[{"data":1,"prerenderedAt":735},["ShallowReactive",2],{"publication:en:P128":3},{"meta":4,"copy":17,"relatedArticles":359,"terms":360,"term":730,"resourceParent":731,"glossaryParent":734},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16},"P128","\u002Fglossary","glossary","cybersecurity glossary for small businesses","Cybersecurity glossary for small businesses: terms you can use","Cybersecurity glossary for small businesses","Cybersecurity definitions with practical limits and next steps. Explore DMARC, MFA and WAF from an Israeli company serving businesses worldwide.",[13,14,15],"\u002F","\u002Fabout","\u002Fblog\u002Fwhat-is-cyber-security-small-business-guide","2026-10-30",{"intro":18,"sections":19,"checklistTitle":207,"checklist":208,"faq":214,"sources":224,"links":330,"cta":354},"This cybersecurity glossary explains terms that business owners encounter when protecting websites, email and accounts. Each published entry connects a plain-English definition to a practical decision, evidence and limits. CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide; the glossary focuses on understanding the systems you already use rather than collecting technical acronyms.",[20,25,187,192,197,202],{"title":21,"paragraphs":22},"Start with the question your business needs to answer",[23,24],"A term is useful when it clarifies an action. If messages appear to use your domain, DMARC helps explain one part of authentication. If a supplier proposes MFA, ask which people and systems it covers and how recovery works. If a website uses a WAF, identify the requests that pass through it and who investigates a legitimate action being blocked.","The glossary is intentionally selective. The search below covers the English entries actually published here. It does not claim that every cybersecurity concept has an independent page or that a definition is sufficient to configure a production system. Use the related guides for a workflow and the service pages when you need to agree work, access and acceptance.",{"title":26,"paragraphs":27,"table":36},"Choose the control by the business question",[28,29,30,31,32,33,34,35],"The published entries cover email-domain authentication, account authentication, web-request filtering and backup\u002Frecovery decisions. SPF, DKIM and DMARC explain different parts of the email path. MFA concerns account access; WAF concerns protected web requests. Backup, immutability, RTO and RPO explain different requirements and boundaries of recovery. Each has its own evidence and limits. Least privilege concerns permitted actions; passkeys concern a sign-in credential; a password manager concerns stored credentials and their ownership. Understanding those boundaries helps connect authentication, authorization and recovery without treating them as the same control. DNS locates service information; DNSSEC validates signed DNS data; HTTPS protects a connection; HSTS describes remembered browser policy. These entries distinguish registration, resolution, transport and application protection so a setting is connected to the question it actually answers.","Read the definition together with its limitations and example. Each entry identifies what observation would support a conclusion and what still needs a separate check. This avoids treating a familiar product or acronym as a guarantee, while making it easier for an owner and supplier to discuss the same scope.","Application weaknesses need their own questions. A plugin advisory concerns a particular component and conditions; XSS concerns browser rendering; CSRF concerns unwanted requests; SQL injection concerns database query construction. The definitions separate those boundaries from supporting headers and traffic filters, then connect them to an authorized review or a practical guide.","Vulnerability decisions also need a shared reference and an evidence boundary. CVE identifies the record; CVSS communicates technical severity; zero-day terminology depends on the knowledge and fix timeline; vulnerability scanning describes scoped automated checks. None alone proves local compromise or complete safety. Use the connected guides to assign priorities, review evidence and prepare incident decisions.","Phishing and business email compromise connect technical controls to the actions people are asked to authorize. Phishing explains digital deception across channels; BEC focuses on abused business trust and sensitive instructions. The related guides cover message checks, supplier changes, QR requests, voice verification, post-click response and a safe team rehearsal. A suspicious request alone does not establish a mailbox takeover or identify how an impersonation was produced.","Website incidents also need a shared vocabulary for harmful code, hidden access and information impact. Malware describes harmful or unauthorized code; a backdoor concerns an undocumented access route; ransomware raises separate encryption, control and confidentiality questions; a data breach needs evidence about exposure, access and extraction. These definitions support the incident guides without turning a symptom or a clean scan into a complete conclusion.","Security boundaries also depend on where a control operates. SSRF concerns requests made by the server; CSP governs selected browser behavior; hardening connects the system configuration to an owned baseline; a firewall enforces traffic policy along an actual path. The infrastructure guides connect these ideas to Linux, SSH, Docker and provider responsibilities without treating one setting or product label as complete protection.","Resource access and recovery also need explicit ownership. Zero Trust explains why network location alone is not permission for a business action. The 3-2-1 backup rule describes copy, media and location separation without proving usable recovery. The connected guides map assets, supplier access, remote workflows, application consistency, retained history and mailbox coverage so these principles lead to owned checks rather than product labels.",{"caption":37,"headers":38,"rows":42},"Choose the entry by the business question",[39,40,41],"Entry","Useful question","Separate question to keep visible",[43,47,51,55,59,63,67,71,75,79,83,87,91,95,99,103,107,111,115,119,123,127,131,135,139,143,147,151,155,159,163,167,171,175,179,183],[44,45,46],"SPF","Which SMTP identity and sending route were evaluated?","Does that identity align with the visible From domain?",[48,49,50],"DKIM","Which signing domain and signature did the receiver verify?","Is signing active for the intended business source?",[52,53,54],"DMARC","How is use of the visible email domain evaluated?","Was the mailbox or payment request legitimate?",[56,57,58],"MFA","Which factors and access paths are actually enforced?","Can the business recover access safely?",[60,61,62],"WAF","Which web requests are evaluated by the control?","Has the application or account weakness been repaired?",[64,65,66],"Backup","What data and function can the copy help recover?","Was the required restoration actually tested?",[68,69,70],"Immutable backup","Which changes does the policy restrict?","Is the protected copy suitable and accessible?",[72,73,74],"RTO","What recovery time target applies to the defined service?","Which stages and dependencies were actually measured?",[76,77,78],"RPO","To which consistent data point must recovery return?","Does the copy contain that point and the required records?",[80,81,82],"Least privilege","Which action, scope and duration does the job require?","Is the identity also protected at sign-in?",[84,85,86],"Passkey","Which credential and verification model is used?","Who controls its provider, replacement and recovery?",[88,89,90],"Password manager","Who can access and recover the credential vault?","Which copied secrets and underlying accounts still need action?",[92,93,94],"DNS","Where are the active records and who owns them?","Do the website, email and dependent services work?",[96,97,98],"DNSSEC","Does the signed data validate through the intended chain?","Are account ownership and application controls appropriate?",[100,101,102],"HTTPS","Which connection and certificate checks passed?","Is the operator trustworthy and the application secure?",[104,105,106],"HSTS","Which HTTPS-only browser policy covers the host?","Are covered subdomains, certificates and recovery ready?",[108,109,110],"WordPress plugin vulnerability","Does the exact component and reported condition apply?","Is there evidence of exposure or actual compromise?",[112,113,114],"XSS","Where can untrusted content become browser behavior?","Is the relevant rendering path corrected?",[116,117,118],"CSRF","How is the authenticated request’s legitimacy checked?","Is the identity separately authorized for the action?",[120,121,122],"SQL injection","Are query structure and data kept separate?","Are dynamic choices and database privileges appropriate?",[124,125,126],"CVE","Which current record and component does the identifier describe?","Does the installed version and condition actually match?",[128,129,130],"CVSS","Which version, vector and source support the severity assessment?","What exposure and business context determine action?",[132,133,134],"Zero-day vulnerability","What was known and which fix existed at the relevant time?","What is the installation’s current state and evidence?",[136,137,138],"Vulnerability scanning","Which targets, checks and access were actually covered?","Were findings validated and corrections accepted?",[140,141,142],"Phishing","What action does the digital message ask someone to take?","Can that action be verified through a known independent route?",[144,145,146],"BEC","Which business instruction or payment detail is being changed?","Who independently verifies the change and authorizes release?",[148,149,150],"Malware","Which harmful or unauthorized code or behavior was established?","What finding, scope and evidence support the conclusion?",[152,153,154],"Backdoor","Which undocumented access route or persistence was found?","Was the route closed and the relevant entry condition addressed?",[156,157,158],"Ransomware","Which assets are encrypted or affected by extortion?","Are availability, access and information impact reviewed separately?",[160,161,162],"Data breach","What is known about exposure, access and extraction?","Which facts and jurisdiction assessment support organizational decisions?",[164,165,166],"SSRF","Which server-side request and destination are actually permitted?","Do application and network checks govern the real connection?",[168,169,170],"CSP","Which browser policy is delivered and is it enforced?","Were required resources and business functions accepted?",[172,173,174],"Hardening","What configuration reduces unnecessary exposure?","Who owns the baseline, exceptions and future changes?",[176,177,178],"Firewall","Which traffic policy is enforced at which point?","Does actual reachability match the intended path?",[180,181,182],"Zero Trust","Which identity, device context and resource action are authorized?","Where is the decision actually enforced and maintained?",[184,185,186],"3-2-1 backup rule","Which original and backup copies have media\u002Flocation separation?","What shared access, history and restoration limits remain?",{"title":188,"paragraphs":189},"How to use an entry with your current supplier",[190,191],"Write down the system and action first, then ask the supplier to explain how the term applies there. A useful answer names the control, its location, the accounts or traffic it covers and the evidence that it is active. Ask what is excluded and who owns follow-up when the business introduces a new connection.","You do not need to memorize the terminology. Keep a short record of the agreed result: which sender should authenticate, which role should be challenged or which request should remain allowed. If the answer requires a change, agree authority, testing and a recovery route before carrying it out. A definition is preparation for that conversation, not permission to experiment.",{"title":193,"paragraphs":194},"Definitions, guides and services have different purposes",[195,196],"A glossary entry explains a concept and its boundaries. A guide walks through a particular diagnostic or planning task. A service page explains work that can be scoped with CyberFixCrew. These pages link to one another where the relationship helps the reader, but do not make a definition compete with every implementation question.","For example, understanding DMARC alignment is different from mapping all billing and website senders before enforcement. Understanding MFA is different from migrating staff without locking them out. Understanding WAF filtering is different from investigating a checkout false positive. When the implementation depends on a provider, use that provider's current documentation as well.",{"title":198,"paragraphs":199},"Sources, examples and updates",[200,201],"The entries cite relevant standards bodies or product documentation and distinguish the standard from a provider's implementation. Examples are labeled and do not become claims about a customer. A revision date identifies the entry's recorded content update; it is not a promise that the underlying product has stayed unchanged since then.","Our methodology page explains the difference between a source-based explanation, an original decision framework and a local experiment. A documented limitation is part of a useful definition. If evidence is unavailable, the page should leave the uncertainty visible instead of filling it with a score, invented measurement or unsupported guarantee.",{"title":203,"paragraphs":204},"Using the glossary across countries and systems",[205,206],"CyberFixCrew's Israeli company identity and website\u002Fdigital-infrastructure specialization inform the topics we choose for worldwide business readers. The technical concepts can be relevant across countries, but a definition is not a universal compliance ruling. Legal duties, contractual requirements, service editions and available features need their own checks.","For help with an unfamiliar term, describe the business task and the system involved without sending credentials or customer data. We can clarify whether the question is definitional, a configuration task or a current incident, and what scope would be useful. Remote work and availability are agreed separately.","Use a definition to make a clearer decision",[209,210,211,212,213],"Identify the system and business action behind the term.","Read the scope and limitations, not only the acronym expansion.","Ask for evidence that the control applies to the relevant path.","Use a guide for a workflow and agree authority before changes.","Keep provider-specific and legal requirements separate.",[215,218,221],{"question":216,"answer":217},"Does the glossary contain every cybersecurity term?","No, it contains the reviewed English entries available in the search below. Broader research is a pool for future editorial decisions, not a claim that every concept needs a separate indexed page.",{"question":219,"answer":220},"Can I use the definitions as an implementation checklist?","Use them to understand the control and prepare questions. Production configuration needs the actual provider documentation, appropriate access and a test plan for the relevant system.",{"question":222,"answer":223},"Why do the entries discuss what a control cannot prove?","It helps distinguish a useful observation from a broader conclusion. That difference matters when deciding whether an email, account or website still needs another check.",[225,228,231,234,237,240,243,246,249,252,255,258,261,264,267,270,273,276,279,282,285,288,291,294,297,300,303,306,309,312,315,318,321,324,327],{"label":226,"url":227},"RFC 9989: DMARC, May 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9989.html",{"label":229,"url":230},"NIST SP 800-63B-4: authentication methods and factors","https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b\u002Fauthenticators\u002F",{"label":232,"url":233},"Cloudflare: WAF concepts and request filtering","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Fconcepts\u002F",{"label":235,"url":236},"RFC 7208: Sender Policy Framework","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7208.html",{"label":238,"url":239},"RFC 6376: DKIM signatures and selectors","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6376.html",{"label":241,"url":242},"NIST SP 800-209 (2020): storage isolation and restoration assurance","https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002FSpecialPublications\u002FNIST.SP.800-209.pdf",{"label":244,"url":245},"NCSC: backing up data for small organisations","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fsmall-organisations-guide-to-cyber-security\u002Fbacking-up-your-data",{"label":247,"url":248},"AWS S3: Object Lock, protected versions and retention modes","https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fobject-lock.html",{"label":250,"url":251},"Microsoft Entra: least privilege, role scope and review","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fbest-practices",{"label":253,"url":254},"FIDO Alliance: passkeys and passwordless authentication","https:\u002F\u002Ffidoalliance.org\u002Fpasskeys\u002F",{"label":256,"url":257},"NCSC UK: password manager buyers guide","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fpasswords\u002Fpassword-manager-buyers-guide",{"label":259,"url":260},"MDN: Domain Name System","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FGlossary\u002FDNS",{"label":262,"url":263},"RFC 4033: DNSSEC authentication, integrity and limits","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc4033.html",{"label":265,"url":266},"MDN: HTTPS and transport encryption","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FGlossary\u002FHTTPS",{"label":268,"url":269},"MDN: HSTS behavior, scope, expiration and preload","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FReference\u002FHeaders\u002FStrict-Transport-Security",{"label":271,"url":272},"WordPress: plugin management, updates and removal","https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Farticle\u002Fmanage-plugins\u002F",{"label":274,"url":275},"OWASP: context-aware cross-site scripting prevention","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross_Site_Scripting_Prevention_Cheat_Sheet.html",{"label":277,"url":278},"OWASP: CSRF tokens, browser behavior and defense boundaries","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross-Site_Request_Forgery_Prevention_Cheat_Sheet.html",{"label":280,"url":281},"OWASP: SQL query parameterization and least privilege","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FSQL_Injection_Prevention_Cheat_Sheet.html",{"label":283,"url":284},"CVE Program: official CVE List and record context","https:\u002F\u002Fgithub.com\u002FCVEProject\u002FcvelistV5",{"label":286,"url":287},"FIRST: CVSS v4.0 characteristics, vectors and severity limits","https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fv4.0\u002Ffaq",{"label":289,"url":290},"NIST glossary: zero-day attack and source context","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fzero_day_attack",{"label":292,"url":293},"NIST SP 800-115 (2008): assessment scope, validation and limitations","https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002FLegacy\u002FSP\u002Fnistspecialpublication800-115.pdf",{"label":295,"url":296},"SingCERT (2025): phishing signs, reporting and exposure response","https:\u002F\u002Fwww.csa.gov.sg\u002Fresources\u002Fsingcert\u002Freport-a-phishing-email\u002F",{"label":298,"url":299},"FBI: business email compromise and independent payment verification","https:\u002F\u002Fwww.fbi.gov\u002Fhow-we-can-help-you\u002Fcommon-frauds-and-scams\u002Fbusiness-email-compromise",{"label":301,"url":302},"NIST glossary: malware definitions and source context","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fmalware",{"label":304,"url":305},"NIST glossary: backdoor definitions and source context","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fbackdoor",{"label":307,"url":308},"UK NCSC: ransomware, encryption and data-theft threats","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fransomware\u002Fhome",{"label":310,"url":311},"NIST glossary: breach terminology in its PII context","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fbreach",{"label":313,"url":314},"OWASP: SSRF prevention, destination checks and network controls","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FServer_Side_Request_Forgery_Prevention_Cheat_Sheet.html",{"label":316,"url":317},"MDN: Content Security Policy, reporting and enforcement","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FGuides\u002FCSP",{"label":319,"url":320},"NIST glossary: hardening and source context","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Fhardening",{"label":322,"url":323},"NIST glossary: firewall and local traffic policy","https:\u002F\u002Fcsrc.nist.gov\u002Fglossary\u002Fterm\u002Ffirewall",{"label":325,"url":326},"NIST SP 800-207 (2020): Zero Trust resource and access principles","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F207\u002Ffinal",{"label":328,"url":329},"Netherlands NCSC: 3-2-1 backup copies, media and location","https:\u002F\u002Fwww.ncsc.nl\u002Fen\u002Fbackup\u002Fall-about-good-backups",[331,334,337,340,343,346,349,352],{"path":332,"label":333},"\u002Fglossary\u002Fdmarc","DMARC: domain alignment and policy",{"path":335,"label":336},"\u002Fglossary\u002Fspf","SPF: SMTP identities and sending authorization",{"path":338,"label":339},"\u002Fglossary\u002Fdkim","DKIM: signatures, selectors and verification",{"path":341,"label":342},"\u002Fglossary\u002Fmfa","MFA: factors and recovery",{"path":344,"label":345},"\u002Fglossary\u002Fwaf","WAF: filtering scope and limitations",{"path":347,"label":348},"\u002Fresearch\u002Fmethodology","How we handle sources and evidence",{"path":350,"label":351},"\u002Fblog\u002Fbusiness-recovery-plan","Plan recovery around the business workflow",{"path":14,"label":353},"About the Israeli company and its specialization",{"title":355,"description":356,"button":357,"type":358},"Connect a security term to the system you use","Tell us the task and the platform. We will clarify the question before discussing any work.","Ask about a practical security question","other",[],[361,369,380,390,401,412,422,432,442,452,462,471,481,492,502,512,523,533,544,555,565,576,587,597,607,617,627,637,647,657,667,678,689,700,710,720],{"id":362,"path":332,"title":363,"keyword":364,"intro":365,"name":52,"aliases":366},"P165","What is DMARC? Alignment, policy and what it cannot prove","what is DMARC","DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It connects the domain in an email's visible From address to a passing, aligned SPF or DKIM result and lets the domain owner publish a handling policy. DMARC is not encryption, a guarantee of inbox delivery or proof that a genuine account has not been compromised.",[367,368],"Domain-based Message Authentication, Reporting, and Conformance","email alignment",{"id":370,"path":341,"title":371,"keyword":372,"intro":373,"name":374,"aliases":375},"P140","What is MFA? Authentication factors, phishing resistance and recovery","what is MFA","MFA, or multi-factor authentication, requires proof from more than one distinct authentication factor: something you know, possess or are. It helps protect accounts when a password is exposed, but the method, enforcement and recovery paths determine the practical protection. Two passwords are not two factors, and an enabled setting does not prove that every business account or sign-in route is covered.","Multi-Factor Authentication (MFA)",[376,377,378,379],"multi factor authentication","2FA","two-factor authentication","passkeys",{"id":381,"path":344,"title":382,"keyword":383,"intro":384,"name":385,"aliases":386},"P157","What is a web application firewall? WAF scope and limits","what is a web application firewall","A web application firewall, or WAF, inspects web traffic and applies rules to requests reaching an application through the protected path. It can help filter malicious HTTP requests and reduce exposure to some application attacks. Its value depends on traffic coverage, rule configuration and monitoring; it does not repair vulnerable code, remove a compromise or protect every network service.","Web Application Firewall (WAF)",[387,388,389],"HTTP filtering","application firewall","false positives",{"id":391,"path":335,"title":392,"keyword":393,"intro":394,"name":395,"aliases":396},"P163","What is SPF? Sending authorization, identities and limits","what is SPF","SPF, or Sender Policy Framework, lets a domain publish which hosts may use that domain in the SMTP sending identity. The receiver checks the connecting source against the relevant policy. SPF does not authenticate a person, encrypt the message or by itself validate the visible From address. To interpret a result, identify the domain and sending route that were actually evaluated.","Sender Policy Framework (SPF)",[397,398,399,400],"sender policy framework","SMTP identity","envelope sender","MAIL FROM",{"id":402,"path":338,"title":403,"keyword":404,"intro":405,"name":406,"aliases":407},"P164","What is DKIM? Signatures, selectors and what a pass establishes","what is DKIM","DKIM, or DomainKeys Identified Mail, adds a cryptographic signature associated with a signing domain to an email. A receiver can retrieve the public key using the signature's domain and selector and verify the covered content under the signing rules. DKIM is not message encryption, proof of a named person's identity or a guarantee that an authenticated message is honest or reaches the inbox.","DomainKeys Identified Mail (DKIM)",[408,409,410,411],"domainkeys identified mail","DKIM signature","DKIM selector","public signing key",{"id":413,"path":414,"title":415,"keyword":416,"intro":417,"name":64,"aliases":418},"P167","\u002Fglossary\u002Fbackup","What is a backup? Recovery copies, coverage and verification","what is a backup","A backup is a retained copy of data intended to support recovery after loss, damage or an unwanted change. Its usefulness depends on what it contains, which earlier states remain available, who can access it and whether the business can restore the needed function. A file in storage or a successful backup job is evidence of one stage, not proof of complete recovery.",[419,420,421],"data backup","backup copy","recovery copy",{"id":423,"path":424,"title":425,"keyword":426,"intro":427,"name":68,"aliases":428},"P168","\u002Fglossary\u002Fimmutable-backup","What is immutable backup? Retention protection and its limits","what is immutable backup","An immutable backup uses a configured control that restricts changes to protected recovery data, such as deletion or overwriting during a retention period. The protection depends on the provider, protected objects or versions, policy state and privileged permissions. Immutability does not by itself prove that the copy is clean, offline, complete or recoverable with the access and keys the business still has.",[429,430,431],"WORM","write once read many","retention lock",{"id":433,"path":434,"title":435,"keyword":436,"intro":437,"name":438,"aliases":439},"P170","\u002Fglossary\u002Frto","What is RTO? Define and test the recovery time objective","what is RTO","RTO, or Recovery Time Objective, is the target limit for restoring a defined system resource or service before its unavailability causes an unacceptable impact. It is a planning objective, not a measured restore result or an automatic contractual guarantee. To use RTO meaningfully, specify the system, clock boundary, dependencies and acceptance condition that determine when the required recovery is complete.","Recovery Time Objective (RTO)",[440,441],"recovery time objective","restoration timeframe",{"id":443,"path":444,"title":445,"keyword":446,"intro":447,"name":448,"aliases":449},"P171","\u002Fglossary\u002Frpo","What is RPO? Recovery points and the data gap","what is RPO","RPO, or Recovery Point Objective, defines the point in time to which data needs to be recovered after a disruption. It is often expressed as the tolerable data gap measured in time. It does not simply equal a backup schedule, and it does not describe how long restoration takes. The usable, consistent data point and the business records it includes must be verified.","Recovery Point Objective (RPO)",[450,451],"recovery point objective","data recovery point",{"id":453,"path":454,"title":455,"keyword":456,"intro":457,"name":80,"aliases":458},"P137","\u002Fglossary\u002Fleast-privilege","What is least privilege? Access matched to the job","what is least privilege","Least privilege means giving a person, application or process only the access needed for an approved task, within the appropriate scope and time. It is an authorization principle: it concerns what an identity can do after access is granted. A strong sign-in method helps protect the identity but does not make excessive permissions appropriate.",[459,460,461],"principle of least privilege","PoLP","minimum permissions",{"id":463,"path":464,"title":465,"keyword":466,"intro":467,"name":84,"aliases":468},"P141","\u002Fglossary\u002Fpasskeys","What is a passkey? Sign-in, device ownership and recovery","what is a passkey","A passkey is a sign-in credential that uses a cryptographic key pair instead of sending a reusable password to the service. The service keeps a public key and the authenticator controls the matching private key. Passkeys can resist credential phishing when implemented correctly, but device ownership, user verification, recovery and account permissions still matter.",[379,469,470],"FIDO2 credential","passwordless sign-in",{"id":472,"path":473,"title":474,"keyword":475,"intro":476,"name":88,"aliases":477},"P172","\u002Fglossary\u002Fpassword-manager","What is a password manager? Vaults, sharing and recovery","what is a password manager","A password manager stores credentials in a protected vault and helps people create and use different passwords for different accounts. Business features may also support shared access, administration and recovery. The vault controls access to stored secrets; the underlying service still controls its own accounts, permissions, sessions and credential validity.",[478,479,480],"password vault","credential vault","business password storage",{"id":482,"path":483,"title":484,"keyword":485,"intro":486,"name":487,"aliases":488},"P161","\u002Fglossary\u002Fdns","What is DNS? Records, ownership and business services","what is DNS","DNS (Domain Name System) connects domain names with information that Internet services need, such as website addresses and mail-routing records. Different records support different functions. For a business, understanding DNS means identifying the authoritative provider, the account owner and the services that depend on each setting before changing it.","DNS (Domain Name System)",[489,490,491],"domain name system","authoritative DNS","DNS records",{"id":493,"path":494,"title":495,"keyword":496,"intro":497,"name":96,"aliases":498},"P162","\u002Fglossary\u002Fdnssec","What is DNSSEC? Signed DNS validation and its limits","what is DNSSEC","DNSSEC adds cryptographic signatures that let validating resolvers check the origin and integrity of DNS data through a chain of trust. It does not encrypt DNS queries or certify that a website is safe. Its effectiveness depends on correct signing, delegation and validation, including the relationship between the DNS provider and the parent-zone settings.",[499,500,501],"DNS security extensions","signed DNS","DNS validation",{"id":503,"path":504,"title":505,"keyword":506,"intro":507,"name":100,"aliases":508},"P159","\u002Fglossary\u002Fhttps","What is HTTPS? Encrypted connections and the trust boundary","what is HTTPS","HTTPS is HTTP carried over a TLS-protected connection. It helps protect data in transit and lets the client check the server certificate for the requested hostname. It does not prove that the website operator is trustworthy, the application is free of vulnerabilities or the information remains protected after the connection ends.",[509,510,511],"HTTP over TLS","secure web connection","encrypted HTTP",{"id":513,"path":514,"title":515,"keyword":516,"intro":517,"name":518,"aliases":519},"P156","\u002Fglossary\u002Fhsts","What is HSTS? Browser HTTPS policy, scope and recovery","what is HSTS","HSTS (HTTP Strict Transport Security) is a browser policy delivered through the Strict-Transport-Security response header over HTTPS. It tells a supporting browser to use HTTPS for the covered host for a defined period. Scope, remembered state and preload matter: a policy should be extended only after the required hostnames and certificates can reliably support it.","HSTS (HTTP Strict Transport Security)",[520,521,522],"Strict-Transport-Security","HTTP strict transport security","HTTPS-only policy",{"id":524,"path":525,"title":526,"keyword":527,"intro":528,"name":108,"aliases":529},"P158","\u002Fglossary\u002Fplugin-vulnerability","What is a WordPress plugin vulnerability? Exposure and evidence","what is a WordPress plugin vulnerability","A WordPress plugin vulnerability is a weakness in a plugin that can allow an unintended action under particular conditions. A published advisory does not by itself prove that your installation is affected or compromised. Identify the exact component, edition, version, exposure and prerequisites before choosing a supported response and checking the result.",[530,531,532],"plugin security flaw","extension vulnerability","plugin weakness",{"id":534,"path":535,"title":536,"keyword":537,"intro":538,"name":539,"aliases":540},"P152","\u002Fglossary\u002Fxss","What is XSS? Unsafe browser rendering and business risk","what is XSS","XSS (cross-site scripting) is an application weakness in which untrusted content is handled in a way that can become executable browser behavior in the site’s context. Prevention depends on how and where the data is rendered. Safe framework behavior, context-appropriate output handling and carefully controlled rich content need review alongside supporting browser policies.","XSS (cross-site scripting)",[541,542,543],"cross-site scripting","unsafe browser rendering","stored XSS",{"id":545,"path":546,"title":547,"keyword":548,"intro":549,"name":550,"aliases":551},"P153","\u002Fglossary\u002Fcsrf","What is CSRF? Forged actions and the authorization boundary","what is CSRF","CSRF (cross-site request forgery) involves causing a browser to send an unwanted request to an application that may recognize the browser’s existing credentials. The application needs an appropriate way to verify the request’s legitimacy as well as the user’s permission for the action. A logged-in session or a hidden button does not establish both.","CSRF (cross-site request forgery)",[552,553,554],"cross-site request forgery","request forgery","CSRF token",{"id":556,"path":557,"title":558,"keyword":559,"intro":560,"name":120,"aliases":561},"P151","\u002Fglossary\u002Fsql-injection","What is SQL injection? Query structure, data and database access","what is SQL injection","SQL injection occurs when untrusted data becomes part of a database query’s instruction structure instead of remaining a data value. The primary prevention is to keep query structure separate and bind values through a supported database interface, while controlling dynamic query choices and database privileges. A WAF or a normal-looking search result does not establish that separation.",[562,563,564],"SQLi","query injection","database query manipulation",{"id":566,"path":567,"title":568,"keyword":569,"intro":570,"name":571,"aliases":572},"P147","\u002Fglossary\u002Fcve","What is CVE? Read a vulnerability identifier and its record","what is CVE","CVE (Common Vulnerabilities and Exposures) provides identifiers and records that help people refer to the same publicly described vulnerability. A CVE identifier is not a severity score, proof that your installation is affected or evidence that an attacker used it. Read the current record, affected products, versions and references together with your own system inventory.","CVE (Common Vulnerabilities and Exposures)",[573,574,575],"vulnerability identifier","CVE record","CVE ID",{"id":577,"path":578,"title":579,"keyword":580,"intro":581,"name":582,"aliases":583},"P148","\u002Fglossary\u002Fcvss","What is CVSS? Vulnerability severity, vectors and business context","what is CVSS","CVSS (Common Vulnerability Scoring System) describes vulnerability characteristics and technical severity using a versioned method and vector. A base score is not a complete measure of business risk or proof of exploitation. Read the score with its version, metrics, source and assumptions, then combine it with local exposure, threat evidence and the business function affected.","CVSS (Common Vulnerability Scoring System)",[584,585,586],"severity vector","Common Vulnerability Scoring System","CVSS v4.0",{"id":588,"path":589,"title":590,"keyword":591,"intro":592,"name":132,"aliases":593},"P149","\u002Fglossary\u002Fzero-day","What is a zero-day vulnerability? Knowledge, fixes and evidence","what is a zero day vulnerability","A zero-day vulnerability is a weakness that was not yet known to the relevant vendor or defenders at the time described by the source. A zero-day attack is exploitation of a previously unknown weakness. Distinguish the vulnerability, exploit, disclosure, available fix and your installation’s current state before deciding what the label means for your business.",[594,595,596],"zero day","0-day","unknown vulnerability",{"id":598,"path":599,"title":600,"keyword":601,"intro":602,"name":136,"aliases":603},"P150","\u002Fglossary\u002Fvulnerability-scanning","What is vulnerability scanning? Scope, findings and verification","what is vulnerability scanning","Vulnerability scanning uses automated checks to identify possible weaknesses or configuration issues within a defined target and access scope. Results need validation and interpretation. A scan is not automatically a penetration test, proof of compromise or evidence that every page, account and business process is secure.",[604,605,606],"automated vulnerability scan","scanner findings","authenticated scan",{"id":608,"path":609,"title":610,"keyword":611,"intro":612,"name":140,"aliases":613},"P142","\u002Fglossary\u002Fphishing","What is phishing? Deceptive requests, channels and business controls","what is phishing","Phishing is deception in a digital message or website that tries to make someone disclose information, grant access, install software or perform a harmful action. It can arrive through email, text, a shared document or a QR code. For a business, the important question is what the request would authorize and how that request can be verified independently.",[614,615,616],"phishing attack","digital phishing","phishing definition",{"id":618,"path":619,"title":620,"keyword":621,"intro":622,"name":623,"aliases":624},"P143","\u002Fglossary\u002Fbec","What is business email compromise? Payment fraud and trusted requests","what is business email compromise","BEC (business email compromise) is a fraud pattern in which a criminal uses a seemingly trusted business communication to redirect money or obtain sensitive information. The instruction may come from an impersonated sender or an abused genuine account. A fraudulent request does not, by itself, prove that your mailbox was compromised; payment verification and account investigation are separate tasks.","BEC (business email compromise)",[144,625,626],"business email compromise","business email fraud",{"id":628,"path":629,"title":630,"keyword":631,"intro":632,"name":148,"aliases":633},"P144","\u002Fglossary\u002Fmalware","What is malware? Harmful code, website symptoms and response","what is malware","Malware is code or software intended to carry out harmful or unauthorized activity. On a business website it may alter content, redirect visitors, send unwanted messages or maintain unauthorized access. A vulnerability, an unusual file and a scanner alert are not interchangeable with a confirmed infection. Establish what was observed, which system is affected and what evidence supports the next action.",[634,635,636],"malicious software","malicious code","website malware",{"id":638,"path":639,"title":640,"keyword":641,"intro":642,"name":152,"aliases":643},"P146","\u002Fglossary\u002Fbackdoor","What is a backdoor? Hidden access and website persistence","what is a backdoor","A backdoor is an undocumented access route that can bypass the way a system is intended to be accessed or controlled. In a website incident it may provide continuing unauthorized access even after visible damage is removed. A suspicious file alone does not prove a backdoor, and deleting one confirmed file does not establish that every access path has been closed.",[644,645,646],"back door","hidden access route","website persistence",{"id":648,"path":649,"title":650,"keyword":651,"intro":652,"name":156,"aliases":653},"P145","\u002Fglossary\u002Fransomware","What is ransomware? Encryption, extortion and recovery decisions","what is ransomware","Ransomware is malicious software used to lock or encrypt data or systems and demand payment. An incident may also involve stolen information and threats to disclose it. Restoring files addresses availability, but does not by itself remove unauthorized access or establish whether information was copied. A business needs separate decisions about containment, trusted recovery and possible data exposure.",[654,655,656],"ransomware encryption","file-locking malware","crypto-ransomware",{"id":658,"path":659,"title":660,"keyword":661,"intro":662,"name":160,"aliases":663},"P166","\u002Fglossary\u002Fdata-breach","What is a data breach? Exposure, access and evidence","what is a data breach","A data breach involves loss of control over information, unauthorized exposure or access, or other handling outside its permitted purpose. For a website incident, distinguish information being reachable, evidence of someone accessing it and evidence of extraction. This page uses an operational explanation: the legal classification, affected population and reporting duties depend on the actual data, circumstances and applicable jurisdiction.",[664,665,666],"information exposure","unauthorized data access","data leakage",{"id":668,"path":669,"title":670,"keyword":671,"intro":672,"name":673,"aliases":674},"P154","\u002Fglossary\u002Fssrf","What is SSRF? Server-side requests and destination controls","what is SSRF","SSRF (server-side request forgery) is a weakness that lets someone influence a server-side application to make an unintended request. The server may be able to reach destinations the visitor cannot access directly. Prevention needs controls on the actual destination and connection, together with appropriate network restrictions; a browser policy or a simple URL-looking check does not settle the server-side risk.","SSRF (server-side request forgery)",[675,676,677],"server-side request forgery","server fetch abuse","server request destination",{"id":679,"path":680,"title":681,"keyword":682,"intro":683,"name":684,"aliases":685},"P155","\u002Fglossary\u002Fcsp","What is CSP? Content Security Policy, reporting and enforcement","what is CSP","CSP (Content Security Policy) is a browser-enforced policy that can restrict resources and behaviors allowed for a web document. A report-only policy observes violations without enforcing those restrictions. CSP can add a defensive layer, but it does not replace fixing unsafe code, authentication or server-side controls. Build and verify the policy around the website’s actual resources and business functions.","CSP (Content Security Policy)",[686,687,688],"Content Security Policy","browser resource policy","CSP report-only",{"id":690,"path":691,"title":692,"keyword":693,"intro":694,"name":695,"aliases":696},"P139","\u002Fglossary\u002Fhardening","What is security hardening? Baselines, changes and verification","what is security hardening","Security hardening is the process of reducing unnecessary exposure and strengthening a system’s configuration for its intended use. It can involve supported updates, fewer services, tighter permissions and controlled administrative access. A useful hardening result is an owned baseline with tested business functions and documented exceptions, not a claim that a system is invulnerable or that an existing compromise has been removed.","Security hardening",[697,698,699],"system hardening","configuration baseline","attack surface reduction",{"id":701,"path":702,"title":703,"keyword":704,"intro":705,"name":176,"aliases":706},"P160","\u002Fglossary\u002Ffirewall","What is a firewall? Network policy, host rules and WAF boundaries","what is a firewall","A firewall controls network traffic according to a defined policy. Network and host firewalls govern traffic paths, while a WAF focuses on web-application traffic and has a different scope. A firewall label or an enabled setting does not prove the intended restriction is effective: verify the relevant source, destination, direction and actual path while preserving required business and recovery access.",[707,708,709],"network traffic policy","host firewall","network filtering",{"id":711,"path":712,"title":713,"keyword":714,"intro":715,"name":180,"aliases":716},"P138","\u002Fglossary\u002Fzero-trust","What is zero trust? Resource access, identity and practical scope","what is zero trust","Zero Trust is an approach to access decisions that does not grant implicit trust merely because a user or device is inside a network or owned by the business. The resource, identity, device context and permitted action need an explicit policy and enforcement. A VPN, MFA setting or product label can support parts of that work without establishing a complete Zero Trust architecture.",[717,718,719],"Zero Trust Architecture","ZTA","implicit network trust",{"id":721,"path":722,"title":723,"keyword":724,"intro":725,"name":184,"aliases":726},"P169","\u002Fglossary\u002F3-2-1-backup","What is the 3-2-1 backup rule? Copies, separation and recovery","what is the 3-2-1 backup rule","The 3-2-1 backup rule means keeping at least three copies of important data, including the original and two backups, using two different media types and keeping one copy offsite. It is a separation principle, not proof of recoverability. Check shared failure risks, protected access, retained history and actual restore results in addition to counting copies.",[727,728,729],"three-copy backup rule","3 2 1 backup","backup copy separation",null,{"path":732,"label":733},"\u002Fresources","Website security resources and templates",{"path":6,"label":10},1794134057451]