What is a 'supply chain attack'?

Attacking a target by compromising a third-party vendor, software, or component the target trusts and uses — infecting the supply of something rather than attacking directly Attacks that target grocery stores and retailers by compromising their payment systems Stealing physical hardware from delivery trucks before it reaches companies Attacking the power supply infrastructure of a company's data center

What is 'credential stuffing'?

Automated attacks that take username/password pairs leaked from one breach and try them against hundreds of other websites — exploiting password reuse Flooding a login form with random credentials until the server crashes Physically inserting fake credential cards into card readers Stealing password manager databases and using them to access all stored accounts

What is 'lateral movement' in a cyberattack?

After gaining initial access to one system, attackers move through the network — using the first foothold to access more systems, escalate privileges, and reach high-value targets An attack that targets multiple companies in the same industry simultaneously Moving attack infrastructure to different servers to avoid being traced Attacking the sides of a network (branch offices) instead of headquarters

What is an 'Advanced Persistent Threat' (APT)?

Highly sophisticated, long-duration cyberattacks typically carried out by nation-states or well-funded criminal groups — they gain access, stay hidden for months, and pursue specific goals Attacks that use advanced AI to automatically adapt to and bypass security defenses A cybercriminal group that has been active for more than 10 years Software that persistently tries to break encryption over long periods

What is a 'brute force attack'?

Systematically trying every possible combination of characters until finding the correct password — effective against short or simple passwords but defeated by long ones Using physical force to gain access to a locked computer or server room Overwhelming a website with traffic using brute computational power Forcibly installing software by overriding operating system permission checks

What is 'cross-site scripting' (XSS)?

Injecting malicious JavaScript into a website's pages that then runs in other users' browsers — stealing their cookies, session tokens, or redirecting them to fake sites An attack where hackers cross-reference different websites to build profiles on users Using scripts to automatically click on ads across multiple websites to commit fraud A script that transfers data between two different websites without permission

What does 'responsible disclosure' mean in cybersecurity?

When a security researcher who finds a vulnerability privately notifies the vendor and gives them time to fix it before publicly disclosing the details When companies publicly admit to a breach and take responsibility for the damage A legal requirement that companies disclose all data breaches within 72 hours When governments share information about cyberattack techniques with other governments

What is a 'keylogger'?

Software (or hardware) that records every keystroke you type — capturing passwords, credit card numbers, messages, and anything else you type on an infected device A program that blocks unauthorized keyboard input on shared computers A tool administrators use to monitor how fast employees type Software that locks your keyboard when your computer detects suspicious activity

What is 'air gapping' and when is it used?

Physically isolating a computer or network from the internet and all other networks — used for the most sensitive systems like nuclear control systems, classified military networks, and industrial control systems Creating empty space (air gaps) between server racks to improve cooling and prevent overheating A wireless security technique that uses gaps in radio frequencies to prevent eavesdropping The physical distance between users and servers that determines network speed

Which career in cybersecurity involves attacking systems with permission to find weaknesses?

Ethical hacker / penetration tester — they use the same skills as criminal hackers but work legally to help organizations find and fix vulnerabilities Security analyst — they monitor network traffic for intrusions Malware analyst — they study malicious software to understand how it works Security architect — they design the security systems that protect organizations