A–Z reference
Forty-two terms that appear on product pages, in security warnings and in news coverage, each defined once and written to be read on its own. Where a term is easier to understand through an example, the example is included rather than left implied.
Entries are cross-linked: a word set in a link inside a definition has its own entry. Definitions describe how these terms are used consistently across the industry, and can be checked against any vendor's documentation.
Software that displays advertising the user did not ask for, usually by injecting it into web pages or opening windows outside the browser. Adware is often installed alongside something the user did want, which is why it overlaps with a potentially unwanted program. It is rarely destructive and frequently the first sign that an installer was taken from a repackaged download site rather than the vendor.
The component that actually decides whether a file is malicious. One product may contain several engines — a signature matcher, a heuristic analyser, a behaviour monitor — and the interface you see is a front end to all of them. How antivirus works follows a file through each stage in order.
The total set of ways into a system: every installed program, open network port, browser extension, connected account and piece of removable media. Reducing it is usually cheaper than defending it. Uninstalling a program you no longer use removes its share of the attack surface permanently, in a way no scanner can.
A copy of data held separately from the original, so the original can be lost without the data being lost. The widely used shorthand is three copies, on two kinds of media, with one kept off-site. A copy on a drive that is always plugged in is a convenience, not a backup, because ransomware that reaches the computer usually reaches the attached drive too.
Worked example: a desktop with a daily copy to an external drive that is unplugged after each run, plus a weekly copy to a second drive kept elsewhere, satisfies the shorthand. The same desktop with a permanently mounted network folder does not.
Watching what a program does after it starts — which files it opens, whether it writes to system areas, whether it begins encrypting documents in bulk — and intervening when the pattern matches known malicious activity. It catches threats that no signature describes, at the cost of occasionally stopping an unusual but legitimate program.
A group of compromised computers controlled remotely and used together, typically to send bulk email, generate fraudulent traffic or overwhelm a target with requests. An affected machine often shows no symptom the owner notices, because the operator's interest is in keeping it working normally.
A check made against the vendor's servers while a file is being examined, usually by sending a hash rather than the file itself. It lets a product recognise something first seen minutes ago elsewhere in the world, and it means the product's behaviour depends on a network connection. What is transmitted during a lookup is set out in the vendor's own privacy documentation, and is worth reading before installing.
Taking username and password pairs exposed in one service's breach and trying them automatically against many other services. It succeeds only where a password has been reused, which is the reason a password manager and two-factor authentication do more for most people than any additional scanner.
A refresh of the signature set, distinct from an update to the program itself. Definition updates are frequent and small; program updates are occasional and larger. A product reporting that it is up to date is usually reporting the first kind, and both matter.
Code that downloads or executes through a web page without the visitor choosing to run anything, generally by way of an exploit in the browser or a plug-in. Current browsers have narrowed this considerably through sandboxing and automatic updating, which is why an out-of-date browser is a larger risk than an out-of-date scanner.
Any device that connects to a network and is used by a person: a desktop, a laptop, a phone, a tablet. The word comes from corporate security, where products are sold per endpoint. On a home product page it usually appears as "devices", and it is the unit a multi-device licence counts.
A technique that takes advantage of a specific flaw in a specific version of software to make it do something it should not. Exploits are version-dependent, which is why applying a patch ends a particular exploit's usefulness outright rather than merely reducing it.
A verdict of "malicious" against something harmless. False positives are the unavoidable cost of heuristic detection, and they matter most when the file flagged is part of the operating system or a tool you depend on. The correct response is to leave the file in quarantine, check with the software's own vendor, and restore from quarantine rather than disabling protection entirely.
The opposite error, a false negative, is malicious code that passes as safe. No product avoids both errors at once; tuning away from one moves a product towards the other.
A filter on network traffic that decides which connections may be made, in which direction, by which program. Every current desktop operating system includes one, switched on by default. A firewall bundled in a security suite replaces that with the vendor's own, usually adding per-application prompts rather than new capability.
An examination of every file on every attached volume, as opposed to real-time protection, which examines files as they are used. A full scan is slow and mostly redundant on a machine where real-time protection has been running continuously, but it is the right step after protection has been off, after a machine has been used by someone else, or when a file arrives on old removable media.
A short fixed-length value calculated from a file's contents, such that any change to the file changes the value. Hashes let a product recognise an exact known file cheaply, and let a cloud lookup ask about a file without transmitting it. Changing a single byte produces a different hash, which is why hash matching alone cannot keep up with malware that alters itself.
Judging a file by its characteristics and intentions rather than by an exact match: whether it is packed to conceal its contents, whether it writes to start-up locations, whether its structure resembles a family of known threats. Heuristics are how anything new is caught at all, and they are also the source of most false positives.
Software, or occasionally a hardware device between keyboard and computer, that records keystrokes. It is the mechanism behind many account takeovers, and the reason two-factor authentication matters: a recorded password on its own is not enough to sign in when a second factor is required.
Malicious code carried inside a document, in the scripting language office suites provide for automation. It runs only if macros are enabled, which is why current office software disables them by default for files from the internet and shows a warning bar instead. Clicking that bar on a document received unexpectedly is the single action that makes this category work.
The umbrella term for software written to act against the interests of the person running it: viruses, worms, trojans, ransomware, spyware and more. "Virus" is often used loosely to mean the whole category; the narrower meaning is in its own entry.
A subscription covering a stated number of devices at once, usually across several operating systems. The count, the platforms covered and whether a device can be swapped mid-term are all set by the vendor and vary between editions, so they are worth confirming on the vendor's own site before purchase rather than from a third-party summary.
An encrypted store that generates and remembers a different password for every account, unlocked by one strong passphrase. Its value is that it removes reuse, which is what makes credential stuffing profitable. Many security suites include one; browsers and operating systems include one as well, and the important thing is using any of them consistently.
A correction issued by a software vendor, often closing a flaw that an exploit depends on. Applying patches promptly is the least glamorous and most consistently effective step available to a home user, and the Australian Cyber Security Centre's guidance for individuals at cyber.gov.au places it near the top of its advice.
A message that impersonates an organisation to obtain credentials, payment details or an authorised action. It is a social engineering technique rather than a technical one, and no scanner prevents a person from typing a password into a convincing copy of a bank's sign-in page. Current examples are catalogued by Scamwatch.
Software that is not malicious enough to call malware but was installed without meaningful consent, or does something the user would not have agreed to: toolbars, search redirectors, aggressive "optimisers". Products differ in how firmly they treat this category, which is why one scanner reports items another ignores without either being wrong.
A holding area where a suspect file is stored in an encoded form so it cannot execute, pending a decision. Quarantine exists precisely because detection is imperfect: it makes a false positive reversible. Emptying quarantine immediately, out of anxiety, is the one action that turns a recoverable mistake into a permanent one.
Malware that encrypts files and demands payment for the key, frequently combined with a threat to publish copied data. The practical defence is a backup that was not connected when the encryption ran; recovery without one depends entirely on the attacker. Incidents affecting Australians can be reported through cyber.gov.au.
Also called on-access scanning: files are examined as they are created, opened or executed, so a threat is caught at the moment of use rather than at the next full scan. It is the feature that distinguishes a resident product from an on-demand scanner, and it is the setting people most often switch off to fix a performance problem and then forget to switch back on.
Malware that alters the operating system itself so its own files and processes are hidden from ordinary inspection, including from a scanner running on the same system. This is why products offer a scan that runs before the operating system loads, and why a confirmed rootkit is usually answered by reinstalling the system rather than cleaning it.
A restricted environment in which code runs without access to the rest of the system, used both by browsers to contain page code and by security products to observe a suspicious file safely. A browser tab is already a sandbox; that is a large part of why modern browsers are hard to attack directly.
Pages or programs that imitate a security warning — a fake scan, a fabricated infection count, a countdown — to push the viewer into installing something or calling a number. The tell is that a web page cannot scan a computer: anything in a browser window claiming to have found infections is describing a result it has no way of obtaining. Scams, rights and help covers what to do when one appears.
A pattern that identifies a specific known piece of malware, distributed to products as a definition update. Signature matching is fast and precise and can only recognise what has already been catalogued, which is why it is the first stage of detection and never the only one.
Software that gathers information about a person's activity and sends it elsewhere without informed consent: browsing history, credentials, messages, location. It overlaps with keyloggers and, where it is installed by someone with physical access to monitor a partner or family member, with conduct the eSafety Commissioner provides support and reporting routes for.
A bundle of security tools sold as one subscription — antivirus with some combination of firewall, password manager, VPN, parental controls and file cleanup. The word describes packaging only. Judging a suite means judging each component you will actually use, and ignoring the ones you will not.
Malware that presents itself as something desirable so the user installs it willingly — a cracked application, a codec, an installer from a site that is not the vendor's. Unlike a worm it does not spread on its own; it relies on distribution, which in practice means search results, download portals and messaging.
Requiring a second proof of identity beyond a password, usually a code from an app or a hardware key. It converts a stolen password from an account takeover into a failed attempt, and it is the highest-value change most people can make to their own security. Codes sent by SMS are weaker than an app or key but still substantially better than a password alone.
The route by which a program receives new versions — the vendor's own updater, an app store, or the operating system's update service. Installing from the vendor's own channel matters because repackaged installers distributed elsewhere are a common way that adware and potentially unwanted programs arrive.
In the strict sense, malware that attaches itself to another file or program and spreads when that host is run. The classic file-infecting virus is now a small share of what scanners actually encounter, but the word has stayed as the name of the product category.
A virtual private network routes a device's traffic through an operator's server, so the local network sees an encrypted tunnel and the destination sees the operator's address. It changes who can observe traffic in transit; it does not remove malware, block phishing, or make a person unidentifiable to services they sign in to. VPNs are frequently bundled into a suite and frequently described in stronger terms than they warrant.
A flaw being exploited before the vendor has issued a fix, so defenders have had zero days to respond. Against a zero-day, signatures are by definition absent, and what remains is behaviour monitoring, sandboxing, least-privilege accounts and a current backup.
The practical use of a glossary in this category is translation. A product page that promises "advanced protection against emerging threats" is describing heuristic analysis and behaviour monitoring, both of which have known limits and known costs. One promising "complete privacy" is usually describing a VPN and a tracker blocker, neither of which does what "complete" implies. Once the marketing phrase has been mapped back to the mechanism, the comparison becomes a comparison of mechanisms, and the questions on choosing protection become answerable.
Social engineering
Persuading a person to take an action against their own interest — approving a login, reading out a code, granting remote access — rather than defeating a technical control. It is the mechanism behind phishing and support-call fraud, and it is deliberately time-pressured, because a person given time usually checks.