Cybersecurity glossary
Learn about the key words, acronyms, and other technical terms used in the security industry.
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A
Account takeover (often abbreviated ATO) describes the scenario where a cybercriminal or organization uses stolen or compromised credentials to gain fraudulent access to an account, and then exploits the privileges granted or associated to said account. All manner of account types may be viable targets, including but not limited to email, banking, online shopping and even corporate or employee accounts.
AI impersonation beats detection training. Learn why hardware authentication is the best defense against CEO fraud and deepfake attacks.
Authenticator
An authenticator is used to confirm the identity of a user and can be something you know, something you have, or something you are. In the case of digital authentication, a person authenticates to a computer system or application by demonstrating that he or she has possession and control of an authenticator.
An authenticator app adds a layer of security for online accounts by generating 2-step verification codes on a mobile or desktop device.
The U.S. National Institute of Standards and Technologies (NIST) SP 800-63B recommends that for services where user authentication is required, they must authenticate using methods that provide the highest level of assurance. The robustness of this confidence is described by an AAL categorization.
Authentication Assurance relies on examination of the cryptographic modules of an authenticator. Level 1 examines the algorithms used in the cryptographic component of the software. Levels 2-4 build on the software component by adding different layers of physical security. The YubiKey FIPS Series meets Level 3 requirements (AAL3) which means that the code is within a tamper-proof container so that keys used in the cryptography are destroyed if the device is physically compromised.
B
Biometrics are physical or behavioral human characteristics that can be used to digitally identify a person to grant access to systems, devices or data. Examples of these biometric identifiers are fingerprints, facial patterns, voice or typing cadence.
Built-in Authenticator
A built-in authenticator (also referred to as a platform authenticator) is built into a particular client device platform, that is, it is implemented on device. An example would be biometrics capabilities that now ship with modern devices.
In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found.