Google Cybersecurity key terms

A model describing the three goals of information security: confidentiality keeps data private, integrity keeps it accurate and unaltered, and availability keeps it accessible to authorized users when they need it.

An organization's overall ability to defend its systems and data, shaped by its policies, controls, tools, and culture, and by how quickly it can detect and respond to attacks.

Any data that can be used, alone or combined with other details, to identify a specific person, such as a name, Social Security number, home address, or email address.

A voluntary framework from the National Institute of Standards and Technology that organizes cybersecurity work into five functions: identify, protect, detect, respond, and recover.

A safeguard or countermeasure an organization puts in place to reduce risk, such as a firewall, an access policy, encryption, or employee awareness training.

The likelihood that a threat will exploit a vulnerability and cause harm to an asset, usually weighed against the possible impact and the cost of preventing it.

Security information and event management: a tool that collects logs and alerts from many sources, correlates them, and helps analysts spot and investigate suspicious activity.

A documented, step-by-step guide that tells security teams how to respond to a specific kind of incident, such as phishing or malware, so responses stay consistent.

The principle that users and programs should receive only the access they need to do their jobs and no more, which limits damage from mistakes or compromised accounts.

A four-layer framework describing how data moves across networks: network access, internet, transport, and application. Each layer handles a different part of delivering data.

A network security device or program that inspects incoming and outgoing traffic and allows or blocks it based on rules the organization defines.

Virtual private network: a service that encrypts traffic and routes it through a remote server, hiding the user's IP address and protecting data on untrusted networks.

Distributed denial of service: an attack in which many compromised machines flood a target with traffic so that legitimate users cannot reach it.

Capturing and inspecting the data packets traveling across a network. Analysts use it to troubleshoot, while attackers use it to steal unencrypted information.

A program that lets a user interact with an operating system by typing commands, which the shell interprets and passes to the system to run. Bash is a common Linux shell.

A Linux command meaning 'superuser do' that temporarily runs a single command with administrator (root) privileges, usually after the user enters their password.

Linux settings that define who may read, write, or execute a file or directory, expressed separately for the owner, the group, and all other users.

Structured Query Language: a language used to create, read, update, and delete data in relational databases, and a core tool for investigating security events stored in logs.

A statement written in SQL that requests specific information from a database, often using SELECT, FROM, and WHERE to choose columns, tables, and matching rows.

A weakness in a system, application, or process that a threat could exploit to gain access or cause harm; examples include unpatched software and weak passwords.

A tool, script, or technique that takes advantage of a specific vulnerability to gain unauthorized access or to run malicious code on a system.

Software written to harm a system or gain unauthorized access to it, including viruses, worms, trojans, spyware, and ransomware.

Manipulating people into revealing information or taking unsafe actions by exploiting trust, fear, or urgency rather than technical weaknesses in a system.

A social engineering attack that uses fake emails, messages, or websites to trick people into revealing credentials, clicking malicious links, or downloading malware.

Converting readable data into an unreadable form using a key, so that only someone with the correct key can turn it back into plaintext.

Running data through a one-way mathematical function to produce a fixed-length value. Hashes verify integrity because any change to the input produces a different output.

Any person or group that poses a security risk to an organization, ranging from opportunistic criminals to malicious insiders and state-sponsored attackers.

A record of events generated by a system, application, or device, such as logins and errors; analysts use logs to detect, investigate, and reconstruct incidents.

A tool that monitors network or host activity and alerts administrators to suspicious patterns, but does not block the traffic it flags.

A tool that monitors traffic for known attack patterns and actively blocks or drops activity it judges to be malicious.

The staged process for handling a security incident: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. It keeps responses organized and repeatable.

A documented record of who handled evidence, when, and why, from collection through storage and analysis, so the evidence stays trustworthy and usable.

A named, reusable block of code that performs a task and can accept inputs called parameters and return a result; functions keep programs organized and avoid repetition.

A programming structure that repeats a block of code until a condition is met or a collection is exhausted, such as a for loop or a while loop.

Code that runs a block only when a test is true, using if, elif, and else so a program can make decisions and branch between different actions.

An ordered Python collection that holds multiple values in a single variable and can be changed, iterated over, and passed to functions.

A pattern of characters that describes a set of text strings, used to search, match, and extract pieces of data such as IP addresses or usernames from log files.

The impression a professional creates through their skills, values, online presence, and communication, which helps employers and peers understand who they are.

Abilities developed in one setting that apply to another, such as communication, problem solving, and analysis, which candidates highlight when moving into cybersecurity.