Security Glossary

64 security terms in plain language.

AES (Advanced Encryption Standard): A symmetric encryption algorithm adopted as a standard by the U.S. government. AES operates on fixed block sizes of 128 bits with key lengths of 128, 192, or 256 bits. It is fast, secure, and widely used for encrypting files, disks, and network traffic.
Algorithmic Trading: The use of computer programs and algorithms to execute trades based on predefined criteria such as price, timing, volume, or mathematical models. In MQL5, algorithmic trading is implemented through Expert Advisors that automate the entire trading process from signal generation to order execution and risk management.
Attack Surface: The total number of points where an attacker could try to enter or extract data from a system. This includes open ports, running services, user accounts, APIs, and any other interface exposed to potential threats. Reducing the attack surface is a fundamental security strategy.
Backtesting: The process of testing a trading strategy or Expert Advisor against historical market data to evaluate its performance before risking real capital. MetaTrader 5's Strategy Tester supports tick-accurate simulation, multi-currency testing, and parameter optimization. Results must be validated against overfitting and market regime changes.
Blockchain: A distributed, append-only digital ledger that records transactions across a network of computers. Each block contains a cryptographic hash of the previous block, a timestamp, and transaction data, forming an immutable chain. Blockchains are the foundation of cryptocurrencies like Bitcoin and Monero.
Browser Fingerprinting: A tracking technique that identifies users by collecting unique characteristics of their browser and device — such as screen resolution, installed fonts, GPU model, and timezone — rather than storing cookies. Because these attributes vary across devices, the combination creates a nearly unique identifier that works even when cookies are blocked or deleted.
Brute Force Attack: An attack method that tries every possible combination of passwords or keys until the correct one is found. While simple in concept, brute force attacks can be effective against weak passwords. Defenses include account lockouts, rate limiting, and strong password requirements.
Certificate Authority (CA): A trusted organization that issues digital certificates verifying the identity of websites and organizations. When your browser shows a padlock icon, a CA has vouched that the site is who it claims to be. Major CAs include Let's Encrypt, DigiCert, and Comodo.
CIA Triad: The three core principles of information security: Confidentiality (keeping data secret), Integrity (keeping data accurate and unaltered), and Availability (keeping data accessible when needed). Every security control maps back to protecting one or more of these pillars.
Cold Wallet: A cryptocurrency wallet that stores private keys entirely offline, disconnected from the internet. Hardware wallets (like Ledger and Trezor) and paper wallets are common forms. Cold wallets are significantly more secure against remote attacks than hot wallets (which remain connected to the internet).
CORS (Cross-Origin Resource Sharing): A browser security mechanism that controls which domains can access resources on a web server. By default, browsers block cross-origin requests to prevent data theft. CORS headers allow servers to explicitly permit trusted domains while blocking unauthorized access.
Credential Stuffing: An automated attack that uses stolen username/password pairs from one breach to try logging into other services. It exploits the common habit of password reuse. Defenses include MFA, rate limiting, and breach-detection services like Have I Been Pwned.
Cross-Site Request Forgery (CSRF): An attack that tricks a user's browser into making unintended requests to a site where they're authenticated. For example, clicking a link that transfers money from your bank account without your knowledge. CSRF tokens and SameSite cookie attributes are common defenses.
Cross-Site Scripting (XSS): A web vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. XSS can steal session cookies, redirect users, or modify page content. Defenses include input sanitization, output encoding, and Content Security Policy (CSP) headers.
Cryptocurrency: A digital currency that uses cryptography for security and operates on a decentralized blockchain network without a central authority. Transactions are verified by network participants through consensus mechanisms like proof-of-work or proof-of-stake. Examples include Bitcoin, Monero, and Ethereum.
Data Breach: An incident where sensitive, protected, or confidential data is accessed, stolen, or exposed by unauthorized individuals. Breaches can result from hacking, malware, insider threats, or accidental exposure. Organizations are typically required by law to notify affected users.
DDoS (Distributed Denial of Service): An attack that floods a target server or network with traffic from many sources simultaneously, overwhelming its capacity and making it unavailable to legitimate users. DDoS attacks use botnets — networks of compromised devices — to generate massive traffic volumes.
DNS (Domain Name System): The internet's phone book — it translates human-readable domain names (like finkatana.com) into IP addresses that computers use to communicate. DNS can be a security weak point: attackers can hijack or poison DNS to redirect users to malicious sites.
Encryption: The process of converting readable data (plaintext) into an unreadable format (ciphertext) using a mathematical algorithm and a key. Only someone with the correct decryption key can reverse the process. Encryption protects data both in transit (over networks) and at rest (on disk).
End-to-End Encryption (E2EE): A communication system where only the sender and recipient can read the messages. The service provider cannot access the content, even if compelled by law enforcement. Used by Signal, WhatsApp, and ProtonMail. Considered the gold standard for private communication.
Expert Advisor (EA): An automated trading program in MetaTrader 5 written in MQL5 that can analyze markets, generate trading signals, and execute trades without manual intervention. EAs follow predefined rules for entry, exit, position sizing, and risk management, and can be backtested on historical data before live deployment.
Exploit: A piece of code, technique, or method that takes advantage of a vulnerability to compromise a system. Exploits can be delivered through malware, social engineering, or direct network attacks.
Firewall: A network security device or software that monitors and controls incoming and outgoing traffic based on predefined rules. Firewalls act as a barrier between trusted internal networks and untrusted external networks, blocking unauthorized access while allowing legitimate communication.
Hash Function: A one-way mathematical function that converts input of any size into a fixed-length output (hash/digest). Good hash functions are deterministic, fast, and collision-resistant. Used for password storage, data integrity verification, and digital signatures. Common algorithms include SHA-256 and bcrypt.
HTTPS: The secure version of HTTP, using TLS encryption to protect data between your browser and a web server. HTTPS prevents eavesdropping, tampering, and impersonation. Modern browsers mark HTTP sites as 'Not Secure.' Free certificates from Let's Encrypt have made HTTPS adoption universal.
IP Address: A unique numerical label assigned to every device on a network (e.g., 192.168.1.1). IPv4 uses 32-bit addresses, while IPv6 uses 128-bit. Your public IP identifies you on the internet; your private IP identifies you on your local network.
Keylogger: Software or hardware that records every keystroke on a computer. Keyloggers can capture passwords, credit card numbers, and private messages. They can be installed through malware, physical access, or even malicious browser extensions.
MAC Address: A unique hardware identifier assigned to every network interface card (NIC). Unlike IP addresses which can change, MAC addresses are burned into the hardware. They operate at the data link layer and are used for local network communication.
Malware: Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems. Malware is an umbrella term covering viruses, worms, trojans, ransomware, spyware, and more. It can spread through email attachments, malicious websites, infected USB drives, or software vulnerabilities.
Man-in-the-Middle (MITM) Attack: An attack where the attacker secretly intercepts and potentially alters communication between two parties who believe they're communicating directly. Common on unsecured Wi-Fi networks. HTTPS and certificate pinning are primary defenses against MITM attacks.
Metasploit: A widely used open-source penetration testing framework that provides tools for discovering vulnerabilities, developing exploits, and testing defenses. Metasploit includes a database of known exploits and payloads, making it invaluable for authorized security testing.
Multi-Factor Authentication (MFA): A security mechanism requiring two or more verification methods from different categories: something you know (password), something you have (phone/token), or something you are (fingerprint). MFA dramatically reduces the risk of account compromise even if passwords are stolen.
Nmap: A free, open-source network scanning tool used for network discovery and security auditing. Nmap can identify open ports, running services, operating systems, and potential vulnerabilities on target systems. It's one of the most essential tools in any security professional's toolkit.
OAuth: An open authorization framework that allows third-party applications to access a user's resources without exposing their password. When you 'Sign in with Google' on another site, OAuth is the protocol managing that permission exchange securely.
Packet: A small unit of data transmitted over a network. All internet communication is broken into packets, which are routed independently and reassembled at the destination. Network security tools like Wireshark capture and analyze individual packets to detect suspicious activity.
Password Hash: A one-way mathematical transformation of a password into a fixed-length string. Instead of storing passwords in plain text, systems store their hashes. When you log in, your password is hashed and compared to the stored hash. Good algorithms like bcrypt and Argon2 are intentionally slow to resist brute force.
Patch: A software update released to fix a vulnerability, bug, or security flaw. Applying patches promptly is one of the most important security practices, as unpatched systems are a leading cause of breaches.
Penetration Testing: An authorized simulated attack on a system to evaluate its security. Penetration testers (pen testers) use the same tools and techniques as real attackers but with permission and the goal of finding vulnerabilities before malicious actors do.
Phishing: A social engineering attack that uses fraudulent emails, messages, or websites to trick victims into revealing sensitive information like passwords or credit card numbers. Spear phishing targets specific individuals, while whaling targets high-profile executives.
PII (Personally Identifiable Information): Any data that can identify a specific individual, either alone or combined with other information. Examples include full names, social security numbers, email addresses, phone numbers, and biometric data. Protecting PII is a legal requirement under regulations like GDPR and CCPA.
Port: A numbered endpoint for network communication. Each service on a computer listens on a specific port (e.g., HTTP on port 80, HTTPS on 443, SSH on 22). Open ports increase the attack surface, so unused ports should be closed with a firewall.
Private Key: The secret half of an asymmetric key pair that must never be shared. It is used to decrypt data encrypted with the corresponding public key and to create digital signatures. Compromise of a private key compromises all communications secured by that key pair.
Proof of Stake (PoS): A consensus mechanism where validators are chosen to create new blocks based on the amount of cryptocurrency they have staked (locked up) as collateral. Unlike proof-of-work (mining), PoS does not require massive energy consumption. Validators risk losing their stake if they act maliciously, creating an economic incentive for honest behavior.
Public Key: One half of an asymmetric key pair that can be freely shared. Data encrypted with a public key can only be decrypted with the corresponding private key. Public keys are used in HTTPS certificates, SSH authentication, and encrypted email.
Ransomware: A type of malware that encrypts a victim's files and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware often also steals data and threatens to publish it. Defenses include regular backups, network segmentation, and email filtering.
Ring Signature: A cryptographic signature scheme where a group of possible signers is combined so that an observer can verify the signature came from someone in the group but cannot determine which specific member signed. Used by Monero to hide the true sender of every transaction, providing privacy by default.
Rootkit: A stealthy type of malware designed to maintain persistent, privileged access to a system while hiding its presence from users and security software. Rootkits can modify the operating system itself, making them extremely difficult to detect and remove.
RSA: An asymmetric encryption algorithm based on the mathematical difficulty of factoring large prime numbers. RSA uses a pair of keys — one public and one private. It is widely used for secure key exchange, digital signatures, and establishing encrypted connections.
Salt (Cryptographic): A random value added to a password before hashing to ensure that identical passwords produce different hashes. Without salting, attackers can use precomputed rainbow tables to reverse hashes. Each user should have a unique salt stored alongside their hash.
Seed Phrase (Recovery Phrase): A sequence of 12 or 24 words generated by a cryptocurrency wallet that serves as the master backup for all private keys in that wallet. Anyone who knows your seed phrase controls all funds in the wallet. It must be stored offline, never photographed, and never entered on a website.
Session Hijacking: An attack where an attacker steals or predicts a valid session token to impersonate a logged-in user. Once hijacked, the attacker has the same access as the victim without needing their password. Defenses include HTTPS, secure cookie flags, and session timeouts.
Sharding: A scaling technique that splits a blockchain into multiple parallel chains (shards), each processing its own subset of transactions simultaneously. This dramatically increases throughput compared to single-chain designs where every node must process every transaction. TON implements dynamic infinite sharding, automatically splitting and merging shards based on network load.
Smart Contract: A self-executing program stored on a blockchain that automatically enforces the terms of an agreement when predefined conditions are met. Smart contracts eliminate the need for intermediaries and run exactly as programmed. They power decentralized applications (dApps), DeFi protocols, and NFT marketplaces on networks like Ethereum, TON, and Solana.
Social Engineering: Manipulating people into revealing confidential information or performing actions that compromise security. Rather than exploiting software, social engineering exploits human psychology through techniques like phishing, pretexting, and baiting.
SQL Injection: An attack that inserts malicious SQL code into input fields to manipulate a database. A successful SQL injection can read, modify, or delete data, bypass authentication, or even execute system commands. Parameterized queries (prepared statements) are the primary defense.
SSL/TLS: Cryptographic protocols that provide secure communication over networks. TLS (Transport Layer Security) is the successor to SSL (Secure Sockets Layer). When you see HTTPS in a URL, TLS is encrypting the connection between your browser and the server, preventing eavesdropping and tampering.
Technical Indicator: A mathematical calculation based on price, volume, or open interest data used to forecast market direction. Common indicators include Moving Averages (trend), RSI (momentum), MACD (trend/momentum), and Bollinger Bands (volatility). In MQL5, custom indicators can be built with indicator buffers and applied to any timeframe.
Threat Model: A structured analysis of potential threats to a system, identifying what you're protecting, who might attack it, and how they might do so. Threat modeling helps prioritize security efforts by focusing on the most likely and impactful risks.
Trading Strategy: A systematic plan that defines specific rules for entering and exiting trades based on technical indicators, price action, or fundamental analysis. A complete strategy includes entry conditions, exit conditions, stop-loss placement, position sizing, and the market conditions where it works best. Strategies can be executed manually or automated through Expert Advisors.
Trojan: Malware disguised as legitimate software. Unlike viruses, trojans don't self-replicate — they rely on users to install them. Once running, they can create backdoors, steal data, or download additional malware. Named after the Greek myth of the Trojan Horse.
VPN (Virtual Private Network): A technology that creates an encrypted tunnel between your device and a server, hiding your internet traffic from your ISP and masking your IP address. VPNs protect privacy on untrusted networks and can provide secure remote access to private networks.
Vulnerability: A weakness in a system, application, or process that could be exploited by an attacker to gain unauthorized access or cause harm. Vulnerabilities can exist in software code, configurations, or even human procedures.
Wireshark: A free, open-source packet analyzer used to capture and inspect network traffic in real time. Security professionals use Wireshark to troubleshoot network issues, detect intrusions, analyze malware communication, and verify that encryption is working correctly.
Zero-Day: A vulnerability that is unknown to the software vendor and has no available patch. Called 'zero-day' because the vendor has had zero days to fix it. These are highly valuable in both offensive and defensive security because there is no existing defense.