Section 6, 7, 9

Ransomware

A type of malware that locks or encrypts files and demands payment to unlock them

Trojan horse

Malware disguised as legitimate software but contains malicious code

RAT (Remote Access Trojan)

A Trojan that allows remote control of the infected system

Worm

A standalone malware that self-replicates and spreads across networks

Spyware

Malware that secretly gathers user data without consent

Adware

Displays unwanted ads, may come bundled with other software

Keylogger

A type of spyware that records keystrokes to steal data

Logic bomb

Malicious code triggered by a specific event or condition

Rootkit

Software that hides its presence to maintain privileged access

Botnet

A network of infected machines controlled by an attacker

PUP (Potentially Unwanted Program)

Unwanted software installed without full user consent, often bundled

Bloatware

Pre-installed software that slows system performance

Fileless malware

Malware that operates in memory to avoid detection

Polymorphic malware

Malware that changes code to avoid detection

Data at rest

Data stored on a device (e.g., hard drive or flash drive)

Data in transit

Data moving through a network (e.g., email or web traffic)

Data in use

Data actively being processed by applications

Tokenization

Replacing sensitive data with non-sensitive placeholders

Data masking

Hiding real data with altered content for testing/training

Classification

Tagging data based on sensitivity level (e.g., public, confidential)

DLP (Data Loss Prevention)

Technology used to detect and prevent unauthorized data transfers

Obfuscation

Making code/data harder to understand to reduce exploitation

Anonymization

Removing personal identifiers from data completely

Pseudonymization

Replacing personal data with pseudonyms to protect privacy

Risk

Probability that a threat will exploit a vulnerability

Threat

Potential cause of an unwanted impact to a system

Vulnerability

Weakness in a system that can be exploited

Likelihood

The chance that a threat will actually exploit a vulnerability

Impact

Effect a threat exploiting a vulnerability would have

Risk assessment

Process of identifying and analyzing risks to systems

Risk register

A document listing known risks, impact, and mitigation strategies

Risk appetite

The amount of risk an organization is willing to accept

Risk tolerance

The acceptable variation in outcomes related to risk