IT & Cybersecurity Glossary

Compliance

Contract required under HIPAA between a covered entity and any vendor that will handle protected health information on its behalf. Makes the vendor legally liable for HIPAA compliance.

Security

Targeted scam that impersonates an executive, vendor, or trusted contact to redirect wire transfers or invoice payments to attacker-controlled accounts. Among the most expensive cyber-attack categories per incident.

Network

Global network of cache servers that delivers static content (images, CSS, JavaScript, HTML) from the location closest to each user — speeds up page load and absorbs traffic spikes at the edge.

General IT

Insurance product that covers financial losses from cyber incidents — ransomware, breach response, business interruption, regulatory fines. Underwriting requirements have tightened sharply since 2020.

Security

Security tooling that continuously monitors endpoints (laptops, servers, workstations) for malicious behavior, blocks active threats, and gives responders the forensics they need to investigate after the fact.

Security

Security platform that correlates signals across endpoints, identity, email, network, and cloud — catching attacks that any single layer would miss in isolation.

Compliance

U.S. federal law that sets privacy and security rules for protected health information (PHI). Applies to healthcare providers, health plans, clearinghouses, and any vendor handling their data.

Cloud

Cloud-hosted virtual machines, storage, and networking that you rent by the hour or month — you manage the operating system and applications on top.

Security

EDR or XDR platform plus a 24/7 security operations center (SOC) that monitors alerts, performs threat hunting, and takes containment actions on your behalf.

General IT

A company that proactively manages a client's IT infrastructure and end-user systems for a recurring fee, instead of charging hourly when things break.

Identity & MFA

Login requirement that combines something you know (password) with something you have (phone, hardware key) or are (biometric). Single most effective control for stopping credential-stuffing and phishing attacks.

Network

Network firewall that does more than port-and-IP filtering — it inspects application traffic, decrypts and re-inspects TLS, identifies the user making each request, and blocks based on threat intelligence.

Identity & MFA

Phish-resistant authentication that replaces passwords with cryptographic key pairs stored on your device — Face ID or fingerprint unlocks the local key, the website never sees a shared secret to steal.

Compliance

Security framework that any business handling credit card data must comply with. Set by the major card brands; enforced through banks and payment processors via contract, not government regulation.

Security

Social-engineering attack that impersonates a trusted party (a colleague, vendor, bank, login page) to trick a target into revealing credentials, clicking a malicious link, or wiring money.

Compliance

Any individually identifiable health information held or transmitted by a HIPAA-covered entity or its business associates. The data category at the heart of HIPAA — defining what triggers the law's full scope.

Security

Malware that encrypts a victim's files (and increasingly, exfiltrates them) then demands payment for decryption keys and non-disclosure. The financially defining cyber threat to small and medium business since 2017.

General IT

The two key metrics for backup and disaster recovery planning. RTO is how long you can be down before the business hurts; RPO is how much data you can afford to lose. They drive every backup design decision.

Network

Cloud-delivered networking + security architecture that combines SD-WAN, ZTNA, secure web gateway, CASB, and FWaaS into one platform — designed for remote-first, cloud-heavy businesses.

Security

Centralized log-and-event collection platform that aggregates security data from across the environment and lets analysts query, correlate, and alert on patterns of interest. The power tool of a security operations center.

General IT

Contractual commitment from a service provider that specifies response times, resolution targets, uptime guarantees, and the credits or penalties for missing them.

Identity & MFA

One identity, one login, many applications. Users authenticate once with their corporate identity provider and then access every SSO-integrated app without separate logins.

Cloud

Application delivered over the internet on a subscription, with the vendor handling infrastructure, updates, and maintenance. You log in and use it; you don't install or run anything.

Network

Encrypted tunnel that gives a remote user network-level access to internal resources as if they were physically on the office network. Increasingly being supplanted by ZTNA for security reasons.

Network

Filter that sits in front of a web application and inspects every request — blocking known attack patterns (SQL injection, XSS, file inclusion) before they reach your code.

Network

Access model that verifies every connection request — user, device, application, context — instead of trusting the network it comes from. The successor to "if you're on the VPN, you're trusted".