54 terms
Threats
Phishing
Phishing is a fraudulent message (often an email) that impersonates a trusted source — a bank, a supplier, a colleague — to trick the recipient into clicking a link, entering credentials, or making a wire transfer. It remains the most common attack vector because it targets people rather than a technical flaw. A single employee falling for it can be enough to compromise an otherwise well-protected system.
Ransomware
Ransomware is malicious software that encrypts a company's files (or threatens to leak stolen data) and demands payment to restore access. Attackers target large organizations and unprepared SMEs alike, often through a phishing email or a poorly secured remote access point. Without reliable, tested backups, a successful attack can shut down operations for days or even weeks.
Malware
Malware is any software designed to harm a computer system — viruses, worms, trojans, spyware, and ransomware all fall under this umbrella. It can steal data, spy on activity, destroy files, or serve as an entry point for a broader attack. Protection relies on several complementary layers: antivirus/EDR, regular updates, and user vigilance.
DDoS (Distributed Denial of Service)
A distributed denial-of-service (DDoS) attack floods a website or online service with a massive volume of artificial traffic, generated from many infected machines, until it becomes unreachable for legitimate users. The goal isn't always data theft — it can be reputational damage, pressure tactics, or a diversion while another attack is carried out in parallel. E-commerce sites and critical online services are particularly exposed.
Zero-day vulnerability
A zero-day vulnerability is a software flaw unknown to the vendor at the time it is discovered or exploited — meaning no patch yet exists. These flaws are especially prized by attackers because they slip past defenses based on known signatures. Once disclosed, a race begins between the vendor releasing a fix and attackers trying to exploit it before companies have applied it.
Supply chain attack
A supply chain attack compromises a vendor, a piece of software, or a third-party provider in order to reach its end customers indirectly, rather than attacking the target directly. It's a fast-growing vector because companies increasingly depend on SaaS tools, integrators, and subcontractors connected to their information system. Every vendor or software dependency becomes a potential entry point that needs evaluating — not just your own perimeter.
Credential stuffing
Credential stuffing automatically tests username/password combinations — stolen in earlier data breaches — against many sites, betting that users reuse the same password elsewhere. It works at scale with automated tools and requires no technical flaw on the targeted site itself. MFA and banning password reuse across services are the best defenses against it.
Man-in-the-middle attack (MITM)
A man-in-the-middle (MITM) attack quietly inserts the attacker between two communicating parties — for example, a user and a website — to intercept, read, or alter the exchange without their knowledge. It often exploits unsecured Wi-Fi networks or unencrypted connections. Encrypting communications (HTTPS, VPN) is the baseline defense against this type of attack.
Spear phishing
Spear phishing is a targeted, personalized form of phishing, prepared in advance using real information about the victim or their company (a colleague's name, an ongoing project, a regular supplier) to appear credible. Unlike mass phishing, it usually targets a specific person — an executive, an accountant, an IT director — with a precise financial or access goal in mind. Its personalization makes it considerably harder to spot than a generic fraudulent email.
Business email compromise (BEC)
Business email compromise (BEC) impersonates an executive or a regular supplier — often through a spoofed email or a genuinely compromised mailbox — to convince an employee to make an urgent, confidential wire transfer to an account controlled by the attacker. It relies on no technical flaw at all, only on hierarchical trust and time pressure. A dual-approval process for any unusual transfer remains the best safeguard.
Shadow IT
Shadow IT refers to applications, cloud accounts, or digital tools used by employees without the IT team's approval or visibility — a SaaS account opened with a personal card, files shared through a consumer-grade service. These tools fall outside the company's security policies and create blind spots: sensitive data with no oversight, accounts that never get deactivated when someone leaves. Regularly mapping which applications are actually in use is a prerequisite to reducing it.
Insider threat
An insider threat comes from someone with legitimate access to the information system — an employee, a former employee, a contractor — who compromises the company's security either through malicious intent or by mistake. It can be deliberate (data theft before leaving, sabotage) or unintentional (a handling error, bypassing rules for convenience). Rigorous access management and prompt revocation when someone leaves significantly reduce this risk.
Defense & tools
Firewall
A firewall is a hardware or software device that filters incoming and outgoing network traffic according to defined rules, blocking unauthorized connections between an internal network and the outside world (typically the internet). It's one of the oldest and most fundamental building blocks of security, still essential today but insufficient on its own against modern threats. How it's configured and maintained over time often matters more than the product itself.
Antivirus
Antivirus software detects, blocks, and removes known malicious programs, mainly by comparing files against a database of previously identified threat signatures. It remains useful against common threats but shows its limits against novel or highly targeted attacks, which is why more advanced solutions like EDR are increasingly used alongside it. It doesn't replace other basic measures: updates, backups, and user awareness.
EDR (Endpoint Detection & Response)
EDR (Endpoint Detection & Response) continuously monitors activity on workstations and servers (processes, files, connections) to detect suspicious behavior, going beyond the known threat signatures a traditional antivirus relies on. When something looks anomalous, it lets a team investigate exactly what happened and isolate the affected machine to contain the spread of an attack. It's now a standard baseline for endpoint security in business, well beyond simple antivirus.
XDR (Extended Detection & Response)
XDR (Extended Detection & Response) extends the EDR principle by correlating security data from multiple sources — endpoints, network, cloud, email — to detect attacks that wouldn't be visible when looking at a single layer in isolation. It aims to give a unified view of an incident that spans several systems, rather than fragmented alerts disconnected from one another. Its value depends heavily on how well the different data sources are actually integrated.
SIEM (Security Information and Event Management)
A SIEM centralizes and correlates logs generated by a company's various systems — servers, applications, network equipment, security tools — to detect suspicious activity patterns and trigger alerts. It's the central tool of a SOC: without a consolidated view of what's happening across the information system, incident detection stays fragmented and slow. Its effectiveness depends heavily on how well detection rules are tuned and on the human follow-up behind it.
SOAR (Security Orchestration, Automation and Response)
SOAR automates part of the repetitive work in a security operations center — gathering information about an alert, applying an initial containment step, notifying teams — following predefined scenarios (playbooks). The goal is to shorten incident handling time and free analysts from low-value tasks so they can focus on decisions that genuinely require human judgment. It generally complements a SIEM rather than replacing it.
VPN (Virtual Private Network)
A VPN creates an encrypted tunnel between a user's device and the company network (or an online service), making the traffic unreadable to anyone who intercepts it — for example over public Wi-Fi. It's widely used to secure remote access for employees working from home or traveling. A VPN protects the confidentiality of traffic, but it doesn't replace strong authentication or the other security measures needed on the device itself.
MFA (Multi-Factor Authentication)
Multi-factor authentication (MFA) requires at least two distinct proofs of identity to log into an account — typically a password (something you know) and a temporary code sent to a phone or a dedicated app (something you have). It blocks the vast majority of fraudulent login attempts, even when the password has been stolen or guessed. It's one of the best cost-to-effectiveness security measures available today, for a company of any size.
IAM (Identity and Access Management)
IAM (identity and access management) covers the processes and tools that determine who has access to what within a company's information system, and under what conditions. It spans account creation and removal, assigning rights based on the principle of least privilege, and regularly checking that granted access is still justified. Rigorous identity management significantly limits the impact of a compromised account or a poorly handled employee departure.
DLP (Data Loss Prevention)
DLP (Data Loss Prevention) tools detect and block the unauthorized exit of sensitive data from a company's information system — for example, a customer file copied to a USB drive or sent through a personal email. It relies on rules that identify data types worth protecting (card numbers, medical records, confidential documents) and monitors the channels through which they could leave. It's particularly relevant for companies handling regulated data.
WAF (Web Application Firewall)
A WAF (Web Application Firewall) specifically filters and monitors traffic destined for an application or website, blocking common attacks like SQL injection or cross-site scripting (XSS) that a standard network firewall wouldn't catch. It sits in front of the application, often without requiring changes to the existing code. It's particularly recommended for e-commerce sites and applications that handle sensitive data or payments.
Patch management
Patch management is the organized process of identifying, testing, and deploying the security updates published by software and operating system vendors. A large share of successful attacks exploit flaws that are already known and already fixed, but whose patch simply wasn't applied in time. A structured process — rather than ad hoc updates — significantly narrows this window of exposure.
Vulnerability management
Vulnerability management is the ongoing process of identifying, prioritizing by criticality, and fixing flaws in a company's systems, applications, and equipment, typically through regular scans. Unlike a one-off audit, it's a recurring effort: new vulnerabilities keep emerging as software evolves. Prioritizing based on actual business risk — not just raw technical severity — is what separates an effective program from a list of flaws nobody acts on.
Backup
A backup is a copy of a company's data, kept separately from the original system, used to restore operations after data loss — a failure, human error, or a ransomware attack. To be genuinely effective, it should follow the 3-2-1 rule (three copies, two different media, one copy off-site or disconnected) and be tested regularly: a backup that's never been restored in a test is a backup whose reliability remains unproven. It's often the last line of defense against ransomware.
Encryption
Encryption transforms readable data into unreadable data without the proper key, protecting its confidentiality if it's intercepted or stolen. It applies both to stored data (files, databases) and data in transit (network exchanges, emails). Even if a device is stolen or a server is accessed without authorization, properly encrypted data remains unusable without the key — making it a fundamental protection measure rather than an optional one.
Zero trust
Zero trust is a security model that assumes no user, device, or application should be trusted by default, even inside the company network — every access request must be explicitly verified, regardless of where it originates. It stands in contrast to the traditional model where anything "inside" the network was implicitly considered safe. Adopting it is a gradual process: it's not a product you buy, but an approach combining IAM, network segmentation, and continuous verification.
Threat intelligence
Threat intelligence involves collecting and analyzing information about active threats — new attacker tactics, exploited vulnerabilities, indicators of compromise observed elsewhere — to anticipate and better detect attacks targeting one's own company. It shifts a reactive posture (responding after the fact) toward a more proactive one, drawing on what's already been observed against similar targets. Its value depends on relevance to the company's specific sector and profile, more than on sheer volume.
Honeypot
A honeypot is a deliberately vulnerable or attractive system, deployed to lure attackers and study their methods without exposing the company's real systems. It's mainly used for early detection (any activity on the decoy is almost always abnormal) and for researching real-world attack techniques. It isn't a protective tool in itself, but a complement to existing detection systems.
Sandboxing
Sandboxing runs a suspicious file or program in an isolated, controlled environment, separate from the rest of the system, to observe its behavior without risking the real infrastructure. It's a common technique for analyzing a suspicious email attachment before it ever reaches a user's inbox. It can catch threats that traditional signatures wouldn't yet recognize.
IOC (Indicator of Compromise)
An indicator of compromise (IOC) is a piece of technical evidence — a suspicious IP address, a malware file signature, a domain name, abnormal network behavior — that reveals a system has been compromised or targeted by an attack. Security teams share and use these indicators to detect similar intrusions elsewhere more quickly, often through a SIEM or a threat intelligence platform. Spotting an IOC doesn't always reveal the full extent of a compromise, but it's the starting point of any investigation.
CVE (Common Vulnerabilities and Exposures)
CVE (Common Vulnerabilities and Exposures) is a public, standardized reference system for known vulnerabilities, each identified by a unique number (for example CVE-2024-XXXXX). It lets companies, vendors, and researchers refer to the exact same flaw without ambiguity, regardless of the tool or source used. It's a basic reference point for any vulnerability management or security monitoring effort.
Organization & roles
SOC (Security Operations Center)
A SOC (Security Operations Center) is the team — in-house or outsourced — responsible for continuously monitoring a company's information system to detect, analyze, and respond to security incidents. It typically relies on a SIEM to centralize alerts and on defined procedures to triage and handle each event. A SOC can cover limited business hours or operate 24/7, depending on the service level a company chooses.
CISO (Chief Information Security Officer)
The CISO (Chief Information Security Officer) — RSSI in French — is the person responsible for defining and steering a company's security strategy: risk assessment, prioritizing investments, regulatory compliance, and coordination between IT, business teams, and leadership. It's a strategic leadership role, distinct from the technical teams that operate security tools day to day. Many SMEs can't afford to hire this profile full-time, which is why an outsourced CISO (vCISO) is increasingly common.
vCISO (virtual CISO)
A vCISO (virtual CISO, or outsourced CISO) carries out the strategic responsibilities of a CISO — defining security strategy, steering priorities, acting as the point of contact for leadership and auditors — without being a full-time employee, typically through a part-time or project-based engagement. This gives an SME access to senior strategic expertise without the cost and delay of a dedicated hire. A vCISO doesn't replace the operational technical teams — it directs their priorities.
Penetration test (pentest)
A penetration test (pentest) simulates a real attack, in a controlled and authorized way, against a system, application, or network, to identify exploitable vulnerabilities before an actual attacker does. Unlike an automated scan, it involves manual expert work that actually attempts to exploit the flaws found, to assess their real-world impact. It ends with a report prioritizing fixes based on their actual criticality to the business.
Red team
A red team simulates, over an extended period and with a specific objective, the tactics of a real attacker — often not limited to a single system, combining technical methods, social engineering, and sometimes physical intrusion — to test a company's overall detection and response capability, not just isolated technical flaws. It differs from a standard pentest in its scope and operational realism. It's generally reserved for companies that already have enough security maturity to fully benefit from it.
Blue team
The blue team is the team responsible for defending an information system: monitoring, threat detection, and incident response, typically relying on a SOC, a SIEM, and EDR/XDR tools. In a combined exercise with a red team, it must detect and counter simulated intrusion attempts, providing a concrete measure of how effective existing defenses really are. It's the team that operates day to day, as opposed to the red team, which attacks on a one-off basis.
Incident response
Incident response covers all the actions taken once a security incident is detected: assessing its severity, containing its spread, eradicating the root cause, restoring affected systems, and then analyzing lessons learned. Having a written, already-tested response plan before an incident happens is often what separates controlled crisis management from costly improvisation under time pressure. For the most severe incidents, it works closely alongside the disaster recovery plan.
DRP (Disaster Recovery Plan)
A disaster recovery plan (DRP) defines in advance the technical procedures for restoring IT systems after a major incident — a severe hardware failure, a disaster, a destructive attack — relying in particular on backups and standby infrastructure. It sets concrete, measurable targets such as RTO and RPO for each critical system. Without a DRP that's regularly tested, the theory of a fast recovery often runs into costly surprises exactly when it's needed most.
BCP (Business Continuity Plan)
The business continuity plan (BCP) goes beyond the IT dimension alone: it defines how the entire company keeps operating — or resumes operations as quickly as possible — during a major crisis, whether technological, human, or logistical. The disaster recovery plan (IT recovery) is typically one technical component among others (backup premises, crisis communication, prioritizing essential activities). It's a living document, meant to be revised as the organization evolves.
RTO (Recovery Time Objective)
RTO (Recovery Time Objective) is the maximum acceptable duration a system or service can remain unavailable after an incident before the impact on the business becomes unacceptable. It's defined system by system: an e-commerce site often has an RTO of a few hours, while a secondary internal tool might tolerate several days. Setting a realistic RTO — and then verifying the infrastructure can actually meet it — is often more revealing than defining it on paper alone.
RPO (Recovery Point Objective)
RPO (Recovery Point Objective) is the maximum amount of data a company is willing to lose, measured in time, in the event of an incident — in other words, the maximum acceptable age of the last usable backup. An RPO of one hour requires a far more demanding backup frequency than an RPO of 24 hours, generally at a higher cost and technical complexity. It should be defined based on the actual criticality of the data involved, not applied uniformly across every system.
Attack surface
The attack surface refers to every point through which an attacker could potentially reach a company's information system: internet-facing applications, user accounts, network equipment, APIs, connected vendors. It expands mechanically with digital transformation — more cloud tools, more remote work, more integrations — which makes regularly mapping it essential. Reducing it doesn't mean halting digitalization; it means knowing precisely what's exposed, and why.
Security awareness
Security awareness covers the training and coaching actions aimed at employees — training modules, phishing simulations, regular communication — to reduce the risk of human error, a frequent cause of security incidents. A single annual session rarely has a lasting effect: effective programs repeat the message in varied formats throughout the year. The goal isn't to turn every employee into a security expert, but to build simple reflexes for the most common situations they'll actually encounter.
Compliance & regulation
DGSSI (Morocco's national cybersecurity authority)
The DGSSI (Direction Générale de la Sécurité des Systèmes d'Information) is Morocco's national cybersecurity authority, under the national defense administration. It sets the security guidance and reference frameworks that underpin many audits conducted in Morocco, supports public administrations and infrastructure considered critical, and more broadly promotes a national cybersecurity culture. For a Moroccan company — especially one interacting with public administrations or regulated sectors — familiarity with the DGSSI framework is often an expected signal of seriousness.
Law 09-08 (Morocco)
Law 09-08 is Morocco's law on the protection of individuals with regard to the processing of personal data. It requires any organization that collects or processes personal data — which covers nearly every Moroccan business, regardless of sector — to meet obligations of proportionate data collection, informing data subjects, and securing that data, under the oversight of the CNDP. It applies equally to data hosted in-house and data entrusted to third-party providers or the cloud: responsibility doesn't disappear just because processing is outsourced.
CNDP (Morocco's data protection authority)
The CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) is the Moroccan authority responsible for enforcing law 09-08. It receives declarations and authorization requests related to personal data processing, and can be approached in the event of a complaint or an incident affecting personal data. For a company, the CNDP is the reference authority whenever it comes to formalizing personal data protection compliance in Morocco.
ISO 27001
ISO 27001 is the leading international standard for information security management. It defines a methodological framework — risk assessment, security policies, technical and organizational controls, continuous improvement — rather than a simple list of tools to install. A company can use ISO 27001 to structure its security approach without necessarily pursuing formal certification, or choose to get certified when clients or partners require it, particularly internationally.
GDPR (RGPD)
The GDPR (General Data Protection Regulation) is the European regulation governing the processing of personal data belonging to EU residents, with strict obligations (consent, right to erasure, data breach notification) and significant financial penalties for non-compliance. A Moroccan company can fall under it as soon as it processes the data of European customers or prospects, even without an establishment in the EU. It's a framework worth knowing for any Moroccan SME working with European clients or partners.
PCI-DSS
PCI-DSS (Payment Card Industry Data Security Standard) is the security standard imposed by the card networks (Visa, Mastercard, and others) on any organization that stores, processes, or transmits payment card data. It sets precise technical requirements: network segmentation, encryption of card data, access control, and regular security testing. For an e-commerce site or a merchant accepting card payments, PCI-DSS compliance isn't optional — the level of requirements applied depends on transaction volume.
NIST Cybersecurity Framework
The NIST Cybersecurity Framework is a US reference framework, widely used internationally, that structures a cybersecurity approach around functions that are easy to communicate: identify, protect, detect, respond, recover. It has no legal standing in Morocco, but it's frequently used as a common language in audits and security reports, including when communicating with a non-technical executive team. Many Moroccan providers draw on it to prioritize recommendations, alongside local frameworks like the DGSSI's.
Want to know where your company stands on these topics? Check our cybersecurity Morocco guide or start a free audit.
Social engineering
Social engineering covers the psychological manipulation techniques used to get someone to disclose confidential information or take an action they normally wouldn't — a fabricated sense of urgency, impersonating authority, flattery, or intimidation. Phishing is its most common form, but it can also happen over a phone call or an in-person visit. It's often the easiest way to bypass otherwise solid technical defenses.