Cybersecurity Terminology

Multi-Factor Authentication (MFA) requires users to provide two or more verification factors: something you know (password), something you have (token/phone), and something you are (biometric). MFA significantly reduces the risk of account compromise because stealing just a password is not enough to gain access.

Defense-in-depth uses multiple overlapping layers of security controls so that if one fails, others remain. Firewalls, IDS/IPS, security awareness training, and encryption are all valid layers. Using one password for all systems violates password best practices, and relying solely on AV is a single-layer approach — the opposite of defense-in-depth.

Symmetric encryption (e.g., AES) uses a single shared key for both encrypting and decrypting. It is fast but requires securely exchanging the key. Asymmetric encryption (e.g., RSA) uses a public key to encrypt and a private key to decrypt. HTTPS uses asymmetric encryption to establish a session, then switches to symmetric encryption for performance.

Virus (attaches to legitimate files), Trojan Horse (disguises itself as legitimate software), Worm (self-replicating, spreads across networks), and Spyware (secretly monitors user activity) are all types of malware. A firewall is a security control, and a VPN is a privacy/security tool — neither is malware.

A SIEM (e.g., Splunk, Microsoft Sentinel, IBM QRadar) ingests logs from firewalls, servers, endpoints, and applications, correlates events across multiple sources, and generates alerts when suspicious patterns are detected. It is the cornerstone of most SOC (Security Operations Center) monitoring programs.