Security and privacy jargon decoded: encryption, authentication and zero trust

Security conversations tend to produce two reactions: eyes glazing over, or sudden fear. Neither helps. The vocabulary is large, but the core ideas are not. Security is about stopping the wrong people from doing the wrong things, and about limiting the damage when something does go wrong. Privacy is about respecting people’s information.

This article groups the terms by the question that each answers, so that you can follow the discussion and contribute to it.

The big three: confidentiality, integrity and availability

• Confidentiality. Only the right people can see the information.
• Integrity. The information has not been altered improperly.
• Availability. The right people can reach it when they need to.

Almost every security measure serves one of these three. Ask which one a particular measure protects.

Proving who you are

• Authentication. Proving your identity, for example with a password.
• Authorisation. Deciding what an identified person may do. Logging in is authentication. Being allowed to delete records is authorisation.
• Password manager. A tool that creates and stores strong, unique passwords.
• MFA or 2FA (multi-factor authentication). Requiring a second proof, such as a code on your phone, as well as a password.
• SSO (single sign-on). Logging in once to reach many systems.
• Biometrics. Using fingerprints or faces as proof of identity.
• Passkey. A newer, phishing-resistant login that replaces passwords with a cryptographic key on your device.
• Least privilege. Giving people and programs only the access they need, and no more.

Scrambling and sealing data

• Encryption. Scrambling data so that it is unreadable without a key.
• Encryption in transit and at rest. Protecting data while it moves across a network, and while it is stored.
• Key. The secret that locks and unlocks encrypted data. Managing keys carefully is half the battle.
• Hashing. Turning data, such as a password, into a fixed fingerprint that cannot be reversed. Systems store hashes, not passwords.
• TLS and HTTPS. The protocols that encrypt web traffic.
• Digital signature. A way of proving that something came from a particular person and was not changed.
• VPN. A private, encrypted tunnel across a public network.

Defences and monitoring

• Firewall. A gatekeeper that controls what network traffic is allowed in and out.
• Antivirus and endpoint protection. Software on devices that detects and blocks malicious programs.
• Patching. Installing updates that fix known weaknesses. Delay is dangerous.
• Vulnerability. A weakness that could be exploited.
• Exploit. A method of taking advantage of a vulnerability.
• Zero-day. A vulnerability that is not yet known to the maker, and so has no fix.
• Penetration test (pen test). A permitted, simulated attack by specialists, to find weaknesses.
• SIEM and logging. Collecting records of what happens, and analysing them for signs of trouble.
• Backup. A separate copy of data to recover from loss or ransomware.

Threats you will hear about

• Phishing. Fraudulent messages that trick people into revealing information or clicking harmful links. It is the most common starting point of incidents.
• Social engineering. Manipulating people, not machines, to gain access.
• Malware. Malicious software of any kind.
• Ransomware. Malware that locks your data and demands payment.
• Data breach. Unauthorised access to, or exposure of, information.
• DDoS. Overwhelming a service with traffic to knock it offline.
• Insider threat. Harm caused by someone with legitimate access, deliberately or by accident.
• Prompt injection. Hidden instructions in text that try to hijack an AI system.
• Supply chain attack. Compromising a supplier or a software component to reach many customers.

Zero trust and defence in depth

• Zero trust. A design principle: never assume that someone is safe just because they are inside the network. Verify every request, and give minimum access.
• Defence in depth. Several layers of protection, so that if one fails, others still hold.
• Attack surface. All the places where an attacker could try to get in. Reducing it reduces risk.
• Segmentation. Dividing a network into parts, so a problem in one does not spread to all.
• Incident response. The plan and practice for handling a security event.

Privacy and the rules

• Personal data (PII). Information that can identify a person: names, phone numbers, location, photos, ID numbers.
• Sensitive data. Categories needing extra protection, such as health, finances or beliefs.
• Consent. Clear, informed agreement to use someone’s data for a stated purpose.
• Data minimisation. Collecting only what you need.
• Retention and deletion. Keeping data no longer than necessary, and removing it properly.
• Anonymisation. Removing identifiers so that people cannot be re-identified.
• Data controller and processor. The party that decides why and how data is used, and the one that handles it on its behalf.
• Privacy by design. Building protection in from the start.
• GDPR and similar laws. Regulations that give people rights over their data and put duties on organisations. Many countries have their own, so check what applies to you.
• Data protection impact assessment. A structured review of risks before a project that uses personal data.

Habits that prevent most trouble

1. 01Use a password manager, and turn on multi-factor authentication everywhere that matters.
2. 02Install updates promptly.
3. 03Give each person only the access they need, and remove it when they leave.
4. 04Keep tested, separate backups.
5. 05Train people to spot phishing, and make it easy to report mistakes without blame.
6. 06Encrypt laptops and phones.
7. 07Know who to call when something goes wrong.

Questions to ask a supplier

• How is our data protected in transit and at rest, and who holds the keys?
• Who on your side can see our data, and how is that access controlled and logged?
• How do you handle updates and vulnerabilities?
• What happens in a breach, and how soon would we be told?
• Where is the data stored, and what happens to it when we leave?
• What independent audits or certifications do you hold?

Frequently asked questions

What is the difference between security and privacy?

Security protects systems and data from unauthorised access. Privacy concerns how personal information is collected, used and shared, and the rights of the people it describes.

Is a strong password enough?

It helps, but passwords are stolen and reused. Multi-factor authentication adds a vital second barrier.

Do small organisations get attacked?

Yes. Attackers often target small ones because defences are weaker, and automated attacks do not choose by size.

Can AI tools leak our data?

They can if sensitive information is pasted into services without checking their terms. Set clear rules about what may be shared, and use approved tools.

You do not need to master every term. If you understand who is trying to get in, what they want and which simple layers stand in their way, you can take part in any security conversation, and push for the habits that really protect people.