A little something for the weekend, sir

[Gary Hinson]

Are there cybersecurity-related terms that confuse you, or that other people often confuse?

Take 'accountability' and 'responsibility' for instance: it is rare to find clear, concise and accurate explanations of either. In practice the wrong words are often used inadvertently by people who simply don't appreciate the distinction, or don't really care.  

Formal definitions in standards such as ISO/IEC 27000 aren't necessarily The Ultimate Answer either.  I recall the years of dispute within SC27 over the intended meaning of "information asset", and "risk" is still a hot potato.

To be fair, the concepts behind them are quite diffuse and complex. Loose language doesn't help, though ... nor sloppy genAI systems that invent fake words such as "exfiltromise"!

I know of a few others but I'm keen to hear your thoughts. What 'trigger words' are in your sights?  Which hot potatoes would you rather we stopped juggling?

Kind regards/Ngā mihi,

Gary

____________________________________________

Gary Hinson CEO of IsecT Ltd

Information risk and security consulting

ISO27k  Audit  ISMS templates and policies
Pragmatic Security Metrics
Cybersecurity Hyperglossary 

_____________________________________________