WBCHSE HS Cyber Security key terms

Any software deliberately written to damage, disrupt, or gain unauthorised access to a computer system, including viruses, worms, trojans, ransomware, and spyware.

A social-engineering attack in which a fraudulent message, usually email or SMS, tricks a person into revealing credentials or clicking a malicious link by impersonating a trusted entity.

A targeted phishing attempt crafted for a specific individual or organisation using researched personal details, making the lure far more convincing than a bulk phishing email.

Malicious software that encrypts a victim's files or locks the device and demands payment, usually in cryptocurrency, in exchange for restoring access.

Malware disguised as legitimate or useful software that users install willingly, after which it performs hidden harmful actions such as opening a backdoor.

Self-replicating malware that spreads across networks without user action, exploiting vulnerabilities to infect other machines automatically and often slowing networks dramatically.

Manipulating people through psychological pressure, authority, urgency, or trust so they disclose information or perform actions that compromise security.

An attack that floods a system or network with traffic or malformed requests so that legitimate users cannot access the service.

A DoS attack launched simultaneously from many compromised machines, often a botnet, generating traffic volumes that overwhelm the target's capacity.

A network of compromised devices, called bots or zombies, controlled remotely by an attacker to send spam, spread malware, or mount coordinated attacks.

A unique numerical label assigned to each device on a network so data packets can be addressed and routed to the correct destination.

A 32-bit value that separates the network portion of an IP address from the host portion, allowing devices to decide whether a destination is local or remote.

The Domain Name System translates human-readable domain names into IP addresses, functioning as the internet's distributed directory service.

A hardware or software barrier that inspects network traffic against configured rules and permits or blocks packets to protect internal systems.

A monitoring tool that analyses network or host activity for signs of attack and raises alerts, but does not itself block the traffic it detects.

An encrypted tunnel between a user's device and a remote server that hides traffic from local networks and protects data in transit over untrusted links.

A demilitarised zone is a segmented subnetwork exposing public-facing services such as web servers while isolating them from the protected internal network.

The systematic process of identifying, testing, and applying software updates that close known vulnerabilities before attackers can exploit them.

Endpoint software that scans files and running processes for known malicious patterns or suspicious behaviour and quarantines detected threats.

A security principle giving each user or process only the permissions strictly needed for its task, limiting damage if an account is compromised.

Authentication requiring two or more independent proof types, such as a password plus a one-time code, so a stolen password alone is insufficient to log in.

The reversible transformation of readable data into ciphertext using a key, so that only parties holding the correct key can recover the original content.

A cipher method where the same secret key both encrypts and decrypts data; it is fast and suits bulk data but requires secure key distribution.

A cipher method using a mathematically linked key pair: a public key for encryption and a private key for decryption, solving key-distribution problems.

A one-way mathematical function converting any input into a fixed-length digest; identical inputs always give identical outputs, and small changes alter the digest completely.

A cryptographic value created with a sender's private key that lets recipients verify message integrity and authenticate the signer's identity.

Storing only a salted one-way digest of a password rather than the plaintext, so that a database breach does not directly reveal users' credentials.

A web attack inserting malicious SQL fragments into input fields so the database executes unintended queries, potentially exposing or deleting records.

A web vulnerability where attacker-supplied script is stored or reflected into pages viewed by other users, executing in their browser session.

Checking and sanitising data received from users or systems against expected format, type, and range before processing, blocking many injection attacks.

HTTP carried over TLS, which encrypts browser-server communication and uses certificates to authenticate the site, protecting data from interception.

India's principal cyber law, providing legal recognition for electronic records and digital signatures and defining offences such as unauthorised access and data tampering.

The disciplined collection, preservation, and analysis of digital evidence from devices and networks so findings remain admissible and defensible.

A documented, unbroken record of who handled evidence, when, and how, proving that digital artefacts were not altered between seizure and court presentation.

A structured sequence of preparation, detection, containment, eradication, recovery, and lessons-learned steps used to handle a security breach.

A platform that aggregates logs from many sources, correlates events, and alerts analysts to suspicious patterns across the infrastructure.

Identifying assets and threats, then estimating likelihood and impact of harm, so security effort and spending can be prioritised sensibly.

A weakness in software, configuration, or procedure that an attacker could exploit to compromise confidentiality, integrity, or availability.

A hidden access method deliberately built into software or planted by an attacker that bypasses normal authentication and grants secret entry.

Delivering computing resources such as storage and processing over the internet on demand, shifting responsibility for physical infrastructure to a provider.

Networks of everyday physical devices embedded with sensors and connectivity that collect and exchange data, often with weak default security settings.

A separate copy of data kept so that files can be restored after accidental deletion, hardware failure, or ransomware encryption.