The fascinating language of cyber security

The cyber security industry is awash with buzzwords and technical terms. Many appear obvious: a breach is a compromise of security, malware is a portmanteau of malicious and software, a virus is software which ‘infects’ a computer system.

However, many are considerably more opaque, with intriguing and unexpected origins. 

Take the subtitle of this blog: dancing pigs refers to users’ attitude to cyber security, where users will click an amusing graphic even despite security warnings; a trojan horse is a piece of software that appears benign but is in fact malicious; and a zombie is a computer that has been compromised by a hacker. So, in other words: “I clicked on a flashing graphic, it turned out to be a virus and now my computer is controlled by a hacker”. 

Even for better known terms such as phishing, few think of the origin of the word. A neologism of fishing, phishing is an electronic communication that appears trustworthy but is intended to fraudulently obtain sensitive information and data. It began with malicious actors attempting to gain access to AOL accounts in 1996: laying out email ‘lures’ allowing them to ‘fish’ for victims in a ‘sea’ of users. The ph is a tribute to John Draper (aka Captain Crunch), one of the founding fathers of what we now know as hacking, who invented “phone phreaking” – using audible tones to hack telephone systems in the 1970s. There are even ‘phish markets’ where credentials are traded as a form of currency. 

Fishing with worms can often result in a good day’s catch – the same applies to phishing with worms, another mainstay of cyber jargon. The first computer worm was created by Robert Morris, a student at Cornell University in 1988. A worm differs from a virus in that it doesn’t need a host to replicate – Robert Morris’s worm managed to shut down 6000 computers (10% of the internet in 1988) and took considerable effort and resources to fix. The term became widely known due to the notoriety of the incident, particularly as Robert’s father was the head of the National Security Agency (NSA) at the time…

As a result of threats such as phishing, viruses and worms, cyber security professionals are often required to wear a number of different hats when protecting businesses. It may seem odd, but a good knowledge of hats is essential to understanding cyber security, particularly when they are grey, white or black. A white hat hacker conducts ethical hacking, whereby they will test the security of a computer system in order to expose flaws, so the owner can rectify any security risks. A black hat hacker does the opposite, conducting malicious attacks for personal gain. The terms ‘black’ and ‘white’ reference Western movies in which often the hats worn by cowboys indicated whether they were good (white) or bad (black). Grey hat hackers, as you have probably guessed, lie somewhere between the two. 

Indeed, the hats don’t end there: green hat refers to fledgling hackers, blue hats are hackers that work outside an organisation but perform the same tests as white hat hackers. Red hat hackers are the vigilantes of the hacking world – they seek out black hats, conducting counter attacks against them, often breaking the law in the process. It’s a lot to get your head around, but nearly all hackers will ascribe themselves to one of these monikers. 

Cyber security language really takes a turn for the outlandish when it comes to the names for types of attack. Take for example, an evil maid attack, which refers to a hack which requires physical access to a computer (the kind of attack an evil maid might conduct). A man-in-the-middle attack is where someone surreptitiously puts themselves between two parties, impersonating them and altering their communication – this is an often used technique in CEO fraud. That is not to mention sniffing or spoofing, which refer to intercepting data unbeknownst to a user and impersonating someone familiar to a victim respectively. 

Wherever you look in the cyber security industry, there are terms and phrases, some of which make perfect sense, others which seem entirely random. There is a magical quality to the way they have emerged from internet forums, misnomers and science fiction, to come together in an organic and shifting lexicon. Of course, it can take a while to get your head around what it all means, but by understanding these words and concepts, the complex world of cyber security starts to make a lot more sense. 

You can learn more about the cyber security work we do at FieldHouse here. Or contact us at [email protected].