We've got a problem with the cybersecurity terms that we see in industry articles and whitepapers. The language of cybersecurity has become so nuanced and intricate that it's enough to frighten away everyone other than industry insiders. And that's exactly the opposite of what we all need.
A more inclusive discussion around cybersecurity -- one that draws in curious non-experts -- helps spread an understanding of cybersecurity that improves all of our safety. Here are the worst three terms that deserve a place on the "wall of shame" in the cybersecurity dictionary.
1. White Hat / Black Hat
How does your hat (and your hat's color) relate to cybersecurity? It doesn't. But cybersecurity insiders love to talk about hats. Is a particular person a "white hat" or a "black hat"? Here's what the cybersecurity insiders mean, in plain language:
- White Hat: someone who has hacking skills but chooses to use their talent to help organizations and individuals identify and resolve their security weaknesses.
- Black Hat: someone who has hacking skills and chooses to use their talent to discover and exploit vulnerabilities in organizations' and/or individuals' security.
Now you know how to interpret this increasingly-popular term in the cybersecurity vernacular.
2. Honeypot
A honeypot sounds delicious, doesn't it? At the very least, it's intriguing. In the context of cybersecurity terms, a honeypot most often means a server or system set up to attract attention from malicious attackers. The thought process often involves a researcher wanting to understand the attack patterns of malicious hackers. By setting up a legitimate-looking server or system in a way that attracts attention of hackers, the researcher or other individual stands by to observe and study any attacks that arise.
The crucial factor that makes it non-damaging? The person who sets up a honeypot intentionally sets up the system in a way that contains no sensitive or confidential information, so that any attacks that arise are sure to be benign.
3. Red Team / Blue Team
Hear us out on this. If you are a CISO (Chief Information Security Officer) and you want a realistic evaluation of how your systems and personnel would react in the case of an attack, you can hire a team to stage that attack. For real.
When an organization hires a team to stage an attack -- with some agreed-upon parameters to avoid damage -- that hired team is called a "red team". The team that stands ready inside of the organization defending against the attack is called the "blue team". As the red team and blue team go into virtual "battle" on the company's cybersecurity turf (or often on a staging environment mean to resemble the company's infrastructure), the company's leadership stands to learn a lot about the extent to which the company is well-prepared for a genuine attack.
Opaque Cybersecurity Terms: Honorable Mentions
Here are the cybersecurity terms that didn't make the cut for this article, but are candidate's for a future post:
- clickjacking
- rootkit
- spyware
- cryptojacking
- botnet
- trojan horse
- deepfake
- penetration testing.
Do any of these cybersecurity terms confuse you? Any other cybersecurity terms that leave you uncertain? Drop us a line, we'd love to include your questions or concerns in a future article on this site.
