness | Sliding a tool under the latch |
| Attack | An attempt to cause harm | The break-in itself |
| Risk | The chance of loss combined with its impact | Likelihood of a break-in and the value of stolen items |
| Control | A safeguard that lowers risk | Lock, alarm, camera |
| Incident | A security event that causes harm or nearly does | The alarm rings after a forced window |
| Patch | A fix for a known weakness | Replacing the broken latch |
How the Terms Connect
The terms form a chain. A threat actor builds or finds an exploit. The exploit targets a vulnerability, which sits on an asset. Damage to the asset creates loss. Controls break the chain at any link.
+--------------+ +---------+ +---------------+ +---------+
| Threat Actor | --> | Exploit | --> | Vulnerability | --> | Asset |
+--------------+ +---------+ +---------------+ +---------+
^
|
Controls block the chain here
(patch, firewall, strong password)
Types of Threat Actors
- Black hat hackers break into systems for money or damage.
- White hat hackers test systems with written permission and report weaknesses.
- Gray hat hackers probe systems without permission but claim good intentions.
- Script kiddies run ready-made tools without deep technical skill.
- Hacktivists attack systems to promote a social or political message.
- Insiders misuse access that an organization already gave them.
- Nation-state groups work for governments and target other countries.
Words About Defense
Authentication
Authentication proves identity. A password, a fingerprint, or a code sent to a phone all serve this purpose.
Authorization
Authorization decides what a verified person may do. A student may read a lesson page, while a teacher may edit it.
Encryption
Encryption scrambles data so that only people with the right key can read it.
Backup
A backup stores a spare copy of data. Recovery from a failure becomes possible when the copy exists.
Firewall
A firewall filters network traffic according to rules. It works like a guard who checks every visitor at a gate.
Practice Scenario
A school runs its website on outdated software. Scanning the internet, a criminal group spots the old version. A known flaw in that version lets the group read student records. Match each term to the story:
- The asset is the student records.
- The vulnerability is the outdated software.
- The threat actor is the criminal group.
- The exploit is the known flaw in the old version.
- The control that would have helped is a timely patch.
- The incident is the moment the group reads the records.
Key Points
- Assets are the things worth protecting.
- Vulnerabilities are weaknesses, and threats are dangers that use them.
- Risk measures how likely and how costly a loss could be.
- Controls reduce risk, and patches remove known weaknesses.
- Clear vocabulary helps teams respond quickly during an incident.