decrypting…# The A to Z of Cyber Security #CS This list portrays various Cybersecurity knowledge and terminology used in the field This List has been compiled by Crowdstrike ## A ### [Attack VectorsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/attack-vector/) An attack vector is the method or combination of methods that cybercriminals use to breach or infiltrate a victim’s network. ### [Advanced Persistent Threat (APT)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/advanced-persistent-threat-apt/) An advanced persistent threat (APT) is a sophisticated, sustained cyberattack in which an intruder establishes an undetected presence in a network in order to steal sensitive data over a prolonged period of time. ### [AI PCRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/ai-pc/) In this post, we’ll cover AI PC use cases in cybersecurity specifically, and various challenges associated with these new machines. ### [Active Directory (AD) AuditingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/active-directory-ad-auditing/) AD auditing is the process of tracking, logging, and reviewing activities in your Active Directory environment. Whether it’s detecting risky environment changes, monitoring privilege escalations, or meeting compliance requirements, auditing your AD setup and activity gives you the insights you need to secure your network. Think of it as the detective work that ensures your AD environment stays clean, compliant, and resilient to threats. ### [Active Directory Federation Services (AD FS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/active-directory-federation-service-adfs/) Active Directory Federation Services (AD FS) is a single sign on (SSO) feature developed by Microsoft that provides authenticated access to any domain, device, web application or system within the organization’s active directory (AD). ### [Advanced Endpoint Protection (AEP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/advanced-endpoint-protection-aep/) Advanced endpoint protection (AEP) is a next-generation endpoint security solution that uses AI, machine learning, and other intelligent automation capabilities to provide more comprehensive cybersecurity protection from a variety of modern threats. ### [Active Directory SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/active-directory-security/) Active Directory is a directory service offered by Microsoft Windows that helps administrators configure permissions and network access. ### [AI-Native XDRRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/ai-native-xdr/) The synergy between XDR and AI introduces a powerhouse solution — AI-native XDR — that offers a myriad of benefits to organizations. ### [Application SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/application-security/) Application security is a set of measures designed to prevent data or code at the application level from being stolen or manipulated. It involves security during application development and design phases as well as systems and approaches that protect applications after deployment. ### [API Security TestingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/api-security-testing/) API security testing helps teams address vulnerabilities early and often throughout the API development process. ### [Application Security Posture Management (ASPM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/application-security/application-security-posture-management-aspm/) ASPM is the process of evaluating, managing, and enhancing the security posture of an organization's custom applications. It ensures applications adhere to security standards, resist cyber threats, and remain compliant. ### [ASPM Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/aspm-best-practices/) Read this post to learn about five ASPM best practices that will help keep your application environments secure from adversaries. ### [Application Security Posture Management (ASPM) Use CasesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/aspm-use-cases/) There are many real-world scenarios where ASPM plays a crucial role in helping organizations fortify their application security. ### [ASOC vs. ASPMRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/application-security/asoc-vs-aspm/) ASOC and ASPM share common foundations in application security, with ASOC often viewed as a precursor to the broader and more holistic ASPM approach. ### [Application Security Orchestration and Correlation (ASOC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/application-security/application-security-orchestration-and-correlation-asoc/) By correlating data from multiple sources and analyzing patterns, ASOC tools enable security teams to de-duplicate and prioritize application security findings. Additionally, ASOC tools enable development teams to automate key workflows and streamline security processes, increasing speed and efficiency for vulnerability testing and remediation efforts. ### [Application Risk ScoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/application-security/application-risk-scoring/) In this post we’ll provide a clearer understanding of risk scoring, discuss the role of Common Vulnerability Scoring System (CVSS) scores (and other scoring standards), and talk about what it means to integrate business and data flow context into your risk assessment. ### [AWS MigrationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/aws-migration/) An AWS migration is the strategic process of moving digital assets — such as applications, databases, and IT processes — from on-premises or other cloud services to Amazon Web Services (AWS). ### [Automated IntelligenceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/automated-intelligence/) Learn more about how traditional defense measures have evolved to integrate automated systems that use AI/machine learning (ML) and data analytics and the role and benefits of automated intelligence as a part of a modern cybersecurity arsenal. ### [AI-Native CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/ai-native-cybersecurity/) AI-native cybersecurity uses cloud-native data platforms and cutting-edge AI to analyze datasets, identify patterns, and strengthen security posture. ### [Adversarial AI & MLRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/adversarial-ai-and-machine-learning/) Adversarial AI or adversarial machine learning (ML) seeks to inhibit the performance of AI/ML systems by manipulating or misleading them. These attacks on machine learning systems can occur at multiple stages across the model development life cycle. ### [Azure Kubernetes Service (AKS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/azure-kubernetes-service-aks/) Azure Kubernetes Service (AKS) is a managed Kubernetes service from Microsoft Azure that aims to simplify the deployment and management of Kubernetes clusters. ### [AI-Powered Behavioral AnalysisRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/ai-powered-behavioral-analysis/) AI-powered behavioral analysis leverages artificial intelligence to learn and predict adversarial behavior patterns. ### [AWS Infrastructure ObservabilityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/aws-infrastructure-monitoring/) In this article, we’ll cover the benefits of implementing infrastructure observability on AWS. We will explore a few key observability services from AWS, along with external services that you can integrate with your AWS account to enhance your monitoring capabilities. ### [Application Security Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/application-security/application-security-best-practices/) In this post, we will cover seven best practices that can ensure the resilience of your applications against ever-evolving threats. ### [Application WhitelistingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/application-whitelisting/) Application whitelisting is the approach of restricting the usage of any tools or applications only to those that are already vetted and approved. ### [Audit LogsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/audit-logs/) Audit logs are a collection of records of internal activity relating to an information system. Audit logs differ from application logs and system logs. ### [AWS Cloud SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/aws-cloud-security-best-practices/) In this article, we go beyond the generic AWS best practices and offer recommendations to help you scale and enhance your AWS security. ### [AWS CloudTrail vs. AWS CloudWatchRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/cloudtrail-vs-cloudwatch/) Amazon Web Services (AWS) offers various monitoring tools to assist users in monitoring their cloud systems. In this post, we’ll compare the AWS CloudTrail and AWS CloudWatch tools, exploring their key features, capabilities, differences, and similarities. ### [Access LogsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/access-logs/) An access log is a log file that records all events related to client applications and user access to a resource on a computer. Examples can be web server access logs, FTP command logs, or database query logs. ### [Application MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/application-monitoring/) Application monitoring is the process of collecting log data in order to help developers track availability, bugs, resource use, and changes to performance in applications that affect the end-user experience (UX). ### [AWS MisconfigurationsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/aws-misconfigurations/) In this article, we’ll explore the most common sets of misconfigurations across the most common services, and give advice on how to stay safe and prevent potential breaches when making any modification to your infrastructure ### [Attack SurfaceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/attack-surface/) An attack surface is the sum of all possible security risk exposures in an organization’s software environment. ### [Address Resolution Protocol (ARP) Spoofing: What It Is and How to Prevent an ARP AttackRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/arp-spoofing/) Address Resolution Protocol (ARP) spoofing or ARP poisoning is a form of spoofing attack that hackers use to intercept data. A hacker commits an ARP spoofing attack by tricking one device into sending messages to the hacker instead of the intended recipient. ### [Attack Surface ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/attack-surface-management/) Attack surface management is the continuous discovery, monitoring, evaluation, prioritization and remediation of attack vectors within an organization's IT infrastructure. ## B ### [Browser ExtensionsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/browser-extensions/) Browser extensions—sometimes referred to as plug-ins or add-ons—are small software modules that enhance and personalize the functionality of web browsers, such as Chrome, Firefox, Edge, and Safari. ### [Behavioral AnalyticsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/behavioral-analytics/) In the context of cybersecurity, behavioral analytics focuses on user behavior within networks and applications, watching for unusual activity that may signify a security threat. ### [Bring-Your-Own-Device (BYOD)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/bring-your-own-desk-byod/) Bring Your Own Device (BYOD) refers to a business policy that allows employees to use personally owned devices for work purposes. Common personal devices include smartphones, laptops, tablets, and flash drives. ### [Backdoor AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/backdoor-attack/) A backdoor attack is a clandestine method of sidestepping normal authentication procedures to gain unauthorized access to a system. It’s like a secret entrance that a burglar can use to get into a house — but instead of a house, it’s a computer or a network. ### [Bootkit: Definition, Prevention, and RemovalRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/bootkits/) Bootkit is a type of malware used by a threat actor to attach malicious software to a computer system and can be a critical threat to your business. ### [BackportingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/backporting/) Backporting is when a software patch or update is taken from a recent software version and applied to an older version of the same software. ### [Brute Force AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/brute-force-attack/) A brute force attack is uses a trial-and-error approach to systematically guess login info, credentials, and encryption keys. The attacker submits combinations of usernames and passwords until they finally guess correctly. ## C ### [Cookie LoggingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/cookie-logging/) Cookie logging is the process of collecting cookies from a user’s site session. ### [Continuous Threat Exposure Management (CTEM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/continuous-threat-exposure-management-ctem/) Continuous threat exposure management (CTEM) is a framework for proactively managing and mitigating threat exposure through an iterative approach that emphasizes building structured organizational processes in addition to leveraging security tools. ### [Cyber EspionageRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/cyber-espionage/) Cyber espionage, or cyber spying, is a type of cyberattack in which an unauthorized user attempts to access sensitive or classified data or intellectual property (IP) for economic gain, competitive advantage or political reasons. ### [Conditional AccessRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/conditional-access/) Conditional access (CA) is about control — deciding who gets access to which resources, when, and under what conditions. It’s a security strategy for organizations that tailors access based on real-time signals like user identity, device health, location, risk, and behavior patterns. ### [CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/) Cybersecurity is the act of defending digital assets, including networks, systems, computers and data, from cyberattacks. ### [Cyberattacks on Small BusinessesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/cyber-attacks-on-smbs/) Many small businesses may still fall into the trap of thinking that their organization isn’t large enough or high-profile enough to be the target for attackers. But the fact of the matter is that they have become an easy mark since many do not have advanced tools to defend the business, but they do have what hackers are after: data. ### [Cloud Access Security Broker (CASB)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-access-security-broker-casb/) A cloud access security broker (CASB) is a security intermediary between cloud users and cloud-based applications. ### [Cloud SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/) Cloud security refers to a broad set of strategies and technologies designed to protect data, applications, and infrastructure hosted in the cloud. ### [ContainerizationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/containerization/) Containerization is a software deployment technology that allows developers to package software and applications in code and run them in isolated compute environments as immutable executable images containing all the necessary files, configurations, libraries, and binaries needed to run that specific application. ### [Cloud VulnerabilitiesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-vulnerabilities/) Cloud vulnerabilities are weaknesses, oversights, or gaps in cloud infrastructure that attackers can exploit to gain unauthorized access and cause harm. ### [CNAPP vs CWPPRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cnapp-vs-cwpp/) Read this article to learn what the differences between CNAPP and CWPP and how they work together to improve cloud security. ### [Cyber Asset Attack Surface Management (CAASM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/cyber-asset-attack-surface-management-caasm/) ### [Cloud Security AssessmentRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-assessment/) A cloud security assessment is an evaluation that tests and analyzes an organization’s cloud infrastructure to ensure the organization is protected from a variety of security risks and threats. ### [Cloud Native SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-native/) Cloud native security is a collection of technologies and practices that comprehensively address the dynamic and complex needs of the modern cloud environment. ### [CDR vs CNAPPRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cdr-vs-cnapp/) ### [Cloud DetectionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-detection/) Cloud detection identifies threats, vulnerabilities, and malicious activities within an organization’s cloud infrastructure. ### [Cloud Native SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-native-security/) Cloud native security is a collection of technologies and practices that comprehensively address the dynamic and complex needs of the modern cloud environment. ### [Cloud FirewallRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-firewall/) A cloud firewall acts as a barrier between cloud servers and incoming requests by enforcing strict authorization, filtering requests, and blocking any potentially malicious requests from unauthorized clients. ### [Cloud Detection and Response (CDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-detection-and-response/) CDR is a security approach specifically designed for cloud environments that focuses on threat detection, immediate incident response, and service integrations. ### [Cloud ComplianceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-compliance/) Cloud compliance refers to the process of adhering to regulatory standards, international laws and mandates, and industry best practices (frameworks, benchmarks) in the context of cloud computing. ### [Cloud MigrationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-migration/) Cloud migration refers to moving everything a business does — from data to applications — into a cloud computing environment. ### [Cloud InfrastructureRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-infrastructure/) Cloud infrastructure is a collective term used to refer to the various components that enable cloud computing and the delivery of cloud services to the customer. This includes hardware, software, network devices, data storage and an abstraction layer that allows users to access virtualized resources. ### [Continuous Integration and Continuous Delivery (CI/CD) PipelineRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/continuous-integration-continuous-delivery-ci-cd/) CI/CD combines the practices of continuous integration (CI) and Continuous Delivery (CD) to allow DevOps teams to deliver code updates frequently, reliably, and quickly. ### [Common Vulnerability Scoring System (CVSS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/common-vulnerability-scoring-system-cvss/) ### [Cloud Security Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-best-practices/) In this blog, we’ll look at 20 recommended cloud security best practices organizations can implement throughout their cloud adoption process to keep their environments secure from cyberattacks. ### [Code SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/code-security/) Code security is the practice of writing and maintaining secure code. It means taking a proactive approach to dealing with potential vulnerabilities so more are addressed earlier in development and fewer reach live environments. ### [Cloud-Native Application Protection Platform (CNAPP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-native-application-protection-platform-cnapp/) A cloud-native application protection platform (CNAPP) is an all-in-one cloud-native software platform that simplifies monitoring, detecting, and acting on potential cloud security threats and vulnerabilities. ### [Cloud Security StrategyRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-strategy/) A cloud security strategy is a framework of tools, policies, and procedures for keeping your data, applications, and infrastructure in the cloud safe and protected from security risks. ### [Cloud Security Issues: Risks, Threats, and ChallengesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-risks/) The reasons behind cloud breaches run the gamut, but can be broadly classified into four cloud security challenges: human errors, runtime threats, shadow IT and poor strategic planning. ### [Container SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/container-security/) Container Security is the continuous process of using security tools to protect containers from cyber threats and vulnerabilities throughout the CI/CD pipeline, deployment infrastructure, and the supply chain. ### [Cybersecurity Risk AssessmentRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/cybersecurity-risk-assessment/) A cybersecurity risk assessment is a systematic process aimed at identifying vulnerabilities and threats within an organization's IT environment, assessing the likelihood of a security event, and determining the potential impact of such occurrences. ### [Cloud Infrastructure Entitlement Management (CIEM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-infrastructure-entitlement-management-ciem/) Cloud infrastructure entitlement management (CIEM) is a security process that helps security teams analyze and manage identities, access rights, privileges, and permissions in cloud environments. ### [Cybersecurity Advisory ServicesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/) Cybersecurity advisory services encompass high-level guidance and strategic planning to ensure that an organization's cybersecurity measures are comprehensive, current, and effective. ### [Cyber Insurance ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/cyber-insurance/) Cyber insurance, sometimes referred to as cyber liability insurance or cyber risk insurance, is a type of insurance that limits a policy holder’s liability and manages recovery costs in the event of a cyberattack, data breach or act of cyberterrorism. ### [Cyber Big Game HuntingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/big-game-hunting/) Cyber big game hunting is a type of cyberattack that usually leverages ransomware to target large, high-value organizations or high-profile entities. ### [Cloud Security FrameworksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-frameworks/) Cloud security frameworks are sets of guidelines, best practices, and controls organizations use to approach the security of their data, applications, and infrastructure in cloud computing environments. ### [Container Lifecycle ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/container-lifecycle-management/) Container lifecycle management is a critical process of overseeing the creation, deployment, and operation of a container until its eventual decommissioning. ### [CIS BenchmarksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/center-for-internet-security-cis-benchmark/) A CIS Benchmark is a meticulously crafted, comprehensive set of security configuration guidelines for a specific technology. Developed by the Center for Internet Security (CIS), these Benchmarks are key to enhancing an organization's ability to prevent, detect, and respond to cyber threats. ### [Cybersecurity TransformationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/cybersecurity-transformation/) Cybersecurity transformation is the implementation of a comprehensive cybersecurity strategy that encompasses various components, including risk management, threat intelligence, security governance, incident response readiness, regulatory compliance, and more. ### [Cloud Workload Protection (CWP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-workload-protection/) Cloud Workload Protection platforms offer organizations a solution to continuously monitor for, and remove threats from their cloud workloads and containers. ### [Cloud ComputingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-computing/) Cloud computing, commonly referred to as “the cloud", provides easy online access to a shared pool of configurable computing resources such as servers, storage, applications, and services. ### [Cloud Compromise AssessmentRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-compromise-assessment/) A cloud compromise assessment is an in-depth evaluation of an organization’s cloud infrastructure to identify, analyze, and mitigate potential security risks. Performing a regular assessment uncovers vulnerabilities and threats early. Assessments are crucial for maintaining a strong security posture. The main goal of the assessment is to uncover any signs of compromise before they can escalate into full-blown security incidents. ### [Credential StuffingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/credential-stuffing/) Credential stuffing is a cyberattack where cybercriminals use stolen login credentials from one system to attempt to access an unrelated system. ### [CybersquattingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/cybersquatting-domain-squatting/) Cybersquatting is the abusive practice of registering and using an internet domain name that is identical or similar to trademarks, service marks, personal names or company names with the bad faith intent of hijacking traffic for financial profit, delivering malware payloads or stealing intellectual property. ### [Cloud SprawlRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/cloud-sprawl/) Cloud sprawl is the uncontrolled proliferation of an organization's cloud services, instances, and resources. It is the unintended but often encountered byproduct of the rapid growth of an organization’s cloud services and resources. ### [Container ScanningRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/container-scanning/) Container scanning is the process of analyzing components within containers to uncover potential security threats. It is integral to ensuring that your software remains secure as it progresses through the application life cycle. ### [Crypto-MalwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/crypto-malware/) Crypto-malware is a type of malicious software, or malware, designed to carry out long-term cryptojacking cyberattacks. ### [Cybersecurity Platform Consolidation Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/platform-consolidation-best-practices/) Cybersecurity platform consolidation is the strategic integration of diverse security tools into a single, cohesive system, or, the concept of simplification through unification applied to your cybersecurity toolbox. ### [Cybersecurity SandboxingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/cybersecurity-sandboxing/) Cybersecurity sandboxing is the use of an isolated, safe space to study potentially harmful code. This practice is an essential tool for security-conscious enterprises and is instrumental in preventing the spread of malicious software across a network. ### [Computer WormRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/computer-worm/) A computer worm is a type of malware that can automatically propagate or self-replicate without human interaction, enabling its spread to other computers across a network. ### [Command and Control (C&C) AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/command-and-control-cac-attack/) C&C (also known as C2) is a method that cybercriminals use to communicate with compromised devices within a target company’s network. ### [Cybersecurity Platform ConsolidationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/platform-consolidation/) Cybersecurity platform consolidation is the strategic integration of diverse security tools into a single, cohesive system. ### [Compromise AssessmentsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/incident-response/compromise-assessments/) Compromise assessments are high-level investigations where skilled teams utilize advanced tools to dig more deeply into their environment to identify ongoing or past attacker activity in addition to identifying existing weaknesses in controls and practices. The intent of the comprehensive assessment is to answer the critical question: “Has my organization been breached?” ### [Cloud Incident ResponseRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-incident-response/) Cloud Incident Response (Cloud IR) is the process you follow when a cybersecurity incident occurs in your cloud environment. ### [Cloud Security ArchitectureRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-architecture/) Cloud security architecture is the umbrella term used to describe all hardware, software and infrastructure that protects the cloud environment and its components, such as data, workloads, containers, virtual machines and APIs. ### [Cloud Application SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-application-security/) Cloud application security is the process of securing cloud-based software applications throughout the development lifecycle. ### [Cloud Data SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-data-security/) Cloud data security refers to the technologies, policies, services and security controls that protect any type of data in the cloud from loss, leakage or misuse through breaches, exfiltration and unauthorized access. ### [Cross Site Scripting (XSS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/cross-site-scripting-xss/) Cross Site Scripting (XSS) is a code injection attack in which an adversary inserts malicious code within a legitimate website. ### [Cyber HygieneRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/cyber-hygiene/) Cyber hygiene refers to the practices computer users adopt to maintain the safety and security of their systems in an online environment. ### [Container-as-a-Service (CaaS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/container-as-a-service-caas/) This guide will explore containerization's key role in modern application development and deployment. It will also discuss how containers as a service (CaaS) fits into the broader cloud service landscape, helping you stay ahead of the curve in this ever-evolving field. ### [Cyber Threat HuntingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-hunting/) Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Cyber threat hunting digs deep to find malicious actors in your environment that have slipped past your initial endpoint security defenses. ### [Cyber Risk: Definition, Common Types and How To Protect Against ThemRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/cyber-risk/) Cyber risk measures the likelihood (probability) that an attacker may exploit a cyber threat, as well as considers the potential impact of that bad event, such as the loss of confidentiality, integrity and availability of an organization’s information. ### [Cloud GovernanceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-governance/) Cloud governance is a set of policies and rules used by companies who build or work in the cloud. This framework is designed to ensure data security, system integration and the deployment of cloud computing are properly managed. ### [Common Cloud Threats: Exploitation of Misconfigured Image ContainersRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/image-container-exploitation/) Developers sometimes use base images from an external registry to build their images. Unfortunately, these images can contain malware or vulnerable libraries. ### [Common Cloud Threats: Malware HostingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/malware-hosting/) Malware hosting occurs when cybercriminals use a free or compromised hosting account to host malware while using the hosting provider's reputation as cover. ### [Cloud Service Provider AbuseRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-service-provider-abuse/) Adversaries leverage cloud service providers to abuse provider trust relationships and gain access to additional targets through lateral movement. ### [Cloud Vulnerability ExploitationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-vulnerability-exploitation/) The fast adoption of the cloud has expanded the attack surface businesses must monitor and protect to avoid cloud vulnerability exploitation. ### [Credential TheftRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/credential-theft/) Credential theft is the act of stealing personal information such as usernames, passwords and financial information in order to gain access to an online account or system. ### [Common Log File FormatsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-file-formats/) A log format defines how the contents of a log file should be interpreted. Typically, a format specifies the data structure and type of encoding. ### [CRUD vs REST ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/crud-vs-rest/) In this article, we will introduce CRUD and REST, explain their similarities and differences, and then consider how to best monitor their performance. ### [CRUDRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/crud/) CRUD is the acronym for CREATE, READ, UPDATE and DELETE. These terms describe the four essential operations for creating and managing persistent data elements, mainly in relational and NoSQL databases. ### [Continuous MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/continuous-monitoring/) Continuous monitoring is an approach where an organization constantly monitors its IT systems and networks to detect security threats, performance issues, or non-compliance problems in an automated manner. ### [Container Security Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/container-security-best-practices/) This article discusses the concept of container security and its main challenges, as well as best practices for developing secure containerized applications. ### [CyberattacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/) A cyberattack is an attempt by cybercriminals, hackers or other digital adversaries to access a computer network or system, usually for the purpose of altering, stealing, destroying or exposing information. ## D ### [Deep Web vs Dark WebRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/dark-web-vs-deep-web/) “Deep web” and “dark web” are NOT interchangeable terms. The deep web is any part of the Net that is not indexed by search engines. The dark web uses encryption software to provide even greater security. ### [Data ComplianceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-compliance/) Data compliance is the practice of ensuring that sensitive and protected data is organized and managed in a way that enables organizations and government entities to meet relevant legal and government regulations. ### [Deepfake AttackRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/deepfake-attack/) Deepfakes are AI-generated forgeries — false images, audio, or video — that appear convincingly genuine. ### [Disinformation CampaignRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/disinformation-campaign/) In this post, we'll explore the mechanics of disinformation campaigns, deliberate efforts to spread false information. ### [Data Theft PreventionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-theft-prevention/) Understand data theft — what it is, how it works, and the extent of its impact and look into the principles and best practices for data theft prevention. ### [Dark AIRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/dark-ai/) Dark AI refers to the application of AI technologies — and notably, recent innovations in generative AI (GenAI) — for the purposes of accelerating or enabling cyberattacks. ### [Dark Web MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/dark-web-monitoring/) Dark web monitoring is the process of searching for, and tracking, your organization’s information on the dark web. ### [Data Flow MappingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/data-flow-mapping/) ### [Data ClassificationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/data-classification/) ### [Data OnboardingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/data-onboarding/) ### [Digital ForensicsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/digital-forensics/) ### [DevOps vs. DevSecOpsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/devops-vs-devsecops/) DevOps and DevSecOps share cultural similarities but address different business goals. Knowing when to use each practice or transition from DevOps to DevSecOps can improve your business. ### [DevOpsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/devops/) DevOps is a mindset and set of practices meant to effectively integrate development and operations into a cohesive whole in the modern product development life cycle. DevOps breaks down the divide between creating a product and maintaining it to allow for higher-paced service and application delivery. ### [Data PortabilityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-portability/) Data portability is the ability of users to easily transfer their personal data from one service provider to another. ### [Data Poisoning: The Exploitation of Generative AIRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/data-poisoning/) Data poisoning is a type of cyberattack in which an adversary intentionally compromises a training dataset used by an AI or machine learning (ML) model to influence or manipulate the operation of that model. ### [Data PrivacyRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-privacy/) Data privacy, also called information privacy, is an area of data protection that addresses the proper storage, access, retention, and security of sensitive data, which helps organizations meet regulatory requirements and protect the confidentiality and immutability of their data. ### [Data Loss Prevention (DLP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-loss-prevention-dlp/) Data loss prevention (DLP) is a set of tools and procedures that forms part of a company’s overall security strategy and focuses on detecting and preventing the loss, leakage, or misuse of data through breaches, exfiltration transmissions, and unauthorized use. ### [Data Protection vs Data SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-protection-vs-data-security/) Data protection and data security are often used interchangeably, but they have distinct focuses and objectives. Read this post to learn the difference. ### [Database MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/database-monitoring/) Database monitoring is the continuous tracking of a database’s activities and performance. It is crucial in helping optimize and tune database processes for high performance and reliability. Security is also another key factor to consider when it comes to monitoring databases due to the importance of this data. ### [Data SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-security/) Data security is the practice of protecting digital data from unauthorized access, use or disclosure in a manner consistent with an organization’s risk strategy. ### [Digital Forensics and Incident Response (DFIR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/digital-forensics-and-incident-response-dfir/) Digital Forensics and Incident Response (DFIR) is a field within cybersecurity that focuses on the identification, investigation, and remediation of cyberattacks. ### [Debug LoggingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/debug-logging/) Debug logging specifically focuses on providing information to assist in identifying and resolving bugs or defects. ### [Data EncryptionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-encryption/) Data encryption converts plain text into an encoded format to protect against unauthorized access to data. ### [Distributed Denial-of-Service (DDoS) AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/ddos-attack/) DDoS, short for distributed-denial-of-service, is a cyberattack that attempts to interrupt a server or network by flooding it with fake internet traffic, preventing user access and disrupting operations. ### [Denial-of-Service (DoS) AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/dos-attack/) A Denial-of-Service (DoS) attack is a cyberattack that floods a machine or network with false requests in order to disrupt business operations. ### [Data ObfuscationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-obfuscation/) Data obfuscation is the process of disguising confidential or sensitive data to protect it from unauthorized access. Data obfuscation tactics can include masking, encryption, tokenization, and data reduction. ### [Data BreachRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/data-breach/) A data breach is a security incident where an organization’s data is illegally stolen, copied, viewed, or released by an unauthorized individual or group. ### [Data ExfiltrationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/data-exfiltration/) Data exfiltration is the theft or unauthorized transfer of data from a device or network. ## E ### [Employee Cybersecurity Awareness Training ProgramRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/employee-cybersecurity-training-program/) CrowdStrike's how-to guide provides SMBs the steps & essentials (with examples) to develop the right training programs for your employees. ### [Entra ID: (formerly Azure Active Directory)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/entra-id/) In this article, we'll explore Entra ID, considering its advantages over traditional identity services. We’ll also look at how it integrates with CrowdStrike Falcon® Identity Protection to enhance your cybersecurity posture. ### [Extended Internet of Things (XIoT)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/extended-internet-of-things-xiot/) The extended internet of things (XIoT) is an umbrella term that includes all internet of things (IoT) or physical devices connected to the internet. It encompasses IoT, operational technology (OT), internet of medical things (IoMT), industrial IoT (IIoT), and supervisory control and data acquisition (SCADA). ### [EDR vs NGAVRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-ngav/) Discover more about two of the most critical elements to every cybersecurity architecture – endpoint detection and response (EDR) and next-generation antivirus (NGAV) – and the points organizations should consider when selecting and integrating these tools ### [EDR vs MDR vs XDRRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-mdr-vs-xdr/) Learn the differences between endpoint detection and response (EDR), managed detection and response (MDR) and extended detection and response (XDR). ### [EPP vs. EDRRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/epp-vs-edr/) EPP and EDR are two critical and distinct components within a comprehensive cybersecurity strategy. ### [Endpoint Protection Platforms (EPP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/endpoint-protection-platform-epp/) An endpoint protection platform (EPP) is a suite of endpoint security technologies such as antivirus, data encryption, and data loss prevention that work together on an endpoint device to detect and prevent security threats like file-based malware attacks and malicious activity. ### [Endpoint Protection SoftwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/endpoint-protection-software/) Endpoint protection software offers a centralized management system from which security administrators can monitor, protect, and investigate vulnerabilities across all endpoints, including computers, mobile devices, servers and connected devices. ### [Endpoint Detection and Response (EDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/endpoint-detection-and-response-edr/) Endpoint Detection and Response (EDR), also referred to as endpoint detection and threat response (EDTR), is an endpoint security solution that continuously monitors endpoint devices to detect and mitigate cyber threats. ### [Extended Detection and Response (XDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/extended-detection-and-response-xdr/) XDR (extended detection and response) collects and correlates data from endpoints, cloud workloads, networks and email, analyzes and prioritizes them, and delivers them to security teams in a normalized format through a single console. ### [EndpointsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/endpoint/) An endpoint is any device that can be connected to a network. Common examples of endpoints include computers, laptops, mobile phones, tablets and servers. ### [Endpoint SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/) Endpoint security, or endpoint protection, is the cybersecurity approach to defending endpoints – such as desktops, laptops, and mobile devices – from malicious activity. ### [Endpoint ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/endpoint-management/) Endpoint management is an IT and cybersecurity process that consists of two main tasks: evaluating, assigning and overseeing the access rights of all endpoints; and applying security policies and tools that will reduce the risk of an attack or prevent such events. ### [Endpoint MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/endpoint-monitoring/) Endpoint monitoring involves the continuous monitoring and management of devices that connect to a network, such as computers, mobile devices, and servers. ### [Exposure Management vs. Vulnerability ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/exposure-management-vs-vulnerability-management/) Exposure management and vulnerability management both play pivotal roles in supporting an organization’s security posture. However, they serve different functions in cybersecurity. ### [Exposure Management in CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/secops/exposure-management/) Exposure management is an organization’s process of identifying, assessing, and addressing security risks associated with exposed digital assets. Exposed assets include any endpoints, applications, or other cloud resources that can be used to breach an organization’s systems. ### [External Attack Surface Management (EASM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/external-attack-surface-management-easm/) External Attack Surface Management (EASM) refers to the continuous discovery, monitoring, evaluation, prioritization, and remediation of attack vectors of an organization's external attack surface. An External Attack Surface, also known as Digital Attack Surface, is the sum of an organization’s internet-facing assets and the associated attack vectors which can be exploited during an attack. ### [Ethical HackerRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/ethical-hacker/) An ethical hacker, also known as a ‘white hat hacker’, is employed to legally break into computers and networks to test an organization’s overall security. Ethical hackers possess all the skills of a cyber criminal but use their knowledge to improve organizations rather than exploit and damage them. ### [Exploit KitsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/exploit-kit/) An exploit kit is a toolkit that cybercriminals use to attack specific vulnerabilities in a system or code. ### [Error LogsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/error-logs/) An error log is a file that contains detailed records of error conditions a computer software encounters when it’s running. ### [Event LogRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/event-logs/) An event is any significant action or occurrence that's recognized by a software system and is then recorded in a special file called the event log. ### [Email Spoofing: How to Identify a Spoofed EmailRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/email-spoofing/) Email spoofing is a type of cyberattack that targets businesses by using emails with forged sender addresses. Because the recipient trusts the alleged sender, they are more likely to open the email and interact with its contents, such as a malicious link or attachment. ## F ### [Fileless MalwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/fileless-malware/) Fileless malware is a type of malicious activity that uses native, legitimate tools built into a system to execute a cyberattack. Unlike traditional malware, which typically requires a file to be downloaded and installed, fileless malware operates in memory or manipulates native tools, making it harder to detect and remove. ### [Free Antivirus vs Paid Antivirus SoftwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/free-vs-paid-antivirus/) In this guide, we outline the key differences between free and paid antivirus solutions available to small businesses and help owners decide which option is right for their company. ## G ### [Guide To Google Cloud MigrationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/google-cloud-migration/) Read this article to learn what a Google Cloud migration entails, its benefits, and the strategic approach needed for a successful transition. ### [Generative AI (GenAI) in CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/generative-ai/) Generative AI (GenAI) is a branch of artificial intelligence that focuses on generating new data based on existing data. This sophisticated technology enables a variety of use cases — such as data retrieval and analysis, content generation, and summarization — across a growing number of applications. ### [Guide On How To Protect Against RansomwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/how-to-protect-against-ransomware/) Businesses of all sizes are vulnerable to cyberattacks like ransomware. To protect against this increasing risk, business owners can invest in endpoint protection solutions and educate themselves about how to prevent and mitigate the impact of ransomware. ### [General Data Protection Regulation (GDPR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/general-data-protection-regulation-gdpr/) The General Data Protection Regulation (GDPR) is the European Union's (EU) personal data protection law that aims to protect the privacy of EU citizens. Enacted in May 2018, it imposes a unified set of rules on all organizations that process personal data originating from the EU, regardless of location. ### [Guide to Cloud Security Posture Management (CSPM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-posture-management-cspm/) Cloud security posture management (CSPM) automates the identification and remediation of risks across cloud infrastructures. ### [Golden Ticket AttackRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/golden-ticket-attack/) A Golden Ticket attack is a malicious cybersecurity attack in which a threat actor attempts to gain almost unlimited access to an organization’s domain. ## H ### [HoneypotsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/honeypots/) A honeypot is a cybersecurity mechanism that leverages a manufactured attack target to lure cybercriminals away from legitimate targets and gather intelligence about the identity, methods and motivations of adversaries. ### [How to choose between outsourced vs in-house cybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/in-house-vs-outsourced-cybersecurity/) Learn the benefits and challenges of in-house and outsourced cybersecurity solutions to find the best fit for your business. ### [HoneytokensRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/honeytokens/) Honeytokens are digital resources that are purposely designed to be attractive to an attacker, but signify unauthorized use. ### [How to Build a Zero Trust StrategyRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/how-to-build-a-zero-trust-strategy/) In this post, we'll outline a framework for a true Zero Trust model that adheres to industry best practices while specifically avoiding the potential pitfalls. ### [How to Hire a Cybersecurity Expert for Your Small BusinessRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/how-to-hire-a-cybersecurity-expert/) Cybersecurity specialists play a key role in securing your organization’s information systems by monitoring, detecting, investigating and responding to security threats. So how should you go about bringing top cybersecurity talent to your company? ### [Honey AccountRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/honey-account/) A honey account is a fabricated user account that triggers alerts for unauthorized activity when accessed. The honey account is part of your system, but it serves no real function other than incident detection. ### [How to Implement Zero Trust in StagesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/how-to-implement-zero-trust/) CrowdStrike offers the following recommendations to move Zero Trust along a journey of maturity based on your needs and priorities: ### [How to Choose the Right Cybersecurity Vendor for Your BusinessRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/how-to-choose-a-cybersecurity-vendor/) Learn the eight factors to use when assessing a cybersecurity vendor to help you choose the right fit for your business now and in the future. ### [How to increase your SMB cybersecurity budgetRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/how-to-increase-your-cybersecurity-budget/) Sharing helpful thought starters, considerations & tips to help IT leaders make the case for increasing their cybersecurity budget. Read more! ### [How to Mitigate Insider Threats for Small BusinessesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/mitigating-insider-threats/) In this post, we’ll take a closer look at insider threats – what they are, how to identify them, and the steps you can take to better protect your business from this serious threat. ### [How to Spot a Phishing EmailRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/how-to-spot-a-phishing-email/) The most common form of phishing attack is a phishing email. Discover the 7 telltale signs of a phishing email with examples here. ### [How to Create a Cybersecurity Budget for Your Small BusinessRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/how-to-create-a-cybersecurity-budget/) Creating a budget for your evolving cybersecurity needs is critical. Learn tips to develop a budget that covers the protection your small business needs. ### [How To Design a Cloud Security PolicyRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-policy/) A cloud security policy is a framework with rules and guidelines designed to safeguard your cloud-based systems and data. ### [Hashing in CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-hashing/) In the context of cybersecurity, hashing is a way to keep sensitive information and data — including passwords, messages, and documents — secure. ### [How To Prevent Ransomware: Pro TipsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/how-to-prevent-ransomware/) The following tips are supported by what CrowdStrike has found to successfully combat and prevent ransomware. ### [How Does Ransomware SpreadRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/how-ransomware-spreads/) As ransomware operators continue to evolve their tactics, it’s important to understand the 10 most common attack vectors used so that you can effectively defend your organization. ### [HIPAA Security RuleRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/hipaa-security-rule/) The HIPAA Security Rule specifies security standards for protecting individuals' electronic personal health information (ePHI) that is received, used, maintained, or transmitted by covered entities and their business associates. ### [Hybrid Cloud SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/hybrid-cloud-security/) Hybrid cloud security is the protection of data and infrastructure that combines elements of private cloud, public cloud, and on-premises infrastructure into a unified architecture. ### [Human Intelligence (HUMINT) in CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/human-intelligence-humint/) Human Intelligence (HUMINT) is a form of “on the ground” information gathering using human sources to collect information. ### [Hybrid CloudRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/hybrid-cloud/) A hybrid cloud combines elements of a public cloud, private cloud and on-premises infrastructure into a single, common, unified architecture allowing data and applications to be shared between the mixed IT environment. ### [How To Implement Phishing Attack Awareness TrainingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/phishing-attack-awareness-training/) As cybercrime of all kinds, and phishing, in particular, reaches new heights in 2023, it’s important for every person in your organization to be able to identify a phishing attack and play an active role in keeping the business and your customers safe. ### [Hypervisor (VMM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/hypervisors/) A hypervisor, or virtual machine monitor (VMM), is virtualization software that creates and manages multiple virtual machines (VMs) from a single physical host machine. ### [History of RansomwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/history-of-ransomware/) Ransomware first cropped up around 2005 as just one subcategory of the overall class of scareware. Learn how it's evolved since then. ### [HacktivismRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/hacktivism/) Hacktivism is a combination of the words “hack” and “activism”. Hacktivists engage in disruptive or damaging activity on behalf of a cause, be it political, social or religious in nature. ## I ### [Identity Access Management (IAM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/identity-access-management-iam/) Identity and access management (IAM) is a cybersecurity framework in which the IT team controls access to computer systems, cloud applications, networks, and assets based on each user or device’s digital identity. ### [IT SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/it-security/) IT security is the overarching term used to describe the collective strategies, methods, solutions and tools used to protect the confidentiality, integrity and availability of the organization’s data and digital assets. ### [Indicators of Attack (IOAs)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/indicators-of-attack-ioa/) IOAs are telltale signs or activities that signal a potential cybersecurity threat or attack is in progress. ### [Incident Response (IR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/incident-response/) Incident response (IR) is the steps used to prepare for, detect, contain, and recover from a data breach. ### [IT AutomationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/it-automation/) IT automation is the use of software to complete time-consuming, repetitive IT tasks without manual intervention. ### [Identity Security Posture Management (ISPM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/identity-security-posture-management-ispm/) Identity security posture management (ISPM) is a framework used to strengthen and maintain the security posture of an organization’s identity infrastructure to prevent breaches. ### [Insider Threat IndicatorsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/insider-threat-indicators/) An insider threat refers to the potential for a person to leverage a position of trust to harm the organization through misuse, theft or sabotage of critical assets. ### [Insider ThreatsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/insider-threat/) An insider threat is a cybersecurity risk that comes from within the organization — usually by a current or former employee or other person who has direct access to the company network, sensitive data and intellectual property (IP). ### [Identity Threat Detection and Response (ITDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/identity-threat-detection-and-response-itdr/) Identity threat detection and response (ITDR) is a security procedure for identifying, reducing, and responding to potential identity-based threats, such as compromised user accounts, leaked passwords, data breaches, and fraudulent activity. ### [Identity SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/) Identity security, also known as identity protection, is a comprehensive solution that protects all types of identities within the enterprise ### [Identity SegmentationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/identity-segmentation/) Identity segmentation is a method to restrict access to applications/resources based on identities. These identities could be human accounts, service (programmatic accounts), or privileged accounts. ### [Internet of Things (IoT) SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/internet-of-things-iot-security/) IoT security focuses on protecting, monitoring and remediating threats related to the Internet of Things (IoT) — the network of connected devices equipped to gather, store and share data via the internet. ### [Incident ResponderRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/incident-responder/) An incident responder is a key player on an organization's cyber defense line. When a security breach is detected, incident responders step in immediately. ### [IaC Scanning: Definition, Processes, and TechnologiesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/iac-scanning/) IaC scanning is the process of codifying infrastructure setup and configuration to enable organizations to automate and streamline their deployments. ### [Injection AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/injection-attack/) Injection attacks occur when attackers exploit vulnerabilities in an application to send malicious code into a system. ### [IT Asset DiscoveryRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/it-asset-discovery/) IT asset discovery is the process an organization uses to identify, catalog, and document all of its IT assets. ### [IT Asset Management (ITAM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/it-asset-management/) IT asset management (ITAM) includes digital, cloud and hardware asset management and is a crucial discipline in cybersecurity. ### [Infrastructure as Code (IaC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/infrastructure-as-code-iac/) Infrastructure as Code (IaC) is the process of dynamically managing and provisioning infrastructure through code instead of a manual process to simplify app development, configuration, and runtime. ### [Introduction to Malware Spam (Malspam)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/malware-spam-malspam/) Malspam, short for malicious spam or spam containing malware, is a spam email that delivers malware as the malicious payload. ### [Incident Response PlanRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/incident-response/incident-response-steps/) Most IR plans can be summed up in 4 common steps: Preparation, Detection & Analysis, Containment & Eradication, and Post-Incident Activity. ### [Identity-Based AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/identity-attack/) To better understand the identity threat landscape, let's explore seven common identity-based attacks and how they work: ### [IIS LogsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/iis-logs/) IIS creates log files for each website it serves. You can set the log file location for an IIS-hosted website from the “Logging” section of the website. ### [Indicators of Compromise (IOC) SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/indicators-of-compromise-ioc/) An Indicator of Compromise (IOC) is a piece of digital forensics that suggests that an endpoint or network may have been breached. ### [IOA vs IOCRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/ioa-vs-ioc/) Indicators of Attack vs Indicators of Compromise: Defining & Understanding the Differences ### [Infrastructure as a Service (IaaS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/infrastructure-as-a-service-iaas/) Infrastructure as a Service (IaaS) is a cloud computing model in which a third-party cloud service provider offers virtualized compute resources such as servers, data storage and network equipment on demand over the internet to clients. ## J ### [Just-in-Time (JIT) AccessRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/just-in-time-access/) Just-in-time (JIT) access is a dynamic, on-demand approach to access control that grants human and non-human identities permissions to an application or system only when they need them to perform a specific, necessary task and only for the minimal amount of time necessary. ## K ### [Kubernetes FrameworksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/Kubernetes-Frameworks--NIST-vs-CIS/) Kubernetes is a container orchestration system used to run various types of workloads, from user-facing web applications to backend processes. ### [Kubernetes Security Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/kubernetes-security-best-practices/) These practices are based on the 4 Cs, which are designed to help organizations achieve optimal security across the primary layers of typical Kubernetes environments. ### [Kubernetes as a Service (KaaS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/kubernetes-as-a-service-kaas/) KaaS is a managed solution offered by cloud providers to streamline the deployment, management, and operation of Kubernetes clusters. ### [Kubernetes with Admission ControllersRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/kubernetes-admission-controller/) In this article, we’ll take a deep dive into the world of Kubernetes admission controllers by discussing their importance, internal mechanisms, image scanning capabilities, and significance in the security posture of Kubernetes clusters. ### [Kubernetes vs DockerRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/kubernetes-vs-docker/) Docker is a versatile platform responsible for creating, managing, and sharing containers on a single host, while Kubernetes is a container orchestration tool responsible for the management, deployment, and monitoring of clusters of containers across multiple nodes. ### [Kerberoasting AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/kerberoasting/) Kerberoasting is a post-exploitation attack technique that attempts to crack the password of a service account within the Active Directory (AD). ### [Keyloggers: How They Work and How to Detect ThemRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/keylogger/) Keyloggers, or keystroke loggers, are tools that record what a person types on a device. While there are legitimate and legal uses for keyloggers, many uses for keyloggers are malicious. ### [Kubernetes vs. MesosRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/kubernetes-vs-mesos/) Container orchestration engines (COEs) make managing containerized workloads easier by automating operational tasks. Kubernetes and Apache Mesos are two of the most popular COEs. ## L ### [Lateral MovementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/lateral-movement/) Lateral movement refers to the techniques that a cyberattacker uses, after gaining initial access, to move deeper into a network in search of sensitive data and other high-value assets. ### [Low-Code Application PlatformRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/low-code-application-platform/) In this post, we’ll examine the low-code application platform — and its near cousin, the low-code application platform — consider its benefits and limitations, and look specifically at the role it can play in cybersecurity. ### [Log RetentionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-retention/) Log retention refers to how organizations store log files relating to security and for how long. It is a significant part of log management, and it’s integral to your cybersecurity. ### [Log StreamingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-streaming/) Log streaming in cybersecurity refers to the real-time transfer and analysis of log data to enable immediate threat detection and response. ### [Logging vs MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/logging-vs-monitoring/) In this article, we’ll explore logging and monitoring processes, looking at why they’re important for managing applications. We’ll also cover best practices to integrate logging with monitoring to obtain robust visibility and accessibility over an entire application. ### [Logging Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/logging-best-practices/) This article considers some logging best practices that can lay the groundwork for a robust and scalable logging infrastructure. ### [Logging Levels ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/logging-levels/) Setting up meaningful log levels is an important step in the log management process. Logging levels allow team members who are accessing and reading logs to understand the significance of the message they see in the log or observability tools being used. ### [Log AnalysisRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-analysis/) Log analysis is the process of reviewing computer-generated event logs to proactively identify bugs, security threats, factors affecting system or application performance, or other risks. ### [Log Files ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-file/) A log file is an event that took place at a certain time and might have metadata that contextualizes it. ## M ### [Man in the Middle (MITM) AttackRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/man-in-the-middle-mitm-attack/) A man-in-the-middle attack is a type of cyberattack in which an attacker eavesdrops on a conversation between two targets. ### [Malware vs VirusRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/malware-vs-virus/) The term malware describes any program or code created with the intent to do harm to a computer, network or server. A virus is a type of malware limited only to programs or code that self-replicates or copies itself in order to spread to other devices or areas of the network. ### [Managed XDR (MXDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/managed-extended-detection-and-reponse-mxdr/) Managed XDR (MXDR) is an outsourced security service that provides advanced detection and response capabilities using a combination of digital technologies and human-led expertise. ### [Mobile Threat Defense (MTD)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/mobile-threat-defense-mtd/) Mobile threat defense combines real-time threat detection, automated response and remediation, and comprehensive visibility and control. Learn more! ### [Multi-factor Authentication (MFA)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/multifactor-authentication-mfa/) Multi-factor authentication (MFA) is a multi-layered security system that grants users access to a network, system or application only after confirming their identity with more than one credential or authentication factor. ### [MDR vs SOCRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/mdr-vs-soc/) Cybersecurity tools and services abound, but two standout services are managed detection and response (MDR) and security operations center (SOC) services. ### [Most Common Types of CyberattacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/common-cyberattacks/) Cyberattacks can target a wide range of victims from individual users to enterprises or even governments. When targeting businesses or other organizations, the hacker’s goal is usually to access sensitive and valuable company resources, such as intellectual property (IP), customer data or payment details. ### [Machine Learning and AI in Identity SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/machine-learning-and-ai-in-iam/) In the domain of identity security, AI presents a promising pathway forward. By harnessing AI-driven identity security solutions, organizations can strengthen their defenses against identity-based attacks. ### [Managed Security Services (MSS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/) Managed security services (MSS) is an umbrella term used to describe any cybersecurity service or solution offered by a third-party provider or managed security service provider (MSSP). ### [Multi-Cloud ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/multi-cloud-management/) Maintaining consistent security across platforms is crucial in a multi-cloud environment. Learn more about challenges and best practices! ### [Multi-Cloud SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/multi-cloud-security/) It is important to implement multi-cloud security to protect your infrastructure, application, and data across multiple clouds. ### [Multi-Cloud Vulnerability ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/multi-cloud-vulnerability-management/) Multi-cloud vulnerability management is the continuous process of identifying and remediating security vulnerabilities across all your cloud environments, whether they’re public, private, or hybrid. ### [Managed Detection and Response (MDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/managed-security-service-provider-mssp/managed-detection-and-response-mdr/) Managed detection and response (MDR) is a cybersecurity service that combines technology and human expertise to perform threat hunting, monitoring, and response. ### [Managed Detection and Response (MDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/managed-detection-and-response-mdr/) Managed detection and response (MDR) is a cybersecurity service that combines technology and human expertise to perform threat hunting, monitoring, and response. ### [Machine Learning (ML)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/machine-learning/) This article provides an overview of foundational machine learning concepts and explains the growing application of machine learning in the cybersecurity industry, as well as key benefits, top use cases, common misconceptions and CrowdStrike’s approach to machine learning. ### [Managed Cloud SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/managed-cloud-security/) Managed cloud security protects an organization’s digital assets through advanced cybersecurity measures, performing tasks like constant monitoring and threat detection. ### [MDR vs MSSP: Defining both solutions and uncovering key differencesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/mdr-vs-mssp/) In this post, we explore these two services, outline their key differentiators and help organizations decide which option is best for their business. ### [MITRE ATT&CK FrameworkRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/mitre-attack-framework/) The MITRE ATTACK Framework is a curated knowledge base that tracks cyber adversary tactics and techniques used by threat actors across the entire attack lifecycle. ### [MSP vs. MSSP: Understanding the differenceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/msp-vs-mssp/) While both MSPs and MSSPs are third-party providers, the primary difference between the two is the scope of their offerings. Learn more here! ### [Microservices ArchitectureRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/microservices-architecture/) A microservice-based architecture is a modern approach to software development that breaks down complex applications into smaller components that are independent of each other and more manageable. ### [Managed Security Service Providers (MSSP) ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/managed-security-service-provider-mssp/) A managed security service provider (MSSP) is an external party that provides cybersecurity services to its customers. ### [Malware AnalysisRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/malware-analysis/) Malware analysis is the process of understanding the behavior and purpose of a suspicious file or URL to help detect and mitigate potential threats. ### [Multi-CloudRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/multi-cloud/) Multi-cloud is when an organization leverages multiple public cloud services. These commonly consist of compute and storage solutions, but there are numerous options from various platforms to build your infrastructure. ### [MalwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/) Malware (malicious software) is an umbrella term used to describe a program or code created to harm a computer, network, or server. Cybercriminals develop malware to infiltrate a computer system discreetly to breach or destroy sensitive data and computer systems. ### [Malware Detection TechniquesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/malware-detection/) Malware detection is a set of defensive techniques and technologies required to identify, block and prevent the harmful effects of malware. This protective practice consists of a wide body of tactics, amplified by various tools. ### [Mean Time to Repair ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/mean-time-to-repair-mttr/) Mean time to repair (MTTR) is a key performance indicator (KPI) that represents the average time required to restore a system to functionality after an incident. ### [Malicious Code: What It Is and How to Prevent ItRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/malicious-code/) Malicious code is a term for code designed to cause damage, security breaches, or other threats to application security. ### [MalvertisingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/malvertising/) Malvertising is a relatively new cyberattack technique that injects malicious code within digital ads. ### [Most Common Types of Cyber VulnerabilitiesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/cyber-vulnerabilities/) In this article, we review the 7 most common types of vulnerabilities, including: misconfigurations, unsecured APIs, zero days, unauthorized access, and unpatched software. ## N ### [Next-Gen SIEMRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/) Next-gen SIEM is the evolution of traditional SIEM in response to digital advancements like cloud computing, big data, and remote work models to extend visibility beyond traditional perimeters. ### [Network SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/network-security/) Network security refers to the tools, technologies and processes that protect an organization’s network and critical infrastructure from unauthorized use, cyberattacks, data loss and other security threats. ### [Non-Human IdentitiesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/non-human-identities/) Non-human identities (NHIs) are digital identities for applications, services, or devices. Organizations use these identities to execute automatic machine-to-machine operations. Organizations grant NHIs specific permissions, but they often ignore the principle of least privilege (POLP). As a result, NHIs can create security vulnerabilities. ### [Network SegmentationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/network-segmentation/) Network segmentation is a strategy used to segregate and isolate segments in the enterprise network to reduce the attack surface. ### [Next-Generation Antivirus (NGAV)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/next-generation-antivirus-ngav/) Next-Generation Antivirus (NGAV) uses a combination of artificial intelligence, behavioral detection, machine learning algorithms, and exploit mitigation, so known and unknown threats can be anticipated and immediately prevented. ### [Next Gen SIEM for Small BusinessRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/next-gen-siem-for-small-business/) ### [Network MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/network-monitoring/) Network monitoring is an IT process that continuously monitors and evaluates a computer network and its assets. ## O ### [Open Source Intelligence (OSINT)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/open-source-intelligence-osint/) Open source intelligence (OSINT) is the act of gathering and analyzing publicly available data for intelligence purposes. ### [Open XDRRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/open-xdr/) Open XDR is a type of extended detection and response (XDR) security solution or platform that supports third-party integrations to collect specific forms of telemetry to enable threat detection, hunting and investigation across the different data sources and execute response actions. ### [Open XDR vs. Native XDRRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/open-xdr-vs-native-xdr/) Extended detection and response (XDR) is often broken into two main categories: open XDR and native XDR. Open XDR relies on third party integrations for full coverage of telemetry, while native XDR handles all collection and response tasks from a single vendor platform. ### [ObservabilityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/) Observability is when you infer the internal state of a system only by observing its external outputs. For modern IT infrastructure, a highly observable system exposes enough information for the operators to have a holistic picture of its health. ### [Observability vs. MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/observability-vs-monitoring/) Monitoring tells you that something is wrong. Observability uses data collection to tell you what is wrong and why it happened. ## P ### [Pass-the-Hash AttackRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/pass-the-hash-attack/) Pass the hash is a type of cybersecurity attack in which an adversary steals a “hashed” user credential and uses it to create a new user session on the same network. ### [Passwordless AuthenticationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/passwordless-authentication/) ### [Password StorageRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/password-storage/) Cybersecurity experts strongly recommend using a password manager to safely store account information on all connected devices, including desktops, laptops, tablets and smartphones. ### [Principle of Least Privilege (POLP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/principle-of-least-privilege-polp/) The principle of least privilege (POLP) is a computer security concept and practice that gives users limited access rights based on the tasks necessary to their job. ### [PhishingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/phishing-attack/) Phishing is a type of cyberattack where threat actors masquerade as legitimate companies or individuals to steal sensitive information such as usernames, passwords, credit card numbers, and other personal details. ### [Privileged Access Management (PAM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/privileged-access-management-pam/) Privileged access management helps organizations manage and secure access to their most critical systems, applications, and data, which are typically reserved for privileged accounts. ### [Patch ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/patch-management/) Patch management is the process of identifying and deploying software updates, or “patches,” to a variety of endpoints, including computers, mobile devices, and servers. ### [Policy As Code (PaC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/policy-as-code/) Policy as Code is the representation of policies and regulations as code to improve and automate policy enforcement and management. ### [Public CloudRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/public-cloud/) A public cloud is a third-party IT management solution that hosts on-demand cloud computing services and physical infrastructure using the public internet. ### [PCI DSS ComplianceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/pci-dss-requirements/) The Payment Card Industry Data Security Standard (PCI DSS) is a framework developed by the Payment Card Industry Security Standards Council (PCI SSC) to help secure and protect all payment card account data. ### [Penetration Testing (Pen Testing)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/penetration-testing/) Penetration testing, or pen testing, is the simulation of real-world attacks in order to test an organization’s detection and response capabilities. ### [Public Cloud vs Private CloudRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/public-cloud-vs-private-cloud/) The key difference between public and private cloud computing relates to access. In a public cloud, organizations use shared cloud infrastructure, while in a private cloud, organizations use their own infrastructure. ### [Purple Teaming ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/purple-teaming/) A purple team is a group of cyber security professionals who simulate malicious attacks and penetration testing in order to identify security vulnerabilities and recommend remediation strategies for an organization’s IT infrastructure. ### [PostgreSQL vs. MySQLRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/postgresql-vs-mysql/) In this article, we will learn about the main features of PostgreSQL and MySQL, compare the two database management systems, and learn when to use PostgreSQL vs MySQL. ### [Platform as a Service (PaaS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/platform-as-a-service-paas/) Platform as a Service (PaaS) is a cloud computing model in which a third-party cloud provider maintains an environment for customers on a pay-as-you-go basis to build, develop, run and manage their own applications. ### [Password SprayingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/password-spraying/) A Password spraying attack involve an attacker using a single common password against multiple accounts on the same application. ### [Privilege EscalationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/privilege-escalation/) A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. ## Q ### [Questions to Ask Zero Trust VendorsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/questions-to-ask-zero-trust-vendors/) ## R ### [RansomwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/) Ransomware is a type of malware that encrypts a victim’s data until a payment is made to the attacker. If the payment is made, the victim receives a decryption key to restore access to their files. If the ransom payment is not made, the malicious actor publishes the data on data leak sites (DLS) or blocks access to the files in perpetuity. ### [Remote Desk Protocol (RDP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/remote-desk-protocol-rdp/) RDP is software that allows users to control a remote desktop as if it were local. ### [Role-Based Access Control (RBAC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/role-based-access-control/) Role-based access control is a mechanism where you allow users to access certain resources based on permissions defined for the roles they are assigned to. ### [Remote Monitoring and Management (RMM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/remote-monitoring-management-rmm/) Remote monitoring and management (RMM) is used by IT departments in many organizations to help oversee and administer IT systems from a remote location. ### [Regulatory ComplianceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/regulatory-compliance/) In this article, we’ll discuss regulatory compliance, exploring the challenges that organizations commonly encounter. ### [Ransomware Examples: Recent Ransomware AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/ransomware-examples/) In this post, we explore 16 recent ransomware examples to outline the adversaries behind them and how they work. ### [Rootkit MalwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/rootkits/) Rootkit malware is a collection of software designed to give malicious actors control of a computer, network or application. ### [Risk Based Vulnerability ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/risk-based-vulnerability-management/) Risk-based vulnerability management is a cybersecurity process that aims to identify and remediate vulnerabilities that pose the greatest risk to an organization. ### [Red Teaming: How Red Team Testing Prepares You for CyberattacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/red-teaming/) Red team testing uses ethical hacking by simulating real-world techniques so your team can identify vulnerabilities in your system and practice response methods. Red teaming goes beyond a penetration test, or pen test, because it puts a team of adversaries — the red team — against an organization’s security team — the blue team. ### [Runtime Application Self-Protection (RASP)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/runtime-application-self-protection-rasp/) Runtime Application Self-Protection (RASP) is a term coined by Gartner to describe a technology that incorporates security functionality within software applications to prevent malicious attacks while the application is running. ### [Red Team vs Blue TeamRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/red-team-vs-blue-team/) In a red team/blue team exercise, the red team is made up of offensive security experts who try to attack an organization's cybersecurity defenses. The blue team defends against and responds to the red team attack. ### [Ransomware as a Service (RaaS) Explained How It Works & ExamplesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/ransomware-as-a-service-raas/) Ransomware as a Service (RaaS) is a business model used by ransomware developers, in which they lease ransomware variants in the same way that legitimate software developers lease SaaS products. ### [Ransomware DetectionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/ransomware-detection/) Ransomware detection is the first defense against dangerous malware since it finds the infection earlier so that victims can take action to prevent irreversible damage. ### [Ransomware Recovery: Steps to Recover your DataRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/ransomware-recovery/) A ransomware recovery plan is a playbook to address a ransomware attack, which includes an incident response team, communication plan, and step-by-step instructions to recover your data and address the threat. ### [Remote Code Execution (RCE): Principles and FunctionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/remote-code-execution/) Remote code execution (RCE) refers to a class of cyberattacks in which attackers remotely execute commands to place malware or other malicious code on your computer or network. ## S ### [ScarewareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/scareware/) Scareware is a type of malware attack that claims to have detected a virus or other issue on a device and directs the user to download or buy malicious software to resolve the problem. ### [Serverless SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/serverless-security/) In serverless architectures, security responsibilities are divided between the cloud provider and the customer, according to what is known as the shared responsibility model. ### [Small Business Cybersecurity ChecklistRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/cybersecurity-checklist/) Our cybersecurity checklist will help SMBs uncover any risk areas & identify opportunities for improving the security of your operations. ### [Shift LeftRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/shift-left-security/) Shifting left in the context of DevSecOps means implementing testing and security into the earliest phases of the application development process. This process is known as “shift left” because it moves the security or testing component to the left (earlier) in the software development life cycle. ### [Semi-Structured DataRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/semi-structured-data/) ### [Shift Left vs. Shield Right in KubernetesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/shift-left-vs-shield-right-kubernetes/) Learn how security teams can combine shift left and shield right concepts throughout the software development lifecycle to achieve stronger Kubernetes security posture. ### [Software SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cybersecurity/software-security/) Software security refers to a set of practices that developers incorporate into the software development life cycle and testing processes to ensure their digital solutions remain secure and are able to function in the event of a malicious attack. ### [Security as a Service (SECaaS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/security-as-a-service-secaas/) Security as a service (SECaaS) is a comprehensive solution that helps an organization address any security issue without needing its own dedicated security staff. ### [Software as a Service (SaaS)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/software-as-a-service-saas/) Software as a Service (SaaS) is a cloud-based software delivery model that allows users to access applications through an internet-connected device rather than requiring an upfront purchase and installation of physical software. ### [SOC-as-a-ServiceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/soc-as-a-service-socaas/) SOC-as-a-Service (SOCaaS) is a security model wherein a third-party vendor operates and maintains a fully-managed SOC on a subscription basis via the cloud. ### [Shadow ITRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/shadow-it/) Shadow IT is the unauthorized use of any digital service or device that is not formally approved of and supported by the IT department. ### [Security Operations Center (SOC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/security-operations-center-soc/) A security operations center, or SOC, is a central location where security experts monitor, detect, analyze, respond to, and report security incidents. ### [SOC Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/soc-best-practices/) Building a first-class security operations center is no simple feat – maintaining it is even harder. We discuss four security operations center best practices that every organization should strive for. ### [Security Data LakeRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/data-lake/) This innovation represents a pivotal development in cybersecurity, offering a centralized repository capable of efficiently storing, managing, and analyzing diverse security data, thereby addressing the critical challenges posed by the data deluge. ### [SOC AutomationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/soc-automation/) Automation significantly boosts the efficiency of SOCs by streamlining processes and handling repetitive, manual tasks. Automation not only accelerates threat detection and mitigation but allows SOC teams to focus on more strategic tasks. ### [Security Orchestration, Automation and Response (SOAR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/security-orchestration-automation-and-response-soar/) Security orchestration, automation and response (SOAR) is a collection of software programs developed to bolster an organization’s cybersecurity posture. A SOAR platform enables a security analyst team to monitor security data from a variety of sources, including security information and management systems and threat intelligence platforms. ### [Software Composition Analysis (SCA)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/software-composition-analysis/) Software composition analysis (SCA) is a technique used for examining the software components that make up an application and then identifying and managing any vulnerabilities discovered. ### [Security as Code (SaC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/security-as-code/) Security as code (SaC) is the integration of automated security measures directly into the software development process, making it an integral part of the software development life cycle (SDLC). SaC introduces proactive rather than reactive security measures, an essential approach given the increasing sophistication of modern cyber threats. ### [Spear-PhishingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/spear-phishing/) Spear-phishing is a targeted attack that uses fraudulent emails, texts and phone calls in order to steal a specific person's sensitive information. ### [Security PostureRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/security-posture/) An organization’s security posture is a holistic snapshot of their security strengths and vulnerabilities across hardware, software, data, and user behavior. ### [Software Development Lifecycle (SDLC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/software-development-lifecycle-sdlc/) The software development life cycle (SDLC) outlines the stages involved in building software applications, from inception to retirement. ### [Serverless Architecture ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/serverless-architecture/) Serverless architecture is a software development approach in which developers can run applications without managing the underlying infrastructure. In the serverless computing model, the cloud provider handles all infrastructure setup, maintenance, and scaling. ### [SBOM (Software Bill of Materials)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/software-bill-of-materials-sbom/) In this post, we will cover the key parts of an SBOM, the benefits and challenges for an organization adopting SBOMs, and how an organization might integrate the usage of SBOMs within its current suite of security tools. ### [Social EngineeringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/) Social engineering is an umbrella term that describes a variety of cyberattacks that use psychological tactics to manipulate people into taking a desired action, like giving up confidential information. ### [Snort and Snort Rules ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/snort-rules/) Snort is an open-source network intrusion detection and prevention system (IDS/IPS) that monitors network traffic and identifies potentially malicious activities on Internet Protocol (IP) networks. ### [SecOpsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/secops/) SecOps is an approach that combines the processes, tools, and highly skilled staff from both security and IT departments into a single, unified team. ### [Security AutomationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/security-automation/) Security automation is the practice of using technology to perform recurring IT security tasks, such as endpoint scanning and incident response, with limited human intervention. ### [SIEM vs Log ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/siem-vs-log-management/) Understand the difference in capabilities, definitions, and costs between a SIEM and a log management solutions (LMS). ### [SmishingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/smishing-attack/) Smishing is the act of sending fraudulent text messages designed to trick individuals into sharing sensitive data such as passwords, usernames and credit card numbers. ### [Silver Ticket AttackRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/silver-ticket-attack/) Similar to a golden ticket attack, a silver ticket attack compromises credentials by taking advantage of the Kerberos protocol. ### [Structured, Unstructured and Semi Structured Logging ExplainedRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/structured-logging/) Structured, semi structured and unstructured logging falls on a large spectrum each with its own set of benefits and challenges. Unstructured and semi structured logs are easy to read by humans but can be tough for machines to extract while structured logs are easy to parse in your log management system but difficult to use without a log management tool. ### [Server MonitoringRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/server-monitoring/) Server monitoring provides visibility into network connectivity, available capacity and performance, system health, and much more. ### [Security MisconfigurationRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/security-misconfiguration/) Security misconfiguration is any error or vulnerability present in the configuration of code that allows attackers access to sensitive data. There are many types of security misconfiguration, but most present the same danger: vulnerability to data breach and attackers gaining unauthorized access to data. ### [Security TestingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/security-testing/) Security testing is a type of software testing that identifies potential security risks and vulnerabilities in applications, systems and networks. ### [Shared Responsibility ModelRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/shared-responsibility/) The Shared Responsibility Model dictates that a cloud provider must monitor and respond to security threats related to the cloud itself and its underlying infrastructure and end users are responsible for protecting data and other assets they store in any cloud environment. ### [SQL Injection (SQLi): How to Protect against SQL Injection AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/sql-injection-attack/) SQL injection (SQLi) is a cyberattack that injects malicious SQL code into an application, allowing the attacker to view or modify a database. Injection attacks, which include SQL injections, were the third most serious web application security risk in 2021. ### [SOA vs MicroservicesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/soa-vs-microservices/) As development teams require more flexibility, scalability and speed, traditional monolithic software development models have become largely obsolete. To meet the needs of the modern landscape, two options have emerged for effectively and efficiently building and running large-scale, complex applications: service oriented architecture (SOA) and microservices. ## T ### [Threat Detection and Response (TDR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-detection/) Threat detection and response (TDR) refers to cybersecurity tools that identify threats by analyzing user behaviors. ### [Types of RansomwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/types-of-ransomware/) The most common types of ransomware are cryptoware, locker ransomware, scareware, leakware, and ransomware-as-a-service. ### [The Dark WebRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/dark-web/) The dark web is the part of the internet where users can access unindexed web content anonymously through special web browsers like TOR. ### [Threat Intelligence PlatformsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-intelligence-platforms/) A Threat Intelligence Platform automates the collection, aggregation, and reconciliation of external threat data, providing security teams with most recent threat insights to reduce threat risks relevant for their organization. ### [Threat Detection, Investigation, and Response (TDIR)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-detection-investigation-response-tdir/) Threat detection, investigation, and response (TDIR) is a cybersecurity process for finding, analyzing, and mitigating threats. ### [Tips and Tools to Scale Your Cybersecurity ProgramRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/small-business/how-to-scale-your-cybersecurity-program/) Get the 9 essential tips and tools that’ll help your organization scale its cybersecurity program. ### [Tabletop ExerciseRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/advisory-services/tabletop-exercise/) Tabletop exercises are a form of cyber defense training in which teams walk through simulated cyberattack scenarios in a structured, discussion-based setting. ### [The Role of AI in CybersecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/) Learn how cybersecurity tools integrate AI, the primary applications of AI, and the benefits of tools that integrate AI. ### [The Fundamentals of Kubernetes SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/kubernetes-security/) Kubernetes security is the application of techniques and processes to protect cloud-native applications running on Kubernetes (also known as K8s) from vulnerabilities or malicious actors. ### [Types of Social Engineering Attacks and how to prevent themRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/types-of-social-engineering-attacks/) Explore ten of the most common types of social engineering attacks and how to prevent them. ### [Three Pillars of ObservabilityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/three-pillars-of-observability/) The three pillars of observability are logs, metrics, and traces. These three data outputs provide different insights into the health and functions of systems in cloud and microservices environments. ### [Threat IntelligenceRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/) Threat intelligence is data that is collected, processed, and analyzed to understand a threat actor's motives, targets, and attack behaviors. ### [The Zeus Trojan Malware — Definition and PreventionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/zeus-malware/) The two primary goals of the Zeus trojan horse virus are stealing people’s financial information and adding machines to a botnet. ### [The Most Common Types of MalwareRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/types-of-malware/) While there are many different variations of malware, there are several types that you are more likely to encounter. ### [Threat ActorRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-actor/) A threat actor, also known as a malicious actor, is any person or organization that intentionally causes harm in the digital sphere. ### [Threat ModelRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-model/) A threat model evaluates threats and risks to information systems, identifies the likelihood that each threat will succeed and assesses the organization's ability to respond to each identified threat. ## U ### [User and Entity Behavior Analytics (UEBA)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/user-and-entity-behavior-analytics-ueba/) User and entity behavior analytics (UEBA) systems monitor an organization’s network, using AI and machine learning (ML) to analyze suspicious activity related to user and endpoint behavior that could indicate a security threat. ### [Understanding Data GravityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/data-gravity/) Data gravity is a term that captures how large volumes of data attract applications, services, and even more data. ### [Understanding the Difference Between Spoofing vs PhishingRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/spoofing-vs-phishing/) Spoofing attacks resemble identity theft while phishing attacks attempt to steal sensitive information. ## V ### [Vulnerability AssessmentRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/vulnerability-assessment/) Vulnerability assessment is the ongoing, regular process of defining, identifying, classifying and reporting cyber vulnerabilities across endpoints, workloads, and systems. ### [Vishing: Definition and PreventionRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/vishing-attack/) Vishing, a voice phishing attack, is the fraudulent use of phone calls and voice messages pretending to be from a reputable organization to convince individuals to reveal private information such as bank details and passwords. ### [Vulnerability ManagementRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/vulnerability-management/) Vulnerability management is the ongoing, regular process of identifying, assessing, reporting on, managing and remediating security risks to keep all systems and assets in a network protected. ### [Virtualization vs. Containerization: What’s the Difference?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/virtualization-vs-containerization/) Learn the differences between containers and virtual machines (VMs), compare and contrast them, and review some use cases showing where one or the other is preferable ### [Virtual Private Cloud (VPC)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/virtual-private-cloud/) A VPC is a single compartment within the entirety of the public cloud of a certain provider, essentially a deposit box inside the bank’s vault. ### [Vulnerability Management LifecycleRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/vulnerability-management-lifecycle/) There are five main stages in the vulnerability management lifecycle include: Assess, Prioritize, Act, Reassess, Improve. ## W ### [Windows New Technology LAN Manager (NTLM)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/identity-protection/windows-ntlm/) Windows New Technology LAN Manager (NTLM) is a suite of security protocols offered by Microsoft to authenticate users’ identity and protect the integrity and confidentiality of their activity. ### [Web Application Firewall (WAF)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/web-application-firewall-waf/) A Web Application Firewall (WAF) is a security device designed to protect organizations at the application level by filtering, monitoring and analyzing HTTP and HTTPS traffic between the web application and the internet. ### [What is DevSecOps? Key Benefits and Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/devsecops/) DevSecOps is a philosophical framework that combines aspects of software development, security, and operations into a cohesive whole. With DevSecOps, developers are more aware of and responsible for maintaining security best practices within their code. It also means operations and security teams implement tools and policies that provide regular security checks throughout the continuous integration/continuous delivery (CI/CD) pipeline. ### [What Is Managed SIEM?: Managed Detection and Response for SIEMRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/managed-siem/) Managed SIEM gives you the functionalities of traditional SIEM but with the benefits of a managed service model. Along with the strengthened security posture that traditional SIEM affords your organization, you can offload the burden of managing complex SIEM technologies in-house. ### [What Is a Cloud Workload Protection Platform (CWPP)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-workload-protection-platform-cwpp/) A cloud workload protection platform (CWPP) is a unified cloud security solution that offers continuous threat monitoring and detection for cloud workloads across different types of modern cloud environments. ### [What is Infrastructure as Code Security?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/iac-security/) Infrastructure as code security is the practice of addressing security configuration issues in the IaC layer rather than scanning deployed cloud resources. ### [What Is Data Security Posture Management (DSPM)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/data-security-posture-management-dspm/) DSPM helps organizations manage their data across the cloud, monitor for risks, enforce security policies, and ensure regulatory compliance. ### [What is File Integrity Monitoring?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/file-integrity-monitoring/) File integrity monitoring (FIM) is a security process that monitors and analyzes the integrity of critical assets, including file systems, directories, databases, network devices, the operating system (OS), OS components and software applications for signs of tampering or corruption, which may be an indication of a cyberattack. ### [What is CrowdStrike Counter Adversary Operations (CAO)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/counter-adversary-operations-cao/) Counter Adversary Operations unites intelligence and threat hunting teams to disrupt modern adversaries and raise their cost of doing business. ### [What is Data Leakage?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/data-protection/data-leakage/) Data leakage refers to the unauthorized transfer of data from inside an organization to an external destination. ### [What is a Managed Service Provider (MSP)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/managed-security/managed-service-provider-msp/) Managed service providers (MSPs) offer a wide range of IT and cybersecurity services to help organizations manage and optimize their technology infrastructure. ### [What is Automated Intelligence?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/automated-intelligence/) Learn more about how traditional defense measures have evolved to integrate automated systems that use AI/machine learning (ML) and data analytics and the role and benefits of automated intelligence as a part of a modern cybersecurity arsenal. ### [Wiper AttacksRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/wiper-attack/) Wiper attacks are malware-based attacks designed to permanently delete or corrupt data on targeted systems. ### [What is a Security Operations Center (SOC) Framework?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/soc-framework/) A SOC framework acts like a blueprint, defining the systematic approach a SOC ought to employ as it detects, analyzes, and responds to cybersecurity threats. ### [What are Security Operations Center (SOC) Reports?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/soc-reports/) SOC reports distill complex security data into actionable intelligence, keeping you ahead of threats. ### [What is Mobile Malware?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/mobile-malware/) Mobile malware is malicious software designed to target mobile devices. Click here to read about the different types and distribution methods. ### [What is a Whaling Attack? (Whaling Phishing)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/whaling-attack/) A whaling attack is a social engineering attack against a specific executive or senior employee with the purpose of stealing money or information, or gaining access to the person’s computer in order to execute further attacks. ### [What is Data Protection?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/secops/data-protection/) Data protection is a process that involves the policies, procedures and technologies used to secure data from unauthorized access, alteration or destruction. ### [What is TrickBot Malware?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/trickbots/) TrickBot malware is a banking Trojan released in 2016 that has since evolved into a modular, multi-phase malware capable of a wide variety of illicit operations. ### [What Is a Supply Chain Attack?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/supply-chain-attack/) A supply chain attack is a type of cyberattack that targets a trusted third party vendor who offers services or software vital to the supply chain. ### [What Is Security Information and Event Management (SIEM)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/security-information-and-event-management-siem/) Security information and event management (SIEM) is a set of tools and services that combine security events management (SEM) and security information management (SIM) capabilities that helps organizations recognize potential security threats and vulnerabilities before business disruptions occur. ### [What Is Cyber Resilience?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/cyber-resilience/) Cyber resilience is the concept that describes an organization’s ability to minimize the impact of an adverse cyber event and restore their operational systems to maintain business continuity. ### [What Is Credential Harvesting?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/credential-harvesting/) Credential harvesting is a cyberattack technique where cybercriminals gather user credentials — such as user IDs, email addresses, passwords, and other login information — en masse. ### [What is Adware and How To Remove ItRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/adware/) Adware — or advertising-supported software — is automated, unwanted software designed to monitor online user behavior and bombard them with targeted advertisements, banners and pop-ups. ### [What is a Threat Intelligence Feed?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-intelligence-feeds/) A threat intelligence feed is a real-time, continuous data stream that gathers information related to cyber risks or threats. ### [What Is SEO Poisoning?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/seo-poisoning/) SEO poisoning is a technique used by threat actors to increase the prominence of their malicious websites, making them look more authentic to consumers. ### [What are Downgrade Attacks?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/downgrade-attack/) In a downgrade attack, an attacker forces the target system to switch to a low-quality, less secure mode of operation. ### [What Is Cloud Monitoring?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-monitoring/) Cloud monitoring is the practice of measuring, evaluating, monitoring, and managing workloads inside cloud tenancies against specific metrics and thresholds. It can use either manual or automated tools to verify the cloud is fully available and operating properly. ### [What Is Business Email Compromise (BEC)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/business-email-compromise-bec/) Business email compromise (BEC) is a cyberattack technique whereby adversaries assume the digital identity of a trusted persona in an attempt to trick employees or customers into taking a desired action, such as making a payment or purchase, sharing data or divulging sensitive information. ### [What Are Living off the Land (LOTL) Attacks?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/living-off-the-land-attack/) Living off the land (LOTL) is a fileless malware cyberattack technique where the cybercriminal uses native, legitimate tools within the victim’s system to sustain and advance an attack. ### [What is DevOps Monitoring?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/devops-monitoring/) DevOps monitoring is the practice of tracking and measuring the performance and health of systems and applications in order to identify and correct issues early. ### [What Is Cybersecurity? Definition, Types, Tips, and MoreRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/what-is-cybersecurity/) Cybersecurity is the act of defending digital assets, including networks, systems, computers and data, from cyberattacks. ### [What Is Infrastructure Monitoring?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/infrastructure-monitoring/) Infrastructure Monitoring allows teams to collect operational and performance data from their systems to diagnose, fix, and improve them. ### [What is Logging as a Service (LaaS)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/logging-as-a-service-laas/) Logging as a service (LaaS) is a solution that centralizes the collection, analysis, monitoring and management of logs. In this article, you’ll learn what LaaS is and why it's important. You’ll also discover the differences between LaaS and traditional log monitoring solutions, and how to choose a LaaS provider. ### [What Is Log Rotation?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-rotation/) Learn about the basics of log rotation—why it’s important, and what you can do with your older log files. ### [What is Log Aggregation?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-aggregation/) Log aggregation is the mechanism for capturing, normalizing, and consolidating logs from different sources to a centralized platform for correlating and analyzing the data. ### [What is Log Management? The Importance of logging and best practicesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-management/) Log management is the practice of continuously gathering, storing, processing, synthesizing and analyzing data from disparate programs and applications. ### [What is Log Parsing?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-parsing/) Log parsing is the process of converting log data into a common format to make them machine-readable. ### [Web Server LogsRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/web-server-logs/) A web server log is a text document that contains a record of all activity related to a specific web server over a defined period of time. ### [What is Data Logging?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/data-logging/) Data logging is the process of capturing, storing and displaying one or more datasets to analyze activity, identify trends and help predict future events. ### [What is Detection Engineering?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/detection-engineering/) Detection engineering is the process of identifying threats before they can do significant damage. ### [What Is CVE? Common Vulnerabilities & ExposuresRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/common-vulnerabilities-and-exposures-cve/) Common Vulnerabilities and Exposures (CVEs) is a framework and international effort to maintain updated registry of all known computer security vulnerabilities and exposures. ### [What Does Ransomware Allow Hackers to Do?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/how-ransomware-allows-hackers-to-compromise-data/) In a ransomware attack, hackers use malware to encrypt, delete or manipulate data, intellectual property or personal information. This allows attackers to hold the information, device or system digitally hostage until the victim meets the cybercriminal’s ransom demands, which usually involve secure, untraceable payment. ### [What is Domain Spoofing?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/domain-spoofing/) Domain spoofing is a form of phishing where an attacker impersonates a known business or person with fake website or email domain to fool people into the trusting them. ### [What is the Cyber Kill Chain? Process & ModelRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/cyber-kill-chain/) The cyber kill chain is an adaptation of the military’s kill chain, which is a step-by-step approach that identifies and stops enemy activity. ### [What is Cloud Encryption?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-encryption/) Cloud encryption is the process of transforming data from its original plain text format to an unreadable format before it is transferred to and stored in the cloud. ### [What Is Real User Monitoring (RUM)?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/real-user-monitoring-rum/) Real User Monitoring (RUM) monitors application performance by capturing every user interaction on a website or mobile application. In this article, we’ll learn about RUM and why businesses need it. We’ll consider its benefits and how you can choose a RUM solution for your business. ### [What is Cryptojacking?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/cryptojacking/) Cryptojacking is the unauthorized use of a person's or organization's computing resources to mine cryptocurrency. ### [What is an Application Log?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/observability/application-logs/) Software applications generate logs when something occurs within (or affects) the application. IT teams typically use application log data to investigate outages, troubleshoot bugs, or analyze security incidents. ### [What is Cloud Analytics?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-analytics/) Cloud analytics is an umbrella term encompassing data analytics operations that are carried out on a cloud platform to produce actionable business insights. ### [What is Centralized Logging?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/centralized-logging/) Centralized logging is the process of collecting logs from networks, infrastructure, and applications into a single location for storage and analysis. ### [What is Spyware?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/spyware/) Spyware is a type of unwanted, malicious software that infects a computer or other device and collects information about a user’s web activity without their knowledge or consent. ### [What is a Spoofing Attack?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/spoofing-attack/) Spoofing is when a cybercriminal disguises communication or activity from a malicious source and presents it as a familiar or trusted source. ### [What is Pretexting?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/pretexting-attack/) Pretexting is a form of social engineering in which an attacker gets access to information, a system or a service through deceptive means. The attacker will present a false scenario — or pretext — to gain the victim’s trust and may pretend to be an experienced investor, HR representative, IT specialist or other seemingly legitimate source. ### [What is a Polymorphic Virus? Detection and Best PracticesRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/polymorphic-virus/) A polymorphic virus, sometimes referred to as a metamorphic virus, is a type of malware that is programmed to repeatedly mutate its appearance or signature files through new decryption routines. ### [What is a Trojan Horse?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/trojans/) A Trojan Horse (Trojan) is a type of malware that disguises itself as legitimate code. Attackers can export files, modify data, and delete files on your device. ### [What's the Difference Between Spear Phishing vs. Phishing?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/social-engineering/spear-phishing-vs-phishing/) Spear phishing is a targeted attack on a specific person or organization, whereas general phishing campaigns are sent to a large volume of people. ### [What is Defense in Depth?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/defense-in-depth/) Defense in depth provides intensive security measures using a layered approach to protect your company from cyberattacks. ### [What is a Botnet?Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/malware/botnets/) A botnet is a network of computers infected with malware that are controlled by a bot herder. ## X ### [XDR vs SIEM vs SOARRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/xdr-vs-siem-vs-soar/) XDR, SIEM, and SOAR address similar use cases but take fundamentally different approaches. Learn how they relate and how they differ. ## Z ### [Zero-Day ExploitRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/zero-day-exploit/) A Zero-Day Exploit is the technique or attack a malicious actor deploys to leverage an unknown security vulnerability to gain access into a system. ### [Zero Trust ArchitectureRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/zero-trust-architecture/) A Zero Trust Architecture refers to the way network devices and services are structured to enable a Zero Trust security model. ### [Zero Trust Network Access (ZTNA)Read More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/zero-trust-network-access-ztna/) Zero Trust network access (ZTNA) is an IT technology solution that requires all users to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data. ### [Zero Trust vs. SASERead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/zero-trust-vs-sase/) We will take a closer look at Zero Trust and SASE and answer some common questions that organizations have when incorporating these into their overarching cybersecurity framework. ### [Zero Trust SecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust-security/) Zero Trust is a security concept that requires all users to be authenticated and authorized before being granted access to applications and data. ### [ZeroSecurityRead More >]( https://www.crowdstrike.com/en-us/cybersecurity-101/zero-trust/) Identity protection, also known as identity security, is a comprehensive solution that protects all types of identities within the enterprise