Braathes security dictionary

When an attacker tries to gain access to an account by trying all possible password combinations, with the help of computer tools, simple passwords can be cracked in no time. That's why your provider often asks you to have at least XX characters, special characters, upper and lower case letters, numbers and all possible strange combinations of these.

When a network of computers infected with malware is controlled by an attacker. They are often used for mass attacks such as DDoS attacks (explained below).

This is the unauthorized distribution of confidential or sensitive data, usually as a result of a breach of computer security.

This is an attack where many computers or devices are used to overload (by sending very many simultaneous requests to, for example) a website or service with traffic, making it inaccessible to legitimate users. This is a methodology that does not necessarily cost an attacker much.

Director fraud is fraud that is carried out using e-mail or SMS from attackers who pretend to be someone in the company's management. This is becoming more and more common. Many people experience strange requests such as: “Can you buy a gift card worth NOK 1500 for all employees in this department?” or that they want the finance employee to pay an invoice or transfer money to an unknown account that has never been used before. In a stressful everyday life, it can be easy to fall for such a scam, and the business can thus suffer a financial loss.

This is when someone steals personal information, such as your name, date of birth or social security number, to carry out fraud or criminal activities in your name.

Account number fraud is when attackers use the email of someone you trust to change the account number for the payment of wages or the payment of an invoice. This means that the salary of employees who are exposed to this goes to an unknown account and is lost. Or that the supplier never received the money when the company paid the invoice.

Malware is malicious software designed to infiltrate or damage computers and networks. This includes, among other things, viruses, trojans and spyware.

Phishing is a technique where attackers try to trick you into giving up sensitive data, such as passwords and credit card information, by pretending to come from a trusted source. Phishing is often used in connection with email fraud, while smishing is referred to as SMS fraud. Want to read more about phishing? Take a look at our BLOG post here.

Ransomware is a type of malware that encrypts your files and demands a ransom to decrypt them. It is a form of digital blackmail.

This is a general term for malicious software, which includes viruses, worms, trojans and spyware, designed to damage computers or steal information.

Phishing is a technique where attackers try to trick you into giving up sensitive data, such as passwords and credit card information, by pretending to come from a trusted source. Spearfishing is an even more cunning method. The attacker will then spend a long time getting to know a business or a specific person who works there and become familiar with patterns of action over time in order to steal sensitive data. The attack can also probably do more damage in a spearphishing attack than a normal phishing attack.

Spoofing is a way fraudsters use to pretend to be an actor you trust. Then they use Norwegian phone numbers that are registered to actors such as e.g. the police. They also say that they are calling from the operator they have obtained the number from. Often they ask for information such as social security number, card number or other and explain in what context they need the information in order to appear credible.

The scammers use software that masks the original number they are calling from. Therefore, the correct number comes up with you.

Vhishing is fraud over the phone. Through cunning tricks and manipulation, the fraudster can outline a fictitious event to get you to provide personal information such as social security number, card details or the like. Now they camouflage their foreign or unknown numbers with Norwegian numbers that you can find online.

A virus is a type of malware that can replicate itself and infect files and computers, often with the intention of destroying data or stealing information.

This is a software vulnerability that becomes known to attackers before the developers have the opportunity to create a patch or update to fix the problem/close the vulnerability hole.

An example is when the widely used program Apache Log4j was found to have security holes. When it is then notified, the hackers are quick to attack to get what they want, and many see it as a race against the clock to get updated as quickly as possible. Read more about the event here.

A firewall is a security mechanism that controls and limits traffic between one or more computer networks and the Internet to protect against unauthorized access.

Multi-factor authentication (MFA) includes the already known two-factor authentication (2FA). With multi-factor authentication, you add several extra layers of security. MFA requires you as a user to provide two or more forms of authentication before you can access an account or service.

This could include something they know (password), something they have (a one-time code sent to a mobile app or an email), or something they are (biometric authentication such as fingerprints or facial recognition). The benefit of introducing MFA is that it will be much more difficult for people with malicious intent to gain access to your online accounts, even if your password is leaked or guessed by computers.

Encryption is the process of converting data into an unintelligible form to protect it from unauthorized access. Only those with the correct key can decrypt the data.

Password strength refers to how secure a password is, based on length, complexity, and randomness. Strong passwords are important to protect accounts. Been a while since you updated your password? Then we recommend reading a bit about password hygiene here.

These are software updates that include fixes for known security issues. Installing them as soon as they arrive is important to close vulnerabilities quickly. Closing such security holes is often called "patching".

Backing up means making copies of important data to restore them in the event of loss or damage, such as a ransomware attack.

2FA is a security practice where two separate methods are used to verify your identity, usually something you know (your password) and something you has (e.g. mobile app or key card). The combination of the two methods makes it more difficult for someone sitting somewhere else in the world without physical access to your mobile or key card to pretend to be you.

This is authentication using physical or biological characteristics, such as fingerprints, facial recognition or retina scanning. Most people have perhaps adopted Face-ID on their mobile phone?

This refers to measures to protect email communications, including spam filtering, phishing prevention and email encryption.

This is general protection of websites and web applications against security risks, including vulnerabilities and attacks.

This is a process for evaluating and assessing threats and vulnerabilities in order to map security risks and develop measures to reduce them. This is often difficult to do on your own if your people do not have the necessary knowledge. We are happy to contribute with advice.

National Security Authority basic principles for ICT security also provides a good framework to work within when securing your data.

These are guidelines and procedures that a business implements to protect its digital resources and data.

These are guidelines and procedures that determine how data is to be secured and transferred in a network or system.

This is a digital signature that confirms the identity of a website or service and ensures that the data sent back and forth is encrypted and protected.

These are procedures and measures taken to manage and limit the damage after a security incident, such as a data leak or an attack. We call it a contingency plan internally. That is because most people have thought through what to do in the event of a physical crisis. Preferably in connection with a natural disaster. In this article, we consider why you should also have a digital emergency plan for when things can go really wrong.

This is about raising awareness among employees or users about security risks and best practices to avoid them. Your people can be your best defense.

This is education and training for employees or users to increase knowledge of security practices and how to recognize threats. We have written a lot about how to train good safety ambassadors in the company. In this article, we offer many good tips.

This is an area of ​​a computer network that is isolated from the rest of the network for extra protection, usually used for critical systems.

This is the process of searching for weak points in software or systems that can be exploited by attackers. It is part of what we do when customers ask for a risk analysis.

This is technology that creates a secure connection to the internet, encrypts the data traffic and hides your identity from the open web. This makes it harder for others to track your activities and steal your data.