Another method of keeping files confidential, as well as secure, is through zero-trust architecture. This eliminates implicit trust throughout an organization with the principle of “never trust, always verify”.

---

Information disclosure can occur through various means, such as website leaks, breaches in access control, software bugs, or misconfigurations, potentially allowing attackers or unauthorized users to gain access to data that was intended to be protected.

The consequences can range from privacy violations and financial harm to reputational damage for individuals and organizations. Effective security measures and robust controls are essential to prevent such leaks and mitigate their impact.

Alteration refers to the unauthorized modification or manipulation of data, which compromises its integrity and accuracy. This can involve changing, deleting, or adding to information in a way that deviates from its original form, rendering it unreliable or incorrect.

Alteration can occur through various means, such as unauthorized access to systems, attacks targeting data storage, or malicious actions within a network. The impact of alteration is significant, as it can lead to erroneous decisions, loss of trust, and potential security risks for organizations or individuals relying on the altered information.

Destruction refers to the act of rendering data or systems inaccessible or permanently irretrievable. Frequently, this is done by either making them unavailable through denial-of-service attacks or by physically or digitally eliminating the data.

Access control ensures that access to physical and digital resources are only granted to users who are authorized to access them. It’s the foundation of data protection, involving setting permissions based on roles and responsibilities within an organization. Different models like mandatory access control (MAC) and role-based access control (RBAC) provide varying levels of security, ensuring that only the correct individuals have access to potentially sensitive information.

Antivirus is a program or software designed to detect and destroy computer viruses. It traditionally relies on a massive list of known threats that it uses as a basis of comparison when monitoring devices – making it no longer effective against modern cyber threats.

Endpoint Detection & Response (EDR) expands on the approach of Antivirus as a technique to identify threats, by monitoring devices for any possible suspicious activity, even if it doesn’t find a match for a known threat.

Related:

Extended Detection & Response goes a step further past EDR and includes additional layers like network and cloud. It also usually includes a Security Information and Event Management (SIEM).

Managed Detection & Response. This is the top level these systems, leveraging a Security Orchestration, Automation, and Response (SOAR) and Security Operation Center (SOC).

Authentication is the process of confirming a user’s identity before granting access to a system. This can be done through methods such as username-password combinations, however multi-factor authentication (MFA) adds an extra layer of security. MFA may involve something the user knows (password), or something they have (a phone for a verification code, or biometric data like fingerprints).

There are 5 stages to AAA:

• Identification – Username
• Authentication – Password / Biometrics
• Authorization – Security permissions
• Auditing – Logging relevant actions that are taken
• Accounting – The act of holding subjects (e.g. users or programs) accountable for their actions

After authentication, authorization determines what actions a user can perform. It assigns permissions to users based on their role within an organization. For example, an employee may be authorized to view certain files but not modify them. RBAC is a common method where access levels are based on job functions, ensuring minimal exposure to sensitive information.

A botnet consists of a network of infected computers controlled remotely by an attacker. These compromised systems are often used for malicious purposes like sending spam, launching DDoS (Distributed Denial of Service) attacks, or spreading malware. Botnets can cause significant disruptions, making them a serious threat to network security.

Brute force and dictionary attacks are common techniques cybercriminals use to crack passwords. In a brute force attack, every possible combination of characters is tried until the correct one is found. A dictionary attack, on the other hand, uses a predefined list of common words or phrases to guess the password more efficiently. Or pre-calculated hashes often referred to as a Rainbow Table, which is a password-cracking tool that utilizes a precomputed table of reversed password hashes to decipher passwords stored in a database.

To prevent both, strong passwords and multi-factor authentication are essential. Here’s an industry best practice:

Best practice is never to transmit passwords in plain text. Instead, we use a one-way mathematical function called hashing.

Hashing is a data security method that transforms data values into distinct, unique identifiers known as hashes, enabling fast and secure access. This technique enhances security by using a one-way process, which makes it impossible to retrieve or alter the original data.

To add to the security of this function, a random set of characters (referred to as salt) is added to the end of the password before hashing.

While cookies are often associated with enhancing user experience on websites, they can also pose security risks. Cookies store information such as login credentials and browsing history, which, if not properly secured, can be exploited by attackers. Proper management and secure storage of cookies are crucial for maintaining privacy and security on the web.

A Denial of Service (DoS) attack aims to disrupt access to a system by overwhelming it with traffic, making it unavailable to legitimate users. A Distributed Denial of Service (DDoS) attack is a more advanced form, where multiple systems are used to flood the target. These attacks can bring down websites or services, causing significant downtime and financial loss.

In its simplest form, encryption refers to storing information in a coded format so that only people who know the code can read it. Encryption is the process of converting data into an unreadable format to prevent unauthorized access. Only users with the correct decryption key can restore the data to its original form. This is crucial for protecting sensitive information in all states, including:

• At rest – While being stored on a server
• In transit – While being sent from one system to another
• In use – While being operated on in memory

Please note that Quantum Computing is likely to render most current encryption standards as insecure and the National Institute of Standards & Technology (NIST) are in the process of defining new Quantum-Resistant Algorithm.

Malware is a general term for any software designed to cause harm to a system. Viruses, worms, trojans, and ransomware are all types of malware. Viruses replicate themselves and spread through systems, often causing damage or stealing information. Worms spread autonomously, while ransomware encrypts data and demands a ransom for its release.

MFA is a login security strategy where an account user is required to have a secondary method of verifying their identity in addition to username and password. Not only do we recommend this as a simple way to improve security, it is now standard for insurers to require this in order to receive coverage.

1. Most secure: Biometric (face, fingerprint, etc)
2. Second most secure: Authenticator app (Duo, Authy, Google, etc)
3. Least secure: Text or email – these are the most easily intercepted by cyber criminals.

Sometimes referred to as an “external penetration test”, this is an experiment to determine if an unauthorized person can access your network, computers, servers, cloud services, email, etc. “Unauthorized” means someone who does not have permission to access your files, email, etc.

The cyber security experts who mimic cyber attacks on an organization’s IT defenses are referred to as the “red team”. They assume the role of malicious attackers, utilizing tools and techniques typically employed by cybercriminals to penetrate the security of the IT system.

There are three types of Penetration Tests:

Black Box – Red Team has no prior knowledge of the systems, usually the most expensive.

Grey Box – Red Team has partial knowledge of the environment.

White Box – Red Team is granted knowledge of the system and can help identify flaws and areas for improvement.

Note: The difference between a Vulnerability Assessment and a Penetration Test is that a vulnerability scan identifies a weakness, a penetration test attempts to exploit that weakness.

Phishing is a social engineering attack where cybercriminals trick users into providing sensitive information, such as login credentials or credit card numbers, by pretending to be legitimate entities. Smishing is a similar tactic, but it uses SMS text messages instead of emails. Both forms of attack exploit trust and can lead to severe consequences if not recognized in time.

Quishing, or QR phishing, is a type of cyber crime that exploits the widespread use of QR codes to deceive individuals into revealing sensitive information or downloading malicious software. In a quishing attack, cyber criminals create counterfeit QR codes that, when scanned, lead to fraudulent websites or prompt harmful downloads. As QR codes are now commonly used for tasks like accessing menus, making payments, or accessing websites, users may unknowingly scan these deceptive codes. This puts their personal and financial data at risk.

The term “quishing” combines QR codes and phishing, indicating an attack where malicious actors use fake QR codes to direct users to spoofed sites, steal information, or install malware on devices. The goal is to steal personal and financial details by tricking users into interacting with seemingly harmless QR codes.

As per the definition of its simplest form, ransomware is software installed by a hacker that encrypts your information so you can no longer read it. The hacker is willing to let you decrypt your information if you pay them (i.e. pay the ransom).

However, it doesn’t end there. Because so many ransomware victims refuse to pay the ransom, hackers have “upped the ante” using extortion. Before encrypting your information, they copy it offsite and threaten to sell or publish your information or harass all of your clients/patients if you don’t pay.

A rootkit is a type of malware designed to hide its presence on a system. Once installed, it allows attackers to maintain privileged access to the system without detection. Rootkits are often used in conjunction with other types of malware to maintain long-term control over compromised systems.

A VPN provides a secure, encrypted connection between a user’s device and a network, making it particularly useful for remote workers. By encrypting internet traffic, a VPN prevents eavesdropping, man-in-the-middle attacks, and other forms of data interception. It’s an essential tool for organizations that want to protect sensitive data accessed outside of a secure office environment.

Vulnerability assessments are a systematic review of security weaknesses. This and penetration tests often get confused. The key difference is that you can pass a penetration test but still have vulnerabilities. Vulnerabilities include anything from out-of-date software and hardware to lack of antivirus protection to inability of your staff to identify fraudulent emails.

A formal document that contains detailed instructions on how to respond to major unplanned, disruptive events. Similar to an IRP, the DR plan goes a step further. What is the company’s plan for recovery after a major disaster were to occur?

Within information security terminology, this is also referred to as IT Resilience Assessments. These are assessments that review business IT practices on how effective their security measures are.

IT and information security overlap but they are distinctly different in how they decrease your cyber risk. IT’s main focus is to implement and maintain systems to ensure your business can be as productive as possible. Information security’s focus is to ensure the information stored in the systems implemented and maintained by IT are protected. Therefore, they need to be effectively aligned to deliver IT resilience through technical controls.

According to the Canadian federal government, “personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:

• age, name, ID numbers, income, ethnic origin, or blood type;
• opinions, evaluations, comments, social status, or disciplinary actions; and
• employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).”

Cyber insurance note: A common question on insurance applications is some form of “How many PII records does your company store?” Higher numbers of PII records generally translates to higher risk for the underwriter. The intent of this question is generally not to determine how many individual pieces of information you have, like birthday, home address, etc.; but for how many people you store such information. For example, if you are a non-residential construction company with 250 current employees, the total number of PII records would be 250 + any information you still have for past employees. On the other hand, if you are a medical clinic with 8,000 patients, the total number of records is 8,000 + current employees + past patients and past employees.

For some industries like healthcare and financial services, strict legislation exists to dictate how information can be handled, stored, and transferred. However, what is often overlooked are the regulations and frameworks that apply to all businesses, regardless of industry. For example:

• PCI – Payment Card Industry compliance
• PIPEDA – Personal Information Protection and Electronic Documents Act
• CASL: Canada Anti-Spam Legislation 

Understanding information security terminology is essential for anyone involved in protecting digital assets from cyber threats. From authentication and access control to botnets, ransomware, and VPNs, these terms are fundamental to building a robust information security strategy. As these threats continue to evolve, staying informed and continually educating yourself and your team about the latest security terminology and strategies, is essential for safeguarding your digital assets.