Cybersecurity glossary

Air-Gapped Network

An air gap is the physical isolation of a system from other networks so it cannot be reached from outside. It is common in industrial environments, though removable media and temporary connections can still create gaps.

API Security

API security protects the interfaces that connect applications and services from unauthorized access and abuse. As businesses rely more on APIs, flaws at this layer become an attractive target for attackers.

Advanced Persistent Threat

An APT is a well-resourced attacker, often state-linked, that gains access and stays hidden for a long time to pursue a specific goal. The defining trait is patience and stealth, not a single smash-and-grab.

The attack surface is the full set of points where an attacker could try to get in: exposed services, applications, accounts, and third-party connections. Reducing it is often the cheapest security win.

Business Continuity Management

Business continuity management ensures critical operations keep running or recover quickly during a disruption, including a cyber attack. Its plan covers roles, procedures, and recovery time targets.

Business Email Compromise

BEC is a targeted fraud where an attacker impersonates an executive or supplier over email to redirect a payment or sensitive data. It relies on deception rather than malware, so it often bypasses technical filters.

Badan Siber dan Sandi Negara

BSSN is Indonesia's national cyber agency, responsible for national cyber policy, standards, and incident coordination across government and critical sectors.

Bug Bounty Program

A bug bounty is a program that rewards security researchers for finding and responsibly reporting flaws. It complements periodic testing with continuous scrutiny from many testers.

Credential Stuffing

Credential stuffing uses username and password pairs leaked from one service to automatically try logging into others. It works because many people reuse the same password across accounts.

Dynamic Application Security Testing

DAST tests a running application from the outside, the way an attacker would, to find flaws that only appear at runtime. It complements SAST rather than replacing it.

Distributed Denial of Service

A DDoS attack floods a service with traffic from many sources at once until legitimate users cannot reach it. The goal is usually to halt operations rather than steal data.

DevSecOps builds security checks into the software development pipeline so issues are caught as code is written, not after release. It shifts security left, closer to the developer.

Digital Forensics and Incident Response

DFIR combines forensic investigation with incident response: preserving evidence, reconstructing what happened, and supporting any legal or regulatory follow-up.

Data Protection Officer

A DPO is the person accountable for an organisation's personal-data compliance. Under UU PDP, many organisations that process data at scale are expected to appoint one.

Endpoint Detection and Response

EDR watches laptops and servers for malicious behaviour and can isolate a compromised device. It succeeds traditional antivirus by focusing on what a threat does, not just known file signatures.

The GDPR is the European Union's data protection regulation. Indonesian companies encounter it when they handle the personal data of people in the EU, and it heavily influenced UU PDP.

Industrial Control Systems · Supervisory Control and Data Acquisition

ICS and SCADA are the control systems that monitor and operate industrial equipment. They were built for reliability in isolated networks, which makes securing them as they connect to IT a distinct challenge.

IEC 62443 is the international standard series for securing industrial automation and control systems. It defines security levels and requirements tailored to OT rather than IT environments.

IR

Incident response is the structured process of containing, investigating, and recovering from a security incident. A tested IR plan is what separates a contained event from a public breach.

Insider Threat

An insider threat comes from someone with legitimate access, such as an employee or partner, whether through malice or carelessness. Because they are already inside, these threats are often harder to detect.

ISO 27001 is the international standard for an information security management system (ISMS). Certification demonstrates that security is managed by a documented, audited process rather than ad hoc effort.

Malicious Software

Malware is a general term for malicious software designed to damage, steal data, or take over systems. Ransomware, trojans, and spyware are some of its forms.

Managed Detection and Response

MDR is a service that combines threat detection with active response, not just alerts. Where a basic managed service tells you something happened, MDR takes agreed containment actions on your behalf.

Managed Security Service Provider

An MSSP runs security operations on behalf of a company, usually including monitoring, detection, and response. Indonesian firms use an MSSP when building an in-house SOC is too slow or too costly to staff.

Mean Time to Respond · MTTD

MTTR measures the average time taken to contain and recover from an incident once detected. Together with MTTD, the time to detect, it shows how fast a security team actually works.

Network Detection and Response

NDR analyses network traffic to find threats that do not touch a managed endpoint, such as activity from unmanaged devices or lateral movement between systems.

Cybersecurity Framework

The NIST Cybersecurity Framework organises security work into a common set of functions such as identify, protect, detect, respond, and recover. It gives teams a shared language for measuring maturity.

Open-Source Intelligence

OSINT is the gathering of information from publicly available sources such as websites, social media, and leaked documents. Attackers and testers alike use it to map a target before going further.

Operational Technology security

OT security protects the systems that run physical operations, such as manufacturing lines and utilities. Uptime and safety come first, so IT security playbooks rarely transfer without change.

OWASP

The OWASP Top 10 is a reference list of the most common and impactful web application security risks. It is a common starting point for testing and securing applications.

Payment Card Industry Data Security Standard

PCI DSS is a global security standard for organizations that store, process, or transmit payment card data. Compliance is a condition for being able to keep processing card transactions.

pentest

A penetration test is an authorised, simulated attack on a system to find and prove real weaknesses before a genuine attacker does. The output is a prioritised list of findings with evidence.

Phishing is a social-engineering attack where criminals impersonate a trusted sender to trick people into revealing credentials, transferring money, or installing malware. It is the starting point for most breaches.

POJK 11/2022 is an OJK regulation setting information-security and resilience requirements for commercial banks, including penetration testing and incident reporting.

POJK 34/2025 extends structured IT and cyber-resilience obligations to rural banks (BPR/BPRS), with a compliance deadline that many smaller banks must still prepare for.

PP 71/2019 governs electronic systems and transactions in Indonesia, including rules on data placement and the obligations of electronic system operators.

Purdue Enterprise Reference Architecture

The Purdue model is a framework that divides an industrial network into levels, from field devices up to business systems. This separation helps isolate and secure operational systems from the IT network.

A purple team exercise has attackers (red) and defenders (blue) work together in the open, so every simulated attack directly improves detection and response.

Ransomware is malware that encrypts an organisation's data and demands payment to restore it, often with a threat to leak the data too. It remains one of the costliest incidents for Indonesian companies.

A red team runs a goal-driven, adversarial exercise that tests people, process, and technology together, not just one application. It measures how an organisation detects and responds under realistic pressure.

Recovery Time Objective · Recovery Point Objective

RTO is the target for how quickly a system must recover after a disruption, while RPO is the target for how much data can be lost. Together they guide backup and recovery planning.

Static Application Security Testing

SAST analyses source code for security flaws without running it. It runs early in development and flags issues like injection risks before the application is ever deployed.

Software Bill of Materials

An SBOM is a full inventory of the components and open-source libraries inside a piece of software. When a new vulnerability appears, it tells you in minutes whether you are affected.

Shift-Left Security

Shift left means moving security checks to the early stages of development rather than waiting until just before release. Finding problems earlier makes fixing them far cheaper and faster.

Security Information and Event Management

A SIEM collects and correlates log data from across an organisation so analysts can spot patterns that a single system would miss. It is the data backbone most SOCs are built on.

Security Orchestration, Automation and Response

SOAR tools automate repetitive response steps, such as enriching an alert or isolating a host, so analysts spend their time on judgement rather than manual clicks.

Security Operations Center

A SOC is the team, process, and tooling that monitors an organisation for security threats around the clock. It collects signals from across the network, investigates suspicious activity, and coordinates the response when something is wrong.

SOC 2 is a reporting standard that evaluates how a service provider protects customer data across controls such as security and availability. It is frequently requested by enterprise buyers before signing.

Social engineering manipulates people into breaking security rules, for example by posing as IT support to reset a password. It targets human trust rather than technical flaws.

Supply Chain Attack

A supply chain attack breaches an organization through a trusted supplier, vendor, or software component. By compromising one party, attackers can reach many victims at once.

Threat hunting is the proactive search for attackers who have evaded automated detection. Analysts form a hypothesis about how an intrusion might look and then hunt for that evidence in the data.

Cyber Threat Intelligence

Threat intelligence is up-to-date information about active attackers, techniques, and indicators of compromise. Security teams use it to recognize threats sooner and tune defences before an attack lands.

User and Entity Behavior Analytics

UEBA builds a baseline of normal behaviour for users and systems, then flags suspicious deviations. It helps catch compromised accounts and insider threats that signature-based tools miss.

UU No. 27/2022 · Undang-Undang Pelindungan Data Pribadi

UU PDP is Indonesia's personal data protection law, which sets obligations for how organisations collect, process, and protect personal data, with real penalties for breaches. It is the closest Indonesian equivalent to the GDPR.

Vulnerability Assessment and Penetration Testing

VAPT pairs a broad scan for known weaknesses with hands-on testing that tries to exploit them. It is the phrase Indonesian regulators and tenders most often use for security testing.

A vulnerability assessment is a systematic scan that catalogues known weaknesses across systems and ranks them by severity. It shows breadth of exposure rather than proving exploitability.

Extended Detection and Response

XDR extends EDR beyond the endpoint to correlate signals across email, network, cloud, and identity in one view. The goal is to see a whole attack rather than isolated fragments.

Zero Trust Architecture

Zero trust is a security principle that grants no automatic trust to any user or device, inside or outside the network. Every access request is re-verified based on identity, context, and risk.

A zero-day is a vulnerability that attackers exploit before the vendor has released a fix. Defence depends on detection and containment rather than patching, because no patch yet exists.