ICDL IT Security key terms

A security principle ensuring that information is only seen by people who are authorised to access it, and is not disclosed to anyone else.

A security principle meaning data stays complete and unaltered, and is only changed by authorised people or processes in approved ways.

A security principle ensuring systems and data can be reached and used by authorised users whenever they are needed, including during failures or attacks.

The process of proving that a user, device, or system is genuinely who or what it claims to be before access is granted.

The step after authentication that decides which resources and actions a verified user is permitted to use, based on assigned rights or roles.

A login method that requires two or more different kinds of proof, such as a password plus a code sent to a phone, making unauthorised access harder.

A secret string of characters a user enters to prove identity; it should be long, hard to guess, unique per account, and never shared.

A tool that stores and fills in login credentials securely, so users can keep strong, different passwords for every account without memorising them.

The set of rules and mechanisms that determine who may view, change, or use a resource, and under what conditions.

A rule that each user or program should be given only the minimum access rights needed to do its job, limiting damage if accounts are misused or compromised.

Settings attached to files, folders, or accounts that specify what actions a particular user or group is allowed to perform on them.

The process of scrambling data using a key so that it cannot be read by anyone who does not hold the correct key to unscramble it.

The reverse of encryption: turning scrambled data back into readable form using the correct key or password.

A copy of data kept in a separate location so that files can be restored if they are lost, damaged, or locked by malware.

Any software deliberately designed to harm, disrupt, or gain unauthorised access to a computer system, including viruses, worms, trojans, and spyware.

A type of malicious program that attaches itself to a legitimate file and spreads when that file is opened or run, often damaging data.

Self-replicating malware that spreads across networks on its own, without needing a host file or user action, often slowing systems down.

Malicious software disguised as something useful or legitimate, which tricks the user into installing it and then performs hidden harmful actions.

Malware that encrypts a victim's files or locks a device and demands payment to restore access, often with no guarantee of recovery.

Software that secretly monitors a user's activity and collects information such as keystrokes, browsing habits, or login details without consent.

A program or device that covertly records every keystroke a user types, often to capture passwords and other sensitive information.

A trick in which attackers send fake messages that appear to come from a trusted source to persuade people to reveal passwords or click harmful links.

A targeted form of phishing aimed at a specific person or organisation, using personal details to make the fraudulent message more convincing.

Manipulating people through deception or pressure, rather than technical means, to get them to disclose information or perform unsafe actions.

A program that scans files and activity for known malicious patterns, blocks or removes threats, and should be kept updated with current signature lists.

A barrier that filters incoming and outgoing network traffic according to set rules, blocking connections that are not explicitly allowed.

A service that creates an encrypted tunnel between a device and a remote server, hiding traffic from local networks and masking the user's address.

A wireless network in a shared space, such as a café or airport, that is often unsecured and should not be trusted with sensitive logins unless protected.

Two or more devices connected so they can exchange data, ranging from a small home setup to the global internet.

An attack that floods a system or network with traffic or requests so that legitimate users can no longer access the service.

An electronic document issued by a trusted authority that confirms the identity of a website or party and supports encrypted, verified connections.

A released fix or improvement for software that often closes security holes; installing updates promptly reduces the risk of known attacks.

A small piece of software applied to an existing program to correct a fault or close a security vulnerability without reinstalling the whole product.

A value calculated from data and used to detect accidental changes or corruption, helping confirm that a file arrived intact.

The practices and legal rules for handling personal information safely, fairly, and only for stated purposes, respecting the rights of the people it describes.

Any information that can identify a living individual, such as a name, address, phone number, or account details, which must be handled responsibly.

Permanently removing data from devices before selling, recycling, or discarding them, so that previous files cannot be recovered by someone else.