Cybersecurity Glossary

Why owners need this vocabulary

Cybersecurity conversations fail when the owner and the IT provider are speaking different languages. You don't need to configure a firewall yourself, but you do need to understand what you're being sold, what an insurer's questionnaire is asking, and what your obligations are if data is lost. These are the terms that matter most for Australian SMEs.

Protecting access

Authentication

Proving you are who you claim to be before a system lets you in. Passwords are one factor; the problem is they can be stolen or guessed.

MFA (Multi-Factor Authentication)

Requiring a second proof of identity — an app prompt, a code, a hardware key — alongside the password. It's the single highest-value control an SME can switch on, because it defeats most stolen-password attacks outright. Insurers increasingly treat it as non-negotiable.

Zero trust

A design philosophy: never assume something is safe just because it's inside your network. Every user and device must verify itself for every access. For SMEs it mostly translates to: strong identity checks everywhere, least-privilege access, no "trusted office network" shortcuts.

VPN (Virtual Private Network)

An encrypted tunnel between a device and a network, commonly used for remote access to internal systems. Useful, but not a substitute for MFA — a VPN with a stolen password is just an encrypted tunnel for the attacker.

Protecting data

Encryption

Scrambling data so it's unreadable without the right key. "Encrypted at rest" means stored data is protected; "in transit" means data moving over networks is protected. HTTPS — the padlock in your browser — is encryption in transit for websites.

Backup

A separate copy of your data that can be restored after loss, corruption or attack. The details matter: backups should be automatic, stored separately from live systems (so ransomware can't encrypt them too), and tested by actually restoring from them. An untested backup is a hope, not a control.

DLP (Data Loss Prevention)

Tools and rules that stop sensitive data leaving the business inappropriately — for example, blocking a spreadsheet of customer records from being emailed externally.

Threats you'll hear about

Phishing

Fraudulent messages designed to trick staff into revealing credentials or paying false invoices. Business email compromise — where an attacker impersonates a director or supplier to redirect payments — is the version that costs Australian SMEs the most.

Ransomware

Malicious software that encrypts your files and demands payment for the key. Modern variants also steal data first and threaten to publish it. Defences are unglamorous: patching, MFA, and separated, tested backups.

Zero-day

A software flaw the vendor doesn't yet know about, so no fix exists. You can't patch a zero-day, which is why layered defences matter — no single control should be your only line.

Threat

In risk language, anything with the potential to cause harm — an attacker, a careless insider, a natural disaster. Threats meet vulnerabilities to create risk.

Running a defence

Patching

Applying vendors' security updates promptly. Most successful attacks exploit flaws for which a fix already existed. A patching cadence — who patches what, how quickly — is a core part of any security baseline.

Firewall

A gatekeeper that filters network traffic against rules, blocking what shouldn't get through. Present in your router, your operating system and most cloud services; the question for your provider is whether the rules are actually managed.

Essential Eight

The Australian Signals Directorate's prioritised set of eight mitigation strategies — including patching, MFA, backups and restricting admin privileges — with defined maturity levels. It's the standard reference point for "are we doing the basics?" in an Australian context, and the ASD publishes the current model.

SIEM (Security Information and Event Management)

A system that collects logs from across your environment and flags suspicious patterns. More common in larger organisations, but managed versions are increasingly available to SMEs.

Incident response

The prepared plan for when something goes wrong: who's notified, who decides, how systems are isolated and restored, and when regulators or affected individuals must be told. Under Australia's Notifiable Data Breaches scheme, breaches likely to cause serious harm must be reported — the OAIC sets out the current requirements.

From glossary to baseline

Knowing the words is the easy half. The harder half is making sure the basics — MFA, patching, tested backups — are actually in place and stay in place, which is an operations discipline rather than a one-off project. If nobody in the business owns this, that gap itself is the biggest vulnerability.