RESOURCES / GLOSSARY

The language of cybersecurity, simplified

Plain English explanations of essential cybersecurity concepts. Search by term or description.

12 concepts

XSS

Cross-site scripting

A vulnerability where untrusted input becomes executable browser content. Use safe, context-aware output handling.

SQL injection

Untrusted input changes a query's structure. Parameterized queries keep input separate from query syntax.

Authentication

Establishing a user's identity: who are you?

Authorization

Deciding whether a user may perform a particular action on a particular resource. Enforce it on the server.

MFA

Signing in with independent types of evidence, such as a password and a security key.

Phishing

Deception intended to make someone reveal sensitive information or take a dangerous action.

Least privilege

Give an account only the rights necessary for its tasks.

CSP

Browser policy that restricts content sources and some execution. An additional layer, not a replacement for safe code.

Encryption

Transforming information with a key to protect its confidentiality. Secure key handling matters too.

Hash

A digest derived from data. Password storage needs specialized slow hashing and a unique salt, not a fast general-purpose hash.

Sandbox

An isolated practice or execution environment, separate from real systems and sensitive data.

Responsible disclosure

Privately reporting a weakness to the owner and coordinating its remediation.