Certificate Topics — Cybersecurity Terminology (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Law Enforcement track Certificate behind this topic: "Cybersecurity Awareness: Cybersecurity Terminology" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 28, 2025) — earned ×2, including accredited versions (PMI-accredited version) Founded and presented by: Minister Destiny Marie Morgan, Minister

This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911. It is community-designed training, not agency policy, and school completion is a school achievement only — not a law-enforcement rank, title, or credential.

Before you start

• This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• Every warning, policy, and news report in this field uses the same core vocabulary. Minister Destiny earned this certificate twice, including an accredited version — because precise words are working tools, especially in reports that other people must act on.
• Learn each term by what it does in real life, not by memorising a dictionary line.

The lesson

Part 1. The Core Four — Threat, Vulnerability, Exploit, and Risk

A threat is a person, event, or thing that could cause harm. A vulnerability is a weakness that could be used — a flaw in software, a missing control, a habit. An exploit is the technique or code that actually takes advantage of a vulnerability: the vulnerability is the unlocked window; the exploit is the method of climbing through it. Risk combines them over something valuable: the chance a threat will use a vulnerability, and the impact if it succeeds.

Two neighbouring words finish the set. An incident is an event that actually harms — or is reasonably believed to have harmed — confidentiality, integrity, or availability. A breach is an incident in which data was accessed or taken by someone unauthorised; in many legal settings the word has a specific definition tied to the kind of data involved, which is one reason reports should describe what happened (“an unauthorised person viewed the file”) rather than reaching for labels early. Precision here is not pedantry. “We face a threat” calls for monitoring; “we have an incident” calls for the response plan.

Part 2. Malware Families — Naming What the Software Does

Malware is the umbrella word for malicious software. The family names describe behaviour. A virus attaches to files or programs and spreads when those are shared or run. A worm spreads by itself across networks, needing no one to carry it. A trojan (or trojan horse) disguises itself as something useful or harmless — a fake invoice program, a cracked game — and is installed by the victim. Ransomware encrypts data or systems and demands payment. Spyware quietly observes and reports — keystrokes, screens, location. A keylogger is the spyware subtype that records typing, which is why it steals passwords so efficiently. A rootkit hides deep in a system to conceal other malware and keep access. A bot is malware that puts a device under remote control; thousands of bots together form a botnet, rented out for spam, fraud, and denial-of-service floods.

One event can involve several families in sequence: a trojan delivers a keylogger, which steals credentials, which let ransomware in. Naming the family tells a responder what to look for next — which is the entire reason the names exist.

Part 3. Deception Words — Phishing and Its Relatives

Phishing is fraudulent messaging that impersonates a trusted sender to make a recipient click, open, pay, or reveal information. The family splits by channel and target. Spear phishing is aimed at a specific person or organisation, using researched details — a real supervisor's name, a real project — to sound convincing. Whaling targets senior leaders. Smishing arrives by text message; vishing is voice phishing, by phone. Spoofing is the underlying trick — faking a sender address, caller ID, or website so a message looks like it comes from somewhere trusted. A business email compromise (BEC) uses a spoofed or actually compromised business account, usually to redirect a payment.

Notice the pattern: these words name the deception, not the technology. That is because the weakness being exploited is trust, and the defence is verification — checking through a separate, known channel before acting.

Part 4. Defences and Boundaries — Firewall, VPN, Encryption, Hashing

A firewall is a barrier — hardware, software, or both — that permits or blocks network traffic according to rules, like a guard checking credentials at defined doors. A VPN (virtual private network) creates an encrypted tunnel across an untrusted network, so traffic between your device and the VPN endpoint is shielded from the local network carrying it. Encryption scrambles readable data (plaintext) into unreadable form (ciphertext) using a mathematical method and a key; only a holder of the right key can reverse it. Encryption protects data in transit (moving) and at rest (stored).

Hashing is encryption's one-way cousin. A hash function turns data into a fixed-length fingerprint. You cannot un-hash a fingerprint back into the data, but any change to the data changes the fingerprint — so hashes prove whether files or passwords match without storing the thing itself. Systems store password hashes, not passwords. Finally, a patch is a vendor's fix for a flaw, and a zero-day is a vulnerability attackers exploit before a patch exists (or before defenders know) — “zero days” of warning. Zero-days command headlines; ordinary unpatched flaws cause far more total harm.

Part 5. Who Are You, and What May You Do — Authentication vs Authorisation

These two are confused constantly, including in professional writing, and the difference matters. Authentication proves identity: a password, a fingerprint, a code from an app. It answers who are you? Authorisation decides what that proven identity may do: view this file, approve that payment, enter this system. It answers what are you allowed to do? You authenticate once at the door; you are authorised, or not, at every filing cabinet inside.

Multi-factor authentication (MFA) strengthens the first half by requiring factors from different categories: something you know (password), something you have (phone, key), something you are (fingerprint, face). Access control is the overall system of authorisation rules, and least privilege — each account gets only the access its work needs — is its guiding principle. Many breach reports that say “the attacker logged in” actually describe both failures: authentication was defeated (a stolen password, no MFA) and authorisation was too broad (that one account could reach everything).

Part 6. The Network Alphabet — and Using Terms Precisely in Reports

A short tour of the acronyms that appear everywhere. An IP address is a device's network address; DNS (Domain Name System) is the directory translating names like cisa.gov into those addresses — which is why DNS tampering can redirect people to fake sites. A SOC (Security Operations Center) is the team and room (physical or virtual) that monitors alerts around the clock. The CISO (Chief Information Security Officer) is the executive accountable for an organisation's security programme. MFA you have met; SIEM (security information and event management) is the software that collects logs so the SOC can spot patterns; an endpoint is any end device — laptop, phone, server — where work and attacks land.

Close with the working skill: writing terms precisely in reports. Say what was observed (“an email appearing to be from the finance manager, sent from an external address”), name the category once you have evidence (“consistent with spear phishing”), separate fact from assessment, and define any acronym on first use for readers outside the field. A report that a supervisor, a prosecutor, or a resident can all follow is not “dumbed down.” It is terminology doing its job.

Words to know — Cybersecurity Terminology

• Exploit — the technique or code that takes advantage of a specific vulnerability.
• Incident — an event that harms, or is reasonably believed to have harmed, security or data.
• Breach — an incident in which an unauthorised person accessed or took data.
• Worm — malware that spreads across networks by itself, without needing a carrier file or person.
• Trojan — malware disguised as something useful or harmless, installed by the victim.
• Spoofing — faking a sender, caller ID, or site so a message appears to come from a trusted source.
• Spear phishing — phishing aimed at a specific person or organisation using researched, convincing details.
• Hashing — turning data into a one-way fixed-length fingerprint used to verify a match without storing the original.
• Zero-day — a vulnerability exploited before a patch exists or before defenders know of it.
• Authentication — proving who you are; authorisation — deciding what that identity is allowed to do.

Myths vs facts — Cybersecurity Terminology

• Myth: Virus is the correct word for all bad software. Fact: Malware is the umbrella; viruses, worms, trojans, ransomware, and spyware behave differently and call for different responses.
• Myth: Authentication and authorisation mean the same thing. Fact: Authentication proves identity; authorisation sets permissions. Breaches often involve a failure of both.
• Myth: Encryption and hashing are interchangeable. Fact: Encryption is reversible with a key; hashing is one-way and used to verify, not to recover, data.
• Myth: A VPN makes a person anonymous and safe from everything. Fact: A VPN encrypts traffic between a device and the VPN endpoint. It does not stop phishing, malware, or a dishonest site at the other end.
• Myth: Jargon exists to keep outsiders out. Fact: Shared precise terms let responders, managers, and the public describe the same event the same way — the fix is plain-language teaching, like this unit, not abandoning the words.

Think it through — Cybersecurity Terminology

A shift brief states: “A hacker breached our firewall with a virus and stole everyone's authentication.” A supervisor asks you to rewrite it precisely before it goes to the chief.

Walk it through: (1) Test each term against the Parts. “Hacker” names no motive or identity — Part 6 practice is to describe the actor as unknown until evidence exists. (2) A firewall is a traffic-control barrier (Part 4); events usually pass through allowed traffic rather than “breaching” the firewall itself, so say what actually happened: an account was used from an external address. (3) “Virus” is unproven — no family has been identified yet (Part 2); “malware” is the honest umbrella until analysis finishes. (4) “Stole authentication” mixes Part 5's pair: credentials were likely stolen (authentication data), while what the intruder did with them was an authorisation problem. (5) A precise rewrite: “An unknown actor used stolen staff credentials to log in from outside the network and accessed two shared drives. The investigation is treating this as a breach; which files were taken is still being determined.”

Try this — Cybersecurity Terminology

• ☐ Take one security headline and underline every technical term; rewrite the headline in plain language without losing accuracy
• ☐ Write the difference between authentication and authorisation from memory, then check it against Part 5
• ☐ Sort these into malware families and say why: a fake tax program that secretly records typing; software that locks files for payment; code that copies itself across an office network overnight
• ☐ Find the glossary at NIST's CSRC site (csrc.nist.gov) and look up two terms you met here
• ☐ Draft a three-sentence incident note about a suspicious email, using observed facts only — no labels you cannot yet support

Resources to keep — Cybersecurity Terminology

• NIST Computer Security Resource Center Glossary — csrc.nist.gov — the authoritative free glossary of cybersecurity and privacy terms from official publications.
• SANS Institute “ABCs of Cybersecurity” — sans.org — a free, plain-language glossary poster for beginners and professionals.
• Cybersecurity and Infrastructure Security Agency (CISA) — cisa.gov — advisories and explainers that model precise, current terminology in use.
• National Cybersecurity Alliance — staysafeonline.org — everyday security terms explained for non-specialists.

What you earned / what's next — Cybersecurity Terminology

✅ Cybersecurity Terminology complete (quiz score 80% or higher): You can use the core security vocabulary accurately — in conversation, in reading alerts, and in reports other people must act on.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Cybersecurity Terminology

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. Words are tools, and you now handle the tools of this field with care — saying what you mean, and meaning what the evidence supports. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.

Sources

• CSRC Glossary — National Institute of Standards and Technology (csrc.nist.gov) — authoritative definitions used for core terms and acronyms.
• ABCs of Cybersecurity glossary — SANS Institute (sans.org) — plain-language term definitions for beginners.
• Cybersecurity advisories and Secure Our World materials — Cybersecurity and Infrastructure Security Agency (cisa.gov) — terminology as used in current official reporting.
• National Cybersecurity Alliance resources — National Cybersecurity Alliance (staysafeonline.org) — everyday phrasing for common terms.

Course Record — Cybersecurity Terminology

• Learning outcomes: On completing this unit, the student can:
• distinguish threat, vulnerability, exploit, risk, incident, and breach and use each correctly
• name the main malware families by behaviour — virus, worm, trojan, ransomware, spyware, rootkit, and botnet
• tell phishing, spear phishing, whaling, smishing, vishing, spoofing, and BEC apart
• explain firewall, VPN, encryption, hashing, patch, and zero-day in plain language
• explain the difference between authentication and authorisation and where MFA fits
• decode MFA, DNS, IP, SOC, CISO, and SIEM, and write a short incident note using observed facts
• Study time: Approximately 1.5 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Certificate Topics — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).