Security Words Explained: Malware, Phishing, Encryption and More

Security warnings and news stories reuse a small vocabulary, and most of it is simpler than it sounds. Below are 29 cybersecurity terms explained in plain English and sorted into five families (harmful software, tricks aimed at people, stolen logins, locks on data, and software flaws with their fixes), each with an everyday example. The same protection often goes by several names: the UK’s National Cyber Security Centre (NCSC) files it under 2-step verification, while the US Cybersecurity and Infrastructure Security Agency (CISA) lists five names for multifactor authentication, including 2FA.¹²

The definitions draw on government glossaries from three countries (the UK, the US and Canada) and stay short on purpose. The habits themselves live in a beginner’s guide to staying safe online; keep this page beside it as the dictionary.

Cybersecurity terms explained: five families of words

Most cybersecurity terms name one of five things: software that does harm, a trick played on a person, a way into someone’s login, a way of locking data, or a flaw in software and its fix. Knowing the family tells you what is at risk and what kind of fix applies, even for a word you have never seen.

The vocabulary keeps growing because each new variant gets a name, often a blend of two older words. Smishing is SMS plus phishing, and malware is short for malicious software.¹ Once you spot the parts, a new word usually explains itself.

Names also differ between countries and companies. CISA notes that a settings menu may offer the same protection as “Two Factor Authentication” or “Multifactor Authentication”.² Canada’s Centre for Cyber Security treats two-factor authentication as one type of multi-factor authentication.³ Whatever your country or language, check what a setting does rather than trusting its name.

An invented headline of a familiar kind reads: “Zero-day exploited in ransomware attack on hospital.” It holds three words from two families: a flaw nobody had fixed yet (zero-day), a way of using that flaw (exploited) and the harmful software that followed (ransomware). Read that way, it says that attackers used an unfixed flaw to lock a hospital’s files.

Viruses, worms, trojans and the rest of the malware family

Malware, short for malicious software, is the umbrella term for any software that can damage computers, networks or devices, and viruses, ransomware and trojans are all kinds of it, according to the NCSC. The more specific names tell you how a program spreads or what it does once inside. The NCSC’s glossary separates them like this:¹

• Virus: malware that infects a legitimate program and spreads when that program is run. An infected file passed along on an old USB stick is the classic case.
• Worm: like a virus, but it copies itself across networks without anyone opening anything. One infected laptop on an office network can reach the others.
• Trojan: malware disguised as legitimate software, used to get into the victim’s computer. A “free” video converter from a site you have never heard of is the classic shape.
• Ransomware: malware that locks you out of your device or files, usually by encrypting them, while criminals demand a ransom to restore access.
• Spyware: malware that installs without your consent, collects data and sends it to someone else. A keylogger is software or hardware that secretly records every key you press, passwords included.
• Botnet: a network of infected devices used for coordinated attacks without their owners’ knowledge. Your own device could be part of one without you noticing.

The trojan is named after the wooden horse of Greek legend, and trojans usually spread through some form of trickery rather than by copying themselves.⁴ Ransomware has also changed: CISA, the US agency, says ransomware gangs often threaten to sell or leak stolen data if the ransom goes unpaid.⁵ A backup can bring your files back, but it cannot take back data that has already been copied.

Each one takes a different route. A trojan only gets in if someone installs it, so the defense starts with where you get your software. A worm moves on its own through flaws, so the defense is closing those flaws, covered in the section on flaws and fixes below. And ransomware turns a missing backup into a ransom demand.

Phishing, smishing and vishing use one trick on different channels

Social engineering is the umbrella term for manipulating people into doing something or handing over information, and the NCSC’s glossary lists phishing, smishing and spear-phishing as related forms. The names differ mainly by channel and by how closely the message is aimed at you:¹

• Phishing: scam emails or texts with links to websites that may carry malware or trick you into giving up passwords or sending money. A “your mailbox is full” email with a button to keep your messages is typical.
• Spear phishing: phishing aimed at particular people and dressed up as coming from someone they know or trust. When the target is a senior executive, it is called whaling.
• Smishing: SMS plus phishing, meaning untargeted texts sent to large numbers of people, such as a “missed parcel” message with a link.
• Spoofing: making a message look as if it comes from a legitimate source. Email addresses, display names and domains can all be faked.

Vishing is the same approach by voice. CISA notes that internet calling makes caller ID easy to fake, which exploits people’s trust in the phone network.⁶ A deepfake, a blend of “deep learning” and “fake”, is an image, video or audio clip edited or generated with artificial intelligence, and it may show a real person.⁷

These tricks work on people rather than on software, which is why software updates alone do not stop them. CISA describes attackers who pose as a new employee, a repair person or a researcher, asking harmless-sounding questions until the pieces add up.⁶

Put two of the words together and you get a common scam. Your phone shows your bank’s name, the caller knows your name, and they ask you to read out a code to “stop a payment”. That is vishing, made convincing by spoofing. CISA’s advice is to check the person’s identity directly with the organization they claim to represent,⁶ which in practice means hanging up and ringing the number printed on your bank card, or opening the bank’s own app.

Why one breach can open several of your accounts

A data breach is any incident in which data, computer systems or networks are accessed without permission. For ordinary people, its main danger comes afterwards, when stolen passwords are tried on other services: the NCSC calls that credential stuffing, and it preys on passwords that people reuse.¹

Credential stuffing involves no guessing at all. Software takes each stolen username-and-password pair and tries it, automatically and at large scale, on other websites.⁸ Guessing is a different attack: a brute force attack uses computing power to enter huge numbers of guesses, and password spraying turns that around by trying a few common passwords against many accounts.¹

Say a recipe site you joined years ago is breached. If your password there matches your streaming account, the attacker never has to guess anything; the breach did the work. That is the whole case for a different password on every account, which a password manager makes practical.

Two-factor authentication (2FA), multifactor authentication (MFA) and 2-step verification (2SV) all mean asking for a second proof besides your password. CISA sorts the proofs into three kinds: something you know, such as a PIN; something you have, such as an authenticator app or a text to your phone; and something you are, such as a fingerprint or face scan.² A stolen password then opens nothing on its own.

A passkey goes further and replaces the password itself. The FIDO Alliance, the industry group behind the standard, says you approve a sign-in with the same fingerprint, face scan, PIN or pattern you use to open your device. It also calls passkeys phishing-resistant and says there are no passwords to steal.⁹

After any breach notice, these words point to two moves: change that password wherever you reused it, and turn on a second step where offered.

Encryption words all come down to who holds the key

Encryption makes information unreadable to everyone except those who hold the key to decrypt it, as the NCSC defines it. The NCSC also separates data at rest, stored on disks or backups, from data in transit, moving across a network.¹

Both matter in ordinary life. An encrypted laptop that is stolen gives the thief a machine but not readable files, and an encrypted connection means anyone intercepting data on its way sees only scrambled text.

End-to-end encryption (E2EE) is the stricter version: messages are encrypted on the sender’s device so that only the sender and the intended recipients can read them, not even the company running the service. Many email and chat services encrypt messages only in transit, so the provider can still read them.¹⁰ A chat app with end-to-end encryption can deliver your message without being able to open it.

A VPN, or virtual private network, encrypts your traffic between your device and the VPN’s server, which stops your internet provider from reading it. It does not make you anonymous: the VPN company and the sites you visit may still see what you do.¹¹

Myth

A VPN makes me anonymous online.

Fact

A VPN stops your internet provider reading your traffic, but the VPN company and the sites you visit may still see your activity.

So when an app says your data is “encrypted”, ask the follow-up question: encrypted so that only you can read it, or so that the company can read it but outsiders can’t? Only end-to-end encryption promises the first.

How a software flaw goes from zero-day to patched

A vulnerability is a weakness or flaw in software, a system or a process; an exploit is a tool built to take advantage of one; and patching means installing the update that fixes it, in the NCSC’s definitions.¹ The US National Institute of Standards and Technology (NIST) describes a patch as a repair job for a piece of software, also known as a fix.¹²

A zero-day is a flaw that attackers can use before any fix is publicly available.¹ The name came to refer to the number of days the software maker has had to fix it: none. Once a fix exists, though, it protects only the devices where people install it.¹³

1. 1A flaw existsa vulnerability
2. 2Someone builds a toolan exploit
3. 3The maker ships a fixa patch
4. 4You install itonly now is your device protected

The clearest lesson on why the last step matters comes from a single, well-documented attack.

The study

Moderate evidence

An unpatched Windows flaw and the WannaCry attack of May 2017

In March 2017, Microsoft released a security update, rated critical, that fixed a serious flaw in Windows.¹⁴ On 12 May, the WannaCry ransomware attack hit more than 200,000 computers in at least 100 countries. In England, the UK’s National Audit Office found that every infected NHS organization had unpatched or unsupported Windows; most infected devices ran Windows 7 without that March update. NHS England estimated that more than 19,000 appointments would have been cancelled in total.¹⁵

WannaCry spread over networks, not through email: the audit found no case of it spreading through the NHS email system.¹⁵ That makes it a worm as well as ransomware, and a reminder that some attacks need nobody to click anything. This is one event in one country’s health service, where some medical equipment ran old Windows that hospitals could not update themselves. At home, turn on automatic updates.

Five pairs of words people mix up

Some words sit so close that they are easy to swap. Each pair below shares a family, and the difference lies in how the threat reaches you or in who can read your data, which is what changes the right response.

Getting the pair right changes the next step: a worm calls for updates more than caution about attachments, and a message that knows a colleague’s name deserves a call to that colleague on a number saved in your own contacts.

The bottom line

You don’t need to memorize every definition. Sort a new word into its family, ask what it wants from you, and check whether a fix already exists. Most of the time the answer is familiar: an update to install, a password not to reuse, or a message to verify with the sender by another route. The digital safety section goes deeper on each family.