- Published
- 8 October 2026
- Last reviewed
- 8 October 2026
How to use this glossary
Use this glossary to understand routine account and device protection. It does not replace your organisation’s security policy or incident-reporting route. Examples use fictional accounts and records.
Browse the alphabetical term index below. Select a term to jump to its definition, example and common mistake. Use the return link after each entry to browse again. You can also use your browser’s Find command to locate a word on this page. Definitions are original RDE plain-language explanations. All examples are fictional teaching scenarios.
Term index
12 terms, listed alphabetically.
- Authentication
- Authorisation
- Backup
- Encryption
- Incident
- Malware
- Multi-factor authentication (MFA)
- Password manager
- Phishing
- Recovery code
- Threat
- Vulnerability
Definitions and practical examples
Authentication
Meaning: Checking a claimed identity before allowing access to a service.
Example: A service checks a password and a registered security key during sign-in.
Common mistake to avoid: Successful authentication does not imply permission to perform every action.
Authorisation
Meaning: Deciding which actions or resources an identity is permitted to access.
Example: A signed-in administrator can view enquiries but not payroll records.
Common mistake to avoid: Do not bypass permissions by sharing another person’s credentials.
Backup
Meaning: A recoverable copy of data kept for restoration when needed.
Example: A team retains a separate copy of important working files under its backup policy.
Common mistake to avoid: A copy is useful only if recovery works; test an appropriate practice restoration.
Encryption
Meaning: Transforming data so that it can be read only through the appropriate cryptographic process.
Example: A device protects stored files using encryption managed by the organisation.
Common mistake to avoid: Encryption does not prevent every misuse by an authorised user or compromised account.
Incident
Meaning: An event requiring assessment or response because security may be affected.
Example: An account sends unexpected messages after an unrecognised sign-in.
Common mistake to avoid: Follow the approved reporting route rather than investigating beyond your authority.
Malware
Meaning: Software designed to cause harm or perform unauthorised activity.
Example: A harmful attachment attempts to install software when opened.
Common mistake to avoid: File appearance and a familiar icon do not establish safety.
Multi-factor authentication (MFA)
Meaning: Authentication using more than one distinct type of evidence.
Example: A service requires a password and a registered security key.
Common mistake to avoid: Two passwords are not two distinct factors; methods differ in phishing resistance.
Password manager
Meaning: A tool that stores and helps manage account credentials.
Example: A person uses a trusted manager to create different passwords for different accounts.
Common mistake to avoid: Protect the manager itself and follow the organisation’s approved-tool policy.
Phishing
Meaning: Deceptive communication intended to trick someone into unsafe action or disclosure.
Example: A message imitates a service desk and requests an urgent sign-in through a link.
Common mistake to avoid: Verify through a trusted independent route; urgency is not proof of legitimacy.
Recovery code
Meaning: A fallback code used through a service’s approved account-recovery process.
Example: A person stores issued recovery codes securely before losing access to their usual factor.
Common mistake to avoid: Treat codes as sensitive; do not send them to someone claiming to offer support.
Threat
Meaning: A potential cause of harm to a system, information or service.
Example: A malicious actor may exploit an exposed weakness to access confidential data.
Common mistake to avoid: A threat is not the same as the weakness that makes exploitation possible.
Vulnerability
Meaning: A weakness that can be exploited or otherwise contribute to harm.
Example: Unpatched software contains a flaw that an attacker could exploit.
Common mistake to avoid: Prioritise fixes using exposure and impact, not merely the number of listed weaknesses.
A distinction worth keeping clear
Authentication checks who or what is accessing a system. Authorisation determines what that identity may do. A person can sign in successfully and still lack permission to open a restricted file.
Practise using the terms
A staff member signs in with a password and security key but cannot view a finance folder. Which step concerns authentication, and which concerns authorisation? Should a colleague send their own password to bypass the restriction? Write your answer in your own notes before reading the explanation. No answer is submitted or stored by this page.
Suggested answer and explanation
The sign-in checks concern authentication. The folder permission concerns authorisation. The colleague should not share a password. The staff member should request access through the approved route so that permissions match the business need and accountability is retained.
Sources and scope
The sources below support the terminology and relevant context. The definitions, examples, cautions and practice tasks on this page are original RDE teaching material, not verbatim extracts or a replacement for an official standard or certification syllabus. Reviewed 8 October 2026. Author: Jefferson Otonbara Imgbi.
Cover image: AI-generated illustrative scene created specifically for this resource.