Security Glossary

This glossary provides definitions for common security and compliance terms used throughout our documentation.

A

Authentication: The process of verifying a user's identity before granting access to systems or data.

Authorization: The process of determining what actions an authenticated user is permitted to perform.

AES-256: Advanced Encryption Standard with a 256-bit key length, a strong encryption algorithm used to protect data.

API (Application Programming Interface): A set of rules that allows different software applications to communicate with each other.

Audit Log: A chronological record of system activities that provides documentary evidence of the sequence of activities.

B

BC/DR (Business Continuity/Disaster Recovery): Strategies and processes designed to help an organization recover from disruptive events.

Backup: A copy of data created as a safeguard against loss or corruption of the original.

C

CCPA (California Consumer Privacy Act): A state statute intended to enhance privacy rights and consumer protection for residents of California.

Cipher: An algorithm for performing encryption or decryption.

Cloud Security: The protection of data, applications, and infrastructure in cloud computing environments.

Compliance: Adherence to laws, regulations, standards, and internal policies.

CSP (Content Security Policy): A security standard that helps prevent cross-site scripting and other code injection attacks.

D

Data Encryption: The process of converting data into a code to prevent unauthorized access.

DDoS (Distributed Denial of Service): An attack where multiple compromised systems attempt to flood a target with traffic.

DPIA (Data Protection Impact Assessment): A process designed to identify and minimize data protection risks.

E

Encryption: The process of converting information into a secure code to prevent unauthorized access.

F

Failover: The process of switching to a redundant system when the primary system fails.

G

GDPR (General Data Protection Regulation): A European Union regulation on data protection and privacy.

I

IAM (Identity and Access Management): Framework of policies and technologies to ensure the right individuals access the right resources.

Incident Response: An organized approach to addressing and managing the aftermath of a security breach.

J

JWT (JSON Web Token): A compact, URL-safe means of representing claims to be transferred between two parties.

K

KMS (Key Management Service): A service that helps create and control the encryption keys used to encrypt data.

L

Least Privilege: The principle of providing users with the minimum levels of access necessary to complete their job functions.

M

MFA (Multi-Factor Authentication): An authentication method requiring two or more verification factors.

N

NIST (National Institute of Standards and Technology): A U.S. government agency that develops technology standards.

P

Penetration Testing: A simulated cyber attack against a system to check for exploitable vulnerabilities.

PII (Personally Identifiable Information): Any data that could potentially identify a specific individual.

R

RBAC (Role-Based Access Control): An approach to restricting system access to authorized users based on roles.

RPO (Recovery Point Objective): The maximum acceptable amount of data loss measured in time after a critical event.

RTO (Recovery Time Objective): The maximum acceptable length of time required to restore normal operations after a critical event.

S

SOC 2: A framework for managing customer data based on five trust service principles.

SSL/TLS: Cryptographic protocols that provide communications security over a computer network.

T

Two-Factor Authentication (2FA): A security process requiring two distinct forms of identification.

V

Vulnerability: A weakness that can be exploited by a threat actor.

Vulnerability Scanning: The process of identifying security vulnerabilities in systems and networks.

X

XSS (Cross-Site Scripting): A type of security vulnerability typically found in web applications.