Glossary
Cyber, forensics, privacy and legal-tech glossary
Plain-English definitions of the terms used across this site, from BEC and chain of custody to RROSH, DMARC and legal holds, with links to the pages that go deeper.
How to use this glossary
Incident responders, privacy lawyers and IT teams use a lot of shorthand, and the same word can mean different things to each of them. These definitions are written for the business owner, office manager, HR lead or lawyer who needs to follow the conversation and ask good questions. Where a term has a fuller page, it is linked at the end of its section.
Definitions draw on NIST SP 800-61 Rev. 3 (incident response), ISO/IEC 27037 (digital evidence), guidance from the Office of the Privacy Commissioner of Canada, Microsoft Learn documentation for Microsoft Entra ID, and The Sedona Canada Principles Addressing Electronic Discovery (Third Edition, 2022). Statutory definitions control where they differ from the plain-English versions here.
60 terms
A
- Artifact
- A trace left by system or user activity, such as a log entry, registry key, link file or browser history record.
B
- Breach of security safeguards
- PIPEDA's term for loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of safeguards, or a failure to establish them.
- Breach record
- The record PIPEDA requires for every breach of security safeguards, kept for 24 months after the organization determines the breach occurred.
- Business email compromise (BEC)
- Fraud that uses a hijacked or impersonated email account to redirect payments or obtain data. Often no malware is involved at all.
C
- Chain of custody
- The documented history of who held a piece of evidence, when, and what was done to it.
- Conditional Access
- The Microsoft Entra ID feature that applies sign-in rules based on conditions such as user, location, device state and risk.
- Confidentiality incident
- Quebec's term under Law 25 for unauthorized access, use or communication of personal information, or its loss.
- Containment
- Actions that stop an incident spreading, such as isolating a device or blocking an account, while preserving evidence.
D
- Data mapping
- An inventory of what personal information you hold, where it lives, who can access it and how long you keep it.
- Deduplication
- Removing identical copies of documents, usually by hash value, before review.
- Defensible collection
- Gathering ESI with documented methods that keep metadata intact and can be explained to the other side or a court.
- DKIM
- A cryptographic signature that proves a message was sent by an authorized system and not changed in transit.
- DMARC
- A DNS policy that tells receiving servers what to do with mail that fails SPF and DKIM alignment (none, quarantine or reject) and sends you reports.
- Double extortion
- Encrypting systems and also threatening to publish stolen data.
- Dwell time
- How long an attacker was inside before being detected.
E
- eDiscovery
- Identifying, preserving, collecting, reviewing and producing ESI in litigation or investigations.
- Eradication
- Removing what the attacker left behind (malware, backdoor accounts, forwarding rules, rogue app consents) once you know what it is.
- ESI (electronically stored information)
- Any information created or stored in digital form, including email, chats, files, databases and logs.
- Exfiltration
- Copying data out of your environment. In ransomware cases it usually happens before encryption, so restoring from backup does not end the exposure.
- Expert report
- A written opinion prepared for litigation, setting out the instructions, methods, findings and limitations.
F
- Forensic image
- A verified bit-for-bit copy of a storage device, including deleted and unallocated space.
H
- Hash value
- A fixed-length digital fingerprint (SHA-256, for example) used to prove a copy matches the original and has not changed.
- Hash values and forensic images
- A plain-language explanation for lawyers, HR and managers of what a hash value is, how a forensic image differs from a copy, and how to read the hash references in a…
I
- Inbox rule / forwarding rule
- An automatic mailbox rule. Attackers use them to hide replies or copy mail out quietly.
- Incident response plan
- A short document that sets roles, decision rights, contacts and scenario playbooks before anything happens.
- Indicator of compromise (IOC)
- A technical clue, such as an IP address, file hash or domain, that points to malicious activity.
L
- Legacy authentication
- Older sign-in protocols that cannot do MFA and are a common route for password-spray attacks.
- Legal hold (litigation hold)
- An instruction, and the matching technical setting, to preserve relevant information once litigation is reasonably anticipated.
- Live response
- Collecting volatile data, such as memory and running processes, from a system that is still powered on.
- Load file
- A structured file that carries document metadata and links into a review platform.
M
- Meet and confer
- Early discussions between parties to agree on the scope, format and process for exchanging electronic records.
- Metadata
- Data about data, such as author, created and modified dates, or email header routing.
- MFA (multi-factor authentication)
- Signing in with something beyond a password, such as an authenticator app prompt or a security key.
O
- OAuth app consent
- Permission a user or admin grants to a third-party app to access mailbox, file or profile data. Malicious consents survive password resets.
- Out-of-band communication
- A channel outside your normal systems (personal phones, a separate messaging app) used when email or Teams may be compromised.
P
- PHIPA
- Ontario's Personal Health Information Protection Act, which applies to health information custodians such as clinics and dental offices.
- Phishing-resistant MFA
- Methods such as passkeys and FIDO2 security keys that will not work on a fake sign-in page.
- PIPEDA
- The federal private-sector privacy law that applies to commercial activity in most of Canada, subject to provincial laws deemed substantially similar.
- Playbook
- Step-by-step instructions for a specific scenario, such as ransomware or a hacked mailbox.
- Preservation
- Keeping potentially relevant ESI intact. The Sedona Canada Principles treat preservation as a duty that arises as soon as litigation is reasonably anticipated.
- Privacy impact assessment (PIA)
- A structured review of how a project collects, uses and protects personal information, done before launch.
- Privacy officer
- The person accountable for an organization's compliance with privacy law (PIPEDA's accountability principle requires one to be designated).
- Privilege
- Legal protection for certain communications (solicitor-client) and for documents prepared mainly for litigation. Whether it applies is a legal question.
- Privileged account
- An admin account with power to change settings for everyone. It should be separate from day-to-day accounts.
- Proportionality
- The principle that discovery effort should match the importance and complexity of the matter. It runs through the Sedona Canada Principles.
R
- Retention schedule
- The documented rules for how long each category of record is kept and how it is destroyed.
- Risk of serious injury
- Quebec's threshold for notifying the Commission d'accès à l'information and affected people.
- RROSH (real risk of significant harm)
- The PIPEDA threshold for reporting a breach to the Office of the Privacy Commissioner and notifying individuals. Assessed using the sensitivity of the information and the probability of misuse.
S
- Security defaults
- Microsoft's free baseline settings for Entra ID tenants, including MFA registration and blocking legacy authentication.
- Service provider (processor)
- An organization handling personal information on behalf of another. The controlling organization stays accountable for it.
- Sign-in logs
- Entra ID records of each sign-in attempt, including location, app and result. Essential in account-takeover investigations.
- SPF
- A DNS record listing the servers allowed to send mail for your domain.
T
- Tabletop exercise
- A facilitated walk-through of a realistic scenario to test the plan and the people, without touching live systems.
- Technology-assisted review (TAR)
- Using machine learning to rank documents for relevance so reviewers focus on the likeliest material first.
- Threat actor
- The person or group behind an attack.
- Timeline analysis
- Arranging artifacts in time order to reconstruct what happened.
- TRIM
- A solid-state drive function that can clear deleted blocks quickly, which limits recovery on modern laptops.
U
- Unallocated space
- Parts of a disk not assigned to current files, where deleted data may survive.
- Unified audit log
- The Microsoft 365 log of user and admin activity across Exchange, SharePoint, OneDrive and Teams.
W
- Write blocker
- Hardware or software that allows a drive to be read without any data being written to it.
Something missing?
If a term in a report, a contract or a regulator's letter is not covered here, ask us. We would rather explain a term in plain words than have a decision made on a misunderstanding. For anything with legal effect, such as whether a breach is reportable or a document is privileged, your counsel has the final word.
Incident line · 24 hours, 7 days
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.