Technical Glossary
Cybersecurity term for hacker.
More grown up than "Bad Guy" wider scope than "Criminal" but sounds less paranoid than "Spies"
It could be a kid in their bedroom, an unhappy employee/customer, a competitor, a criminal organization, or CIA/KGB/etc.
They can be motivated by financial gain, political activism, or simply the challenge of breaking into a system.
More grown up than "Bad Guy" wider scope than "Criminal" but sounds less paranoid than "Spies"
It could be a kid in their bedroom, an unhappy employee/customer, a competitor, a criminal organization, or CIA/KGB/etc.
They can be motivated by financial gain, political activism, or simply the challenge of breaking into a system.
TInvestors want to know that you have at least thought about who may want to harm you and that you have a plan to protect yourself against them.
Even if you are a small startup, you can be a target for ransomware groups, especially if you store personal or financially valuable data.
Investors are currenly concerned your AI may glitch and delete your database (and all the backups). It does happen.
If you are at the national security level then you better have this well and truly covered.
Even if you are a small startup, you can be a target for ransomware groups, especially if you store personal or financially valuable data.
Investors are currenly concerned your AI may glitch and delete your database (and all the backups). It does happen.
If you are at the national security level then you better have this well and truly covered.
Zero Trust
If you assume that a bad actor is already inside your system, then you write your software and configure your architecture accordingly.
You keep checking that every person, device, or entity (like AI) trying to access your systems is who/what they say they are.
You log data requests and check for unusual access patterns.
Works well with RBAC and least privilege (see below)
You keep checking that every person, device, or entity (like AI) trying to access your systems is who/what they say they are.
You log data requests and check for unusual access patterns.
Works well with RBAC and least privilege (see below)
This can significantly reduce the risk (both likelihood and impact) of data breaches and cyber attacks. No one wants to be the next data breach news headline.
being able to PROVE to investors that you have a robust security strategy in place can enhance your credibility and increase investor confidence.
Auditors love this sort of thing too, so it can make your life easier when you need to do audits for investors or regulators.
being able to PROVE to investors that you have a robust security strategy in place can enhance your credibility and increase investor confidence.
Auditors love this sort of thing too, so it can make your life easier when you need to do audits for investors or regulators.
Least Privilege
A security principle that states that users should be granted the minimum level of access necessary to perform their job functions.
Example: Only allow the reporting server read, not write, access to your database.
Example: Only the HR team can access employee records, and not the marketing team or your latest AI assistant.
Example: Only the deployment process can make changes to the database, and not the developers.
Example: Only allow the reporting server read, not write, access to your database.
Example: Only the HR team can access employee records, and not the marketing team or your latest AI assistant.
Example: Only the deployment process can make changes to the database, and not the developers.
It helps to minimize the potential damage caused by insider threats and reduces the attack surface for cybercriminals.
[RBAC] Role Based Access controls
Regulating access to network resources based on the roles of individual users within an organization.
Example: John is part of the [HR team]. You would grant the [HR team] access to employee records, but not John specifically.
If John moves to another team or someone else joins the [HR team], you can simply update the [HR team]'s permissions and not worry about individual user permissions.
Example: John is part of the [HR team]. You would grant the [HR team] access to employee records, but not John specifically.
If John moves to another team or someone else joins the [HR team], you can simply update the [HR team]'s permissions and not worry about individual user permissions.
It allows companies to efficiently manage user permissions and ensure that sensitive data is only accessible to authorized personnel
This can help prevent data breaches and maintain compliance with regulations.
This can help prevent data breaches and maintain compliance with regulations.
[PCI-DSS] The Payment Card Industry Data Security Standard
This is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.
If you handle credit card information this is a MUST have.
Failure to protect customer/credit card data will incur costly fines and reputational damage.
Failure to protect customer/credit card data will incur costly fines and reputational damage.
[NZISM] New Zealand Information Security Manual
This as a set of guidelines and best practices for information security management in New Zealand.
if you interact with government departments or agencies in New Zealand, you may be required to comply with the NZISM standards.
Even if you don't interact with the government, following the NZISM standards can reduce the risk of cyber attacks.
if you interact with government departments or agencies in New Zealand, you may be required to comply with the NZISM standards.
Even if you don't interact with the government, following the NZISM standards can reduce the risk of cyber attacks.
It helps companies operating in New Zealand to ensure that they are following best practices for information security, which can reduce the risk of cyber attacks and enhance the company's reputation for security.
[NIST CSF] National Institute of Standards and Technology Cybersecurity Framework
The is a set of guidelines and best practices for assessing maturity and managing cybersecurity.
It provides a structured approach for companies to identify, assess, and manage cybersecurity risks, which can help prevent data breaches and protect the company's assets and reputation.
This can quickly help you indentify where your biggest risks are and where to focus your efforts to reduce them.
and conversly, where you can save money by not over-investing in low risk areas.
This can quickly help you indentify where your biggest risks are and where to focus your efforts to reduce them.
and conversly, where you can save money by not over-investing in low risk areas.
[GDPR] General Data Protection Regulation
This is a European law on data protection and privacy for all individuals within the European Union and the European Economic Area.
It is crucial for companies that operate in or have customers in the EU to protect personal data and avoid hefty fines and legal consequences associated with non-compliance.
Even if you don't operate in the EU, following GDPR principles can enhance your company's reputation for data privacy and security.
Even if you don't operate in the EU, following GDPR principles can enhance your company's reputation for data privacy and security.
Vulnerability
A flaw/weakness in your system
If it was exploited it could be used to gain unauthorized access or cause harm.
If it was exploited it could be used to gain unauthorized access or cause harm.
Example: My front door can be opened with a master key
Exploit
A process that could be used to attack a vulnerability.
Example: A locksmith could own a master key that opens my front door.
Threat
When it is likely that the vulnerability will be exploited it becomes a threat.
Example: My locksmith was burgled and my master key was stolen.
Blast radius
How much damage would probably occur if the vulnerability was exploited.
Example: If my front door is unlocked they could steal everything.
Risk
The chance that a vulnerability will be exploited and cause harm, along with a qualified idea of the blast radius.
Example: Locksmiths are security conscious, the chance of them exploiting the vulnerability is low, but if a bad actor stole the master key the consequences could be bad.
Risk Treatment
The process of deciding how to manage a risk, including accepting it, mitigating it, transferring it, or avoiding it.
- Accepting it: I have nothing worth stealing
- Mitigating it: Get a new lock, a safe for important things, or big dog
- Transferring it: Get insurance
- Avoiding/Outsourcing it: Move to a gated community
Risk Appetite
The amount of risk that an organization is willing to accept to achieve its objectives.
No risk, no reward. Successful businesses must balance risk and reward to achieve their goals.
Your risk appetite will determine how much risk you are willing to take on in order to achieve your business objectives.
Imagine you write a medical records app. You want to be able to share data with other healthcare providers
For example, if your risk appetite is low, you may only allow a short list of vetted, trusted providers to access the data.
On the other hand, if your risk appetite is high, you might have flexible security measures that allow for greater data sharing, but also increase the risk of a data breach.
e.g. you may accept an simple online form where the applicant "promises to be careful" as good enough vetting.
Your risk appetite will determine how much risk you are willing to take on in order to achieve your business objectives.
Imagine you write a medical records app. You want to be able to share data with other healthcare providers
For example, if your risk appetite is low, you may only allow a short list of vetted, trusted providers to access the data.
On the other hand, if your risk appetite is high, you might have flexible security measures that allow for greater data sharing, but also increase the risk of a data breach.
e.g. you may accept an simple online form where the applicant "promises to be careful" as good enough vetting.
Risk Tolerance
The acceptable deviation from the level set by the risk appetite and business objectives
Risk tolerance defines the boundaries within which an organization can operate while maintaining its risk appetite. It helps in determining the extent to which risks can be accepted or mitigated.
The best illustration I have heard for this was policing.
A district may have zero appetite for road deaths.
One particular stretch of road may be dangerous during snow months, so a low speed limit is posted.
Their Risk tolerance allows relaxing of the speed limit during summer months, but not during winter months.
The best illustration I have heard for this was policing.
A district may have zero appetite for road deaths.
One particular stretch of road may be dangerous during snow months, so a low speed limit is posted.
Their Risk tolerance allows relaxing of the speed limit during summer months, but not during winter months.