Cybersecurity words explained in plain language. When one of these terms appears in a story, it links here.
B
- Botnet
- A network of infected computers and devices controlled by criminals, often used for DDoS attacks, spam or spreading malware.
C
- Canadian Centre for Cyber Security
- The federal government's cyber security authority, part of the Communications Security Establishment.
- Credential stuffing
- Trying usernames and passwords leaked from one site on many other sites, because people reuse passwords.
- CVE
- Common Vulnerabilities and Exposures: the public list that gives each known security flaw an ID such as CVE-2026-12345, so everyone can talk about the same flaw.
- CVSS
- Common Vulnerability Scoring System: a score from 0 to 10 for how severe a security flaw is.
D
- Data breach
- An incident in which personal or confidential information is accessed or taken by someone who should not have it.
- DDoS
- Distributed denial of service: flooding a website or network with traffic from many machines so it slows down or goes offline.
E
- Encryption
- Scrambling data so only someone with the right key can read it.
- Endpoint detection and response
- Security software on computers and servers that watches for suspicious behaviour, alerts defenders and can isolate an infected machine.
- Exploit
- Code or a technique that takes advantage of a vulnerability.
F
- Firewall
- A barrier that filters network traffic in and out of a device or network according to rules.
I
- Info-stealer
- Malware that collects saved passwords, browser cookies and other credentials from an infected computer and sends them to criminals.
L
- Law 25
- Quebec's privacy law for the private sector (formerly Bill 64).
M
- Malware
- Any software made to harm a device or its user: viruses, ransomware, spyware, trojans and info-stealers are all malware.
- Multi-factor authentication
- Signing in with something more than a password, such as a code from an app, a security key or a passkey, so a stolen password alone is not enough.
P
- Passkey
- A way to sign in without a password: your device keeps a secret key and confirms it is you with your fingerprint, face or PIN.
- Patch
- An update that fixes a security flaw or a bug.
- Phishing
- A message that pretends to come from someone you trust (a bank, Canada Post, the CRA, your boss) to make you click a link, open a file or give away a password or payment details.Phishing by text…
- PIPEDA
- The Personal Information Protection and Electronic Documents Act: Canada's federal privacy law for businesses.
R
- Ransomware
- Malicious software that locks or encrypts an organization's files and demands payment to unlock them.
S
- Social engineering
- Tricking people, rather than computers, into giving access or information: phishing, fake support calls and pretending to be an executive are common examples.
- Supply chain attack
- An attack on an organization through a supplier it trusts, such as a software vendor, an IT provider or an open-source package.
V
- VPN
- Virtual private network: an encrypted tunnel between a device and a network.
- Vulnerability
- A weakness in software, hardware or a process that an attacker can use to get in, steal data or cause damage.
Z
- Zero-day
- A security flaw that attackers use before the maker has a fix, so defenders have had "zero days" to patch.