Glossary

The IronSights Cyber Glossary.

Clear explanations of cyber security terms, frameworks and technologies used across modern businesses.

85Terms defined

AUPlain-English focus

∞Hover anywhere on site

85 terms

Detection & response

Attack Surface ReductionASR

A set of Microsoft Defender for Endpoint rules that block common attack techniques — such as Office macro execution of child processes, credential dumping, and malicious script execution — at the endpoint level.

Read definition

Frameworks & standards

Australian Cyber Security CentreACSC

The Australian government's lead agency for cyber security advice, threat intelligence, and incident reporting, operated by the Australian Signals Directorate.

Read definition

Frameworks & standards

Australian Signals DirectorateASD

Australia's national intelligence and cyber security agency, responsible for foreign signals intelligence, cyber warfare, and protecting Australian government systems from cyber threats.

Read definition

General

Bring Your Own DeviceBYOD

A policy that permits employees to use their personal devices — smartphones, laptops, tablets — to access corporate systems and data, introducing security challenges around device management and data separation.

Read definition

Threats & attacks

Business Email CompromiseBEC

A type of cyber fraud where attackers impersonate or compromise a business email account to redirect payments, steal sensitive information, or commit payroll fraud.

Read definition

Frameworks & standards

CREST

An international not-for-profit body that certifies cyber security service providers and practitioners, particularly in penetration testing and incident response, to globally recognised standards.

Read definition

Threats & attacks

Command and controlC2

Infrastructure used by attackers to communicate with and control malware or compromised systems within a target network, issuing commands and receiving exfiltrated data.

Read definition

Identity & access

Conditional Access

A Microsoft Entra ID feature that enforces context-aware access controls — evaluating signals such as user identity, device compliance, location, and risk level before granting access to corporate resources.

Read definition

Threats & attacks

Credential harvesting

The process of capturing login credentials — usernames and passwords — through phishing sites, malware, data breaches, or other means, typically for use in account takeover or sale on dark web markets.

Read definition

Compliance & governance

Cyber insurance

An insurance product that covers financial losses arising from cyber incidents — including business interruption, ransomware payments, data breach notification costs, legal liability, and regulatory fines.

Read definition

Network & infrastructure

DKIM

An email authentication method that adds a cryptographic digital signature to outgoing emails, allowing receiving mail servers to verify that the message has not been tampered with in transit.

Read definition

Network & infrastructure

DMARC

An email authentication protocol that builds on SPF and DKIM to instruct receiving mail servers how to handle emails that fail sender verification — helping prevent domain spoofing and phishing from your domain.

Read definition

Network & infrastructure

DNS filtering

A network security control that blocks access to malicious, inappropriate, or policy-violating domains at the DNS resolution layer — before a connection to the destination is established.

Read definition

Microsoft 365 & cloud

Data Loss PreventionDLP

A set of policies and controls that detect and prevent sensitive data from being shared, transferred, or accessed in ways that violate organisational security or compliance requirements.

Read definition

Network & infrastructure

Email authentication

A suite of DNS-based protocols — SPF, DKIM, and DMARC — that allow receiving mail servers to verify that an email genuinely originates from the domain it claims to be from.

Read definition

Threats & attacks

Email spoofing

A technique where attackers send email that appears to originate from a legitimate domain by exploiting missing or weak email authentication records (SPF, DKIM, DMARC), enabling phishing, fraud, and impersonation attacks.

Read definition

General

Encryption

The process of converting readable data into an unreadable format using a cryptographic algorithm, ensuring that only authorised parties with the correct decryption key can access the original information.

Read definition

Detection & response

Endpoint Detection and ResponseEDR

A security solution that continuously monitors endpoint activity — processes, network connections, file changes — and provides detection, investigation, and response capabilities for advanced threats that evade traditional antivirus.

Read definition

Identity & access

Entra ID

Microsoft's cloud-based identity and access management platform — formerly Azure Active Directory — used to manage user accounts, enforce authentication policies, and control access to Microsoft 365 and third-party applications.

Read definition

Frameworks & standards

Essential Eight

A set of eight baseline cyber security mitigation strategies published by the ACSC that, when implemented, significantly reduce the risk of the most common cyber threats facing Australian organisations.

Read definition

Microsoft 365 & cloud

Exchange Online

Microsoft's cloud-hosted email and calendar service included in Microsoft 365, providing managed email infrastructure with built-in spam filtering, archiving, and integration with the broader security stack.

Read definition

Detection & response

Extended Detection and ResponseXDR

A security solution that extends endpoint detection to correlate threat data across endpoints, email, identity, and cloud applications, providing a unified view of an attack across the entire environment.

Read definition

Identity & access

FIDO2

An open authentication standard that enables passwordless and phishing-resistant login using hardware security keys, device biometrics, or passkeys stored in the operating system.

Read definition

Compliance & governance

Gap analysis

An assessment that compares an organisation's current security posture against a target framework or standard, identifying the specific controls that are missing, partially implemented, or not meeting required maturity levels.

Read definition

Frameworks & standards

ISO/IEC 27001ISO 27001

The international standard for information security management systems (ISMS), specifying requirements for establishing, implementing, and continuously improving information security controls.

Read definition

Detection & response

Incident responseIR

A structured approach to detecting, containing, eradicating, and recovering from cyber security incidents, including forensic investigation, stakeholder communication, and post-incident review.

Read definition

Frameworks & standards

Information Security Registered Assessors ProgramIRAP

An Australian Signals Directorate program that certifies qualified individuals to assess the security of government systems against the Information Security Manual (ISM).

Read definition

Microsoft 365 & cloud

Insider Risk Management

A Microsoft Purview capability that uses behavioural analytics to detect and investigate risky activities by current or former employees — such as data exfiltration before resignation, policy violations, and security breaches.

Read definition

Threats & attacks

Insider threat

A security risk that originates from within an organisation — a current or former employee, contractor, or business partner who misuses their authorised access, whether intentionally or accidentally.

Read definition

Penetration testing

Kill chain

A model describing the sequential phases of a cyber attack — from initial reconnaissance through to the attacker achieving their objective — used to understand attack progression and identify defensive intervention points.

Read definition

Detection & response

Lateral movement

The technique used by attackers to progressively move through a network after initial compromise, gaining access to additional systems, data, and credentials en route to their ultimate target.

Read definition

Compliance & governance

Legal hold

A directive to preserve all electronically stored information relevant to an anticipated or ongoing legal matter, preventing its deletion or alteration until the hold is lifted.

Read definition

Network & infrastructure

MTA-STS

An email security standard that lets domains publish a policy requiring TLS-encrypted SMTP connections for incoming email, preventing downgrade attacks that could expose email content in transit.

Read definition

Threats & attacks

Malware

Software intentionally designed to cause harm to a computer system, network, or data — including viruses, trojans, ransomware, spyware, and adware.

Read definition

Compliance & governance

Maturity model

A framework for assessing the sophistication and completeness of an organisation's security controls across defined levels, typically from 0 (not implemented) to 3 or 5 (fully optimised).

Read definition

Microsoft 365 & cloud

Microsoft 365M365

Microsoft's cloud-based productivity and security platform, combining Office applications, Exchange email, Teams collaboration, SharePoint, OneDrive, and an integrated suite of security and compliance tools.

Read definition

Microsoft 365 & cloud

Microsoft Autopilot

A cloud-based Windows device provisioning service that configures new devices automatically — joining them to Entra ID, enrolling them in Intune, and applying policies — without manual imaging or IT touch.

Read definition

Compliance & governance

Microsoft Compliance Manager

A Microsoft Purview tool that provides a compliance score for your Microsoft 365 environment, with pre-built assessments mapped to frameworks including ISO 27001, the Essential Eight, and the Privacy Act.

Read definition

Microsoft 365 & cloud

Microsoft Defender for Cloud AppsMCAS

A Cloud Access Security Broker (CASB) that provides visibility over SaaS application usage, detects anomalous behaviour, enforces data governance policies across cloud apps, and controls OAuth application permissions.

Read definition

Microsoft 365 & cloud

Microsoft Defender for Endpoint

Microsoft's enterprise endpoint security platform providing antivirus, endpoint detection and response (EDR), attack surface reduction, and threat and vulnerability management for Windows, macOS, Linux, iOS, and Android devices.

Read definition

Microsoft 365 & cloud

Microsoft Defender for Identity

A Microsoft security product that monitors on-premises Active Directory and Entra ID signals to detect identity-based attacks — including lateral movement, credential theft, and privilege escalation — before they reach critical assets.

Read definition

Microsoft 365 & cloud

Microsoft Defender for Office 365MDO

A Microsoft 365 security product that protects against advanced email threats including phishing, malware, and business email compromise through Safe Links, Safe Attachments, and anti-phishing policies.

Read definition

Microsoft 365 & cloud

Microsoft Intune

Microsoft's cloud-based unified endpoint management platform that enrolls, configures, and enforces compliance policies on Windows, macOS, iOS, and Android devices — both corporate-owned and BYOD.

Read definition

Microsoft 365 & cloud

Microsoft Purview

Microsoft's data governance, compliance, and information protection platform that discovers, classifies, and protects sensitive data across Microsoft 365 environments and connected cloud services.

Read definition

Microsoft 365 & cloud

Microsoft Secure Score

A Microsoft-provided security posture measurement for Microsoft 365 environments, scored from 0–100%, with recommended improvement actions ranked by impact and implementation effort.

Read definition

Microsoft 365 & cloud

Microsoft Sentinel

Microsoft's cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform, built on Azure for scalable log ingestion, threat detection, and automated response.

Read definition

Microsoft 365 & cloud

Microsoft Teams

Microsoft's cloud-based collaboration platform included in Microsoft 365, combining chat, video conferencing, file sharing, and integrated applications for workplace communication.

Read definition

Microsoft 365 & cloud

Microsoft Teams Rooms

Purpose-built hardware systems running a dedicated Microsoft Teams application that turn meeting rooms into managed video conferencing spaces, enrolled in Intune and authenticated against Entra ID.

Read definition

Identity & access

Multi-factor authenticationMFA

A security control that requires users to verify their identity using two or more factors — something they know, something they have, or something they are — before accessing a system or application.

Read definition

Frameworks & standards

NIST Cybersecurity FrameworkNIST CSF

A voluntary US government framework providing a common language and structured approach to managing cyber security risk across five functions: Identify, Protect, Detect, Respond, and Recover.

Read definition

Network & infrastructure

Near Field CommunicationNFC

A short-range wireless communication standard that allows devices to exchange data when held within a few centimetres of each other, commonly used for contactless payments, access cards, and mobile credential authentication.

Read definition

Network & infrastructure

Network Video RecorderNVR

A dedicated device that records and stores video footage from IP cameras on a local hard drive, typically over a standard Ethernet network rather than coaxial cabling.

Read definition

Frameworks & standards

Notifiable Data Breaches schemeNDB

Australian legislation under the Privacy Act 1988 requiring organisations with annual turnover above $3 million to notify the OAIC and affected individuals when a data breach is likely to cause serious harm.

Read definition

Frameworks & standards

Office of the Australian Information CommissionerOAIC

The Australian government agency responsible for administering the Privacy Act 1988 and the Notifiable Data Breaches scheme, and for handling privacy complaints and data breach notifications.

Read definition

Microsoft 365 & cloud

OneDrive for Business

Microsoft's personal cloud storage service for work files included in Microsoft 365, providing per-user storage that syncs to Windows devices and integrates with SharePoint and Microsoft Teams.

Read definition

Network & infrastructure

Open Source IntelligenceOSINT

The practice of collecting and analysing publicly available information — from websites, social media, job postings, public records, and technical data — to build intelligence about a target.

Read definition

Penetration testing

An authorised, simulated cyber attack against an organisation's systems, networks, or applications, conducted to identify vulnerabilities before malicious attackers can exploit them.

Read definition

Compliance & governance

Personally Identifiable InformationPII

Any information that can be used — alone or in combination with other data — to identify a specific individual, including names, email addresses, tax file numbers, health identifiers, and financial account details.

Read definition

Threats & attacks

Phishing

A social engineering attack in which attackers send fraudulent communications — typically emails — designed to trick recipients into revealing credentials, clicking malicious links, or transferring funds.

Read definition

People & awareness

Phishing simulation

A controlled exercise in which security teams send realistic but harmless fake phishing emails to employees to measure click rates, identify vulnerable individuals, and deliver targeted training.

Read definition

Network & infrastructure

Power over EthernetPoE

A standard that allows network switches to deliver electrical power to connected devices — such as IP cameras, access points, and VoIP phones — over the same Cat5e/Cat6 cable used for data.

Read definition

Threats & attacks

Pretexting

A social engineering technique where an attacker fabricates a believable scenario or identity to manipulate a target into providing information, access, or performing an action.

Read definition

Detection & response

Privilege escalation

A technique used by attackers to gain higher levels of system access than initially obtained, moving from a standard user account to administrator or SYSTEM-level privileges.

Read definition

Identity & access

Privileged Access ManagementPAM

A security discipline that controls and monitors access to accounts with elevated permissions, ensuring privileged access is granted only when needed, for the minimum time required, and with full audit trails.

Read definition

Threats & attacks

Ransomware

Malicious software that encrypts a victim's files or systems and demands a ransom payment — typically in cryptocurrency — in exchange for the decryption key.

Read definition

Penetration testing

Reconnaissance

The first phase of a cyber attack or penetration test, in which the attacker or tester gathers information about the target — including infrastructure, staff, technology stack, and potential vulnerabilities — before attempting exploitation.

Read definition

Frameworks & standards

SMB1001

An Australian cyber security certification standard developed specifically for small businesses, providing four tiered certification levels that scale with business size and risk appetite.

Read definition

Network & infrastructure

SPF

An email authentication protocol that specifies which mail servers are authorised to send email on behalf of a domain, allowing receiving servers to reject email from unauthorised sources.

Read definition

Detection & response

Security Information and Event ManagementSIEM

A security platform that aggregates log and event data from across an IT environment, correlates it in real time, and generates alerts when suspicious patterns indicate a potential threat.

Read definition

Detection & response

Security Operations CentreSOC

A centralised function — either internal or outsourced — responsible for continuously monitoring an organisation's security posture, detecting threats, and coordinating incident response.

Read definition

People & awareness

Security awareness training

A program that educates employees about cyber threats, safe behaviours, and organisational security policies — helping them recognise and respond correctly to phishing, social engineering, and other attacks.

Read definition

Microsoft 365 & cloud

Sensitivity labels

Classification tags applied to documents and emails in Microsoft Purview that persist with the content wherever it travels, and can enforce encryption, restrict forwarding, and apply visual markings.

Read definition

Microsoft 365 & cloud

SharePoint Online

Microsoft's cloud-based collaboration and document management platform included in Microsoft 365, used for storing, sharing, and co-authoring files across teams and organisations.

Read definition

Identity & access

Single sign-onSSO

An authentication method that allows users to log in once with a single set of credentials and gain access to multiple applications without re-authenticating for each one.

Read definition

Threats & attacks

Smishing

A phishing attack delivered via SMS text message, typically impersonating parcel delivery services, banks, or government agencies to lure recipients into clicking malicious links.

Read definition

Threats & attacks

Social engineering

The use of psychological manipulation to trick people into divulging confidential information, granting access, or performing actions that compromise security — exploiting human behaviour rather than technical vulnerabilities.

Read definition

Threats & attacks

Spear phishing

A targeted phishing attack tailored to a specific individual or organisation, using research and personalisation to appear more credible and increase the likelihood of success.

Read definition

Threats & attacks

Tailgating

A physical security attack where an unauthorised person gains entry to a secured area by following closely behind an authorised person through an access-controlled door.

Read definition

Detection & response

Threat intelligence

Evidence-based knowledge about existing or emerging cyber threats, including attacker tactics, techniques, procedures, indicators of compromise, and contextual information used to inform defensive decisions.

Read definition

Network & infrastructure

Virtual LANVLAN

A logical partition of a physical network that separates traffic between groups of devices as if they were on entirely separate physical networks, without requiring separate cabling.

Read definition

Threats & attacks

Vishing

A social engineering attack conducted over the phone, where attackers impersonate trusted entities — such as the ATO, Microsoft support, or a bank — to extract sensitive information or gain remote access.

Read definition

Penetration testing

Vulnerability

A weakness in a system, application, or process that could be exploited by an attacker to gain unauthorised access, cause disruption, or achieve other malicious objectives.

Read definition

Frameworks & standards

Zero Trust

A security model that assumes no user, device, or network should be implicitly trusted — requiring continuous verification of identity, device health, and context before granting access to any resource.

Read definition

Threats & attacks

Zero-day vulnerability

A software vulnerability that is unknown to the vendor or has no patch available, leaving systems exposed to exploitation with no vendor-supplied defence.

Read definition

Compliance & governance

eDiscovery

The process of identifying, collecting, preserving, and reviewing electronically stored information (ESI) for use in legal proceedings, regulatory investigations, or internal enquiries.

Read definition