Unit 11: Cyber Security and Incident Management - Lesson 1

Vocabulary practice flashcards defining core terms, threat sources, malware types, and business loss categories from BTEC Level 3 Unit 11 Lesson 1.

Cyber Security

The practice of protecting systems, devices, networks and data from digital attacks, unauthorised access, damage and disruption.

Threat

Something with the potential to cause harm to a system, network or data.

Vulnerability

A weakness or gap in a system, process or behaviour that a threat could exploit.

Internal Threats

Security threats originating from inside the organisation, such as from employees, contractors, visitors or authorised users, which may be deliberate or accidental.

External Threats

Security threats originating from outside the organisation, such as from attackers, criminal groups, competitors or other parties with no legitimate access.

Malware

Malicious software designed to damage, disrupt or gain unauthorised access to systems.

Spyware

A form of malware that secretly monitors user activity and collects sensitive data without consent.

Adware

Software that displays unwanted adverts, which can slow systems and redirect users to harmful sites.

Ransomware

A type of malware that encrypts files and demands payment for the decryption key.

Virus

Malware that attaches to legitimate files and spreads when those files are shared.

Worm

Self-replicating malware that spreads across networks without requiring user action.

Rootkit

Malware that hides deep within a system, giving attackers persistent and concealed access.

Trojan

Malware that disguises itself as legitimate software but carries a malicious payload.

Hacking

Attempting to gain unauthorised access to systems, accounts or networks by exploiting weaknesses in software, configurations or human behaviour.

Sabotage

Deliberately disrupting or destroying an organisation's systems or data.

Social Engineering

Manipulating people into revealing information or performing unsafe actions using psychological manipulation such as deception, urgency, authority or trust.

Operational Loss

A category of impact where systems, services or production processes become unavailable or degraded, disrupting the day-to-day running of an organisation.

Financial Loss

Direct costs, compensation, legal liability, regulatory fines (such as from the ICO under UK GDPR) and recovery expenses resulting from a cyber attack.

Reputation Loss

A category of impact resulting in damage to customer, partner and public trust in an organisation following a security breach.

Intellectual Property Loss

The theft of original ideas, proprietary source code, confidential product designs, research or trade secrets that give an organisation a competitive advantage.

Phishing

A deceptive attempt to steal sensitive credentials or distribute malware using fraudulent emails or messages that appear legitimate.

Impersonation

A psychological manipulation tactic where an attacker pretends to be a person of authority to create urgency and bypass security verification.

Fake IT Support Call

A social engineering tactic where an attacker poses as technical assistance personnel requesting login credentials under the guise of fixing a system problem.

Fake Login Page

A fraudulent replica website designed to deceive users and capture their entered account details.

Deliberate Internal Threat

An intentional malicious action taken by an authorized insider, such as employee data theft, unauthorized access, or sabotage.

Accidental Internal Threat

An unintentional security risk caused by employee mistakes, negligence, or inadequate training, such as sending sensitive files to an unintended recipient.

Information Commissioner's Office (ICO)

The independent UK supervisory authority responsible for enforcing data protection legislation and issuing financial penalties for security breaches.

UK GDPR

The primary United Kingdom data privacy regulation that sets legal requirements for handling personal information and imposes severe fines for data breaches.

State-Sponsored Actors

External cyber attackers backed by a government that target foreign infrastructure, intelligence, or proprietary commercial assets.

Organised Criminal Groups

Coordinated networks of attackers whose primary objective is monetary profit through schemes such as ransomware deployment and data extortion.

Attack Vector

The specific path, route, or technique an attacker utilizes to exploit a vulnerability and compromise a target system.

Three Pillars of Cyber Security

People, processes, and technology functioning collaboratively to provide holistic defense and mitigate risk.