Adware – software that displays advertisements; you may see popup ads or a small window or bar that displays ads in your browser.

Back door – a means of accessing your computer that bypasses computer security mechanisms.

Back up (verb) – to copy an electronic record to ensure its information will not be lost, often while compressing data to save space.

Backup (noun) – a copy of an electronic record, maintained to protect the information from loss and often compressed to save space.

Bot – short for robot, a computer on which intruders have installed software that lets them secretly control the system from a remote location on the Internet.

Botnet – a network of bots connected via the Internet to perform tasks, such as installing malware, sending spam, or attacking other computers.

Compromised computer – a computer that cannot be considered secure, because it has been infected with malware, been accessed by someone without authority to access it, or been subject to some other form of malicious attack.

Configure – to choose options in order to create a custom system.

Denial of Service (DoS) – an attack that successfully prevents or impairs the authorized functionality of networks, systems or applications by exhausting resources. This activity includes being the victim of or participating in the DoS.

Drive-by download – software downloaded by a malicious web site without your knowledge.

Encryption – the process of transforming information to make it unreadable to anyone who doesn’t have the password needed to decode it.

Extended Validation Certificate (EV Cert) - A certificate that, prior to being issued, requires verification of a web site’s authenticity by a certificate authority. See www.cabforum.org for a list of extended validation guidelines (steps required before a certificate authority issues an EV Cert), and a current list of Certificate Authority Browser Forum members.

Firmware – software that is embedded into hardware; it can be updated and accessed by the user.

Firewall – a security system that uses hardware and/or software mechanisms to prevent unauthorized users from accessing an organization’s internal computer network.

Any machine connecting to the Internet should use a firewall. There are two types of firewalls. Software firewalls usually run on computers. Hardware firewalls are separate devices designed to efficiently protect computers. They are usually used by businesses, organizations, schools, and governments. All firewall protection creates a barrier between the computers and the Internet.

Flash drives/thumb drives – very small portable storage devices that may store very large (gigabyte) quantities of information and can be attached to a USB or firewire port quickly and easily to transfer files.

Instant messaging (IM) – the ability to exchange short messages online with coworkers or others. IM solutions can take several forms. They can use an existing Internet-based service, or they can be an Intranet-only solution implemented and controlled within an IT department. The latter is significantly more secure than the former, but lacks access to business partners.

Keylogger – software that records everything you type, then sends it off to whomever installed the software.

Malware – a contraction of “malicious software,” malware is a general term used to describe software that infiltrates or damages a computer.

Mobile device (contemporary devices are typically called smart phones or tablets) – a portable device that can be used to perform computer-like tasks, such as browsing the web or reading email, but does not run under a standard desktop operating system, such as Windows, OS X or Linux.  This distinction is what makes mobile devices a particular security challenge; standard forms of protection are unavailable or not feasible for general use.  The devices typically offer Internet activity through Wi-Fi and/or a telecommunications company data service.  

Peer-to-peer (P2P) – a network of computers that can directly access each other’s files.

Phishing – the process of attempting to acquire sensitive information used for identity theft, such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an email or instant message, or via a web site or telephone call.

Software patches – fixes to correct a problem. People are constantly finding security holes (vulnerabilities) in computer software that could be used to infect your computer with a virus, spyware, or worse. When vulnerabilities are discovered, the software vendor typically issues a fix (patch) to correct the problem. Patches should be applied as soon as possible because the average time for someone to try to exploit a security hole can be as little as a few days.

Spyware – malware whose principal aim is to surreptitiously collect information by “spying” on the user.

SSL (Secure Sockets Layer) – a method that uses data encryption and digital certificate authentication to secure information traveling over the Internet.

Trojan – malware that appears to perform a benign or useful action but in fact performs a malicious action, such as transmitting a computer virus.

URL (Uniform Resource Locator) – the Internet address on the World Wide Web. It usually begins with http:// followed by the rest of the name of the resource. It is the common name for a site’s web page.

Virus – self-replicating malware that attaches itself to a digital document or application, then spreads through copies of that document or application that are shared, frequently via email or USB drives. Viruses almost always corrupt or modify files.

Vulnerability – a weakness in a computer that allows an attacker to make unauthorized changes. Vulnerabilities include weak passwords, poor configuration, or software bugs.

Worm – self-replicating malware that can move from computer to computer on the network. Unlike a virus, it does not need to attach itself to an existing document or application. Worms almost always cause harm to the network, if only by consuming bandwidth.

Zombie – a computer that has been compromised, often by a botnet, so that an unauthorized person has complete control to use the computer to perform malicious tasks.

Credit Card Payment Processing: Credit card numbers used for payment processing are regulated through a trade association agreement with the Payment Card Industry (PCI). Examples: credit card numbers, names, and other information used for payment processing.

Data stewards: Senior officers of the university responsible for determining how data in their area should be handled. For example, the Vice President for Human Resources is the data steward for administrative data pertaining to Cornell employees. The data steward role is defined in University Policy 4.12, Data Stewardship and Custodianship.

Export Controlled Research: Export Controlled Research is protected by ITAR (International Traffic in Arms Regulations) and EAR (Export Administration Regulations). Example: dual-use technology used for scientific advancement as well as military applications.

FERPA (Education Records): Education records (i.e., files and documents which contain information related to an identifiable student) are protected by FERPA (Family Educational Rights and Privacy Act). Examples: class lists, grade rosters, records of advising sessions, grades, financial aid applications. See University Policy 4.5, Access to Student Information.

GLBA (Bursar Records): Cornell’s Bursar records are protected by GLBA (Gramm-Leach-Bliley/Financial Services Modernization Act) and also by FERPA.

HIPAA (Health Records): Certain health information is protected by HIPAA (Health Information Portability and Accountability Act) and is considered confidential if it is individually identifiable and held or transmitted by a covered entity. Examples: health records, patient treatment information, health insurance billing information. The HIPAA-covered entities at Cornell are Weill Cornell Medicine, Cornell Health, Benefit Services (both for the Ithaca campus and WMC), and University Counsel.

Human Subjects: Sensitive Identifiable Human Subject Research: Information that reveals or can be associated with the identities of people who serve as research subjects. Examples: names, finger prints, full-face photos, a videotaped conversation, or information from a survey filled out by an individual.

Personal Identifiers (Confidential Data): Personal identifiers are Social Security numbers, credit card numbers, driver’s license numbers, and bank account numbers. These are considered confidential data when they appear in conjunction with an individual’s name or other identifier.

Restricted Research Data: Restricted Access Research Data Sets: Example: census data.