Glossary
Cybersecurity glossary
The terms you’ll meet in an audit report, an insurance policy or Québec’s Law 25, explained simply, with their French equivalents.
#
3-2-1-1-0 backup rule
In French : Règle 3-2-1-1-0
- A backup method: 3 copies of your data, on 2 different types of media, with 1 copy off-site, 1 copy offline or immutable, and 0 errors when you test restores. It extends the classic 3-2-1 rule to account for ransomware, which goes after backups first. The final zero is the reminder that a backup you have never restored is not a backup you can count on. Read the guide
A
Account takeover
In French : Prise de contrôle de compte
- When an attacker gains access to a legitimate account (email, social media, online banking) and uses it as if they were the owner. Typical causes are a stolen or reused password, no multi-factor authentication, or a hijacked session token. The compromised account is then used to fool its contacts, who trust the sender. Read the guide
Antivirus
In French : Antivirus, antimaliciel
- Software that detects, quarantines or deletes malicious code on a device, mainly by comparing files against signatures of known threats. Windows and macOS include one, and the Canadian Centre for Cyber Security's baseline controls call for it to update and scan automatically. It's still essential, but it struggles to spot an attacker using stolen credentials and legitimate tools: that's the job of EDR. Read the guide
Attack surface
In French : Surface d'attaque
- Every point an attacker could use to get in: internet-facing services, accounts, devices, applications, vendors with access, and even employees reachable by email. The larger it is, the higher the risk. Shrinking your attack surface means, for example, closing a forgotten remote desktop port or deleting former employees' accounts. Read the guide
B
Baseline cyber security controls
In French : Contrôles de cybersécurité de base
- A prioritized set of measures published by the Canadian Centre for Cyber Security for small and medium organizations: an incident response plan, automatic patching, malware protection, backups, strong authentication, employee training and more. They are a realistic starting point and form the basis of the CyberSecure Canada program. Read the guide
BIMI
In French : BIMI
- Brand Indicators for Message Identification: a standard that displays your company logo next to your emails in supporting inboxes. It requires an enforced DMARC policy (quarantine or reject) and, with several providers including Gmail, a mark certificate (VMC or CMC). It is a brand recognition perk, not a security control in itself. Read the guide
Brute-force attack
In French : Attaque par force brute
- An automated attempt to guess a password by trying a huge number of combinations until one works. It succeeds mostly against short or predictable passwords and against internet-facing services with no limit on attempts (remote desktop, VPN, web portals). Multi-factor authentication and lockouts after repeated failures make it largely ineffective. Read the guide
Bug bounty program
In French : Programme de primes aux bogues
- A program in which an organization invites security researchers to find vulnerabilities in its systems in exchange for a reward, usually scaled to severity. It runs on clear rules (scope, permitted methods) and often through a specialized platform. It suits organizations that already have the capacity to triage and fix reports quickly. Read the guide
Business continuity plan (BCP)
In French : Plan de continuité des affaires (PCA)
- A plan describing how the business keeps serving customers through a major disruption, including a cyberattack: priority activities, manual workarounds, communications and essential suppliers. The Canadian Centre for Cyber Security describes it as the plan for quickly resuming only the most critical operations. The IT recovery plan is its technical component. Read the guide
Business email compromise (BEC)
In French : Compromission de courriel d'affaires
- A family of frauds in which the attacker uses a real, hijacked email account, or an address that imitates one, to divert payments or extract information. CEO fraud and vendor banking change fraud are the best-known variants. Losses are often large because the request looks like normal business. Read the guide
C
CAI (Commission d'accès à l'information)
In French : Commission d'accès à l'information (CAI)
- Québec's oversight body for access-to-information and privacy laws, in both the public and private sectors. A business reports a confidentiality incident to the CAI when it presents a risk of serious injury. The CAI can investigate, issue orders and impose administrative monetary penalties. Read the guide
CCSPA (Bill C-8)
In French : LPCCE (projet de loi C-8)
- The Critical Cyber Systems Protection Act, Part 2 of federal Bill C-8, which received Royal Assent on June 15, 2026. It targets designated operators in finance, telecommunications, energy and transportation, which will have to maintain a cyber security program, manage supplier and third-party risk and report certain incidents. As of September 2026 it was not yet in force and will be phased in; suppliers to those operators may see new contract requirements. Confirm your situation with your legal counsel. Read the guide
CEO fraud
In French : Fraude du président
- A scam in which a fraudster poses as a company executive, by email or phone, and asks an employee for an urgent, confidential wire transfer. Example: 'I'm in a meeting, can you pay this supplier before 3 p.m.? Keep it between us.' The defence: confirm any unusual payment request through a different channel, at a number you already have on file. Read the guide
CIS Controls
In French : Contrôles CIS
- A prioritized list of 18 security controls published by the Center for Internet Security, a U.S. non-profit. Safeguards are grouped into three Implementation Groups (IG1 to IG3); IG1 is the basic cyber hygiene recommended for every organization, small businesses included. Version 8.1 was released in 2024. Read the guide
CISO
In French : RSSI
- Chief Information Security Officer: the person who leads an organization's information security, sets priorities, reports to leadership and coordinates incident response. In a small business it is rarely a full-time job; the role is often held by an executive, shared with the IT provider or given to a virtual CISO. Read the guide
Confidentiality incident
In French : Incident de confidentialité
- Under Québec's Law 25, any access to, use or communication of personal information not authorized by law, as well as its loss or any other breach of its protection. Examples: a client file emailed to the wrong person, a stolen laptop, a hacked mailbox. Every incident must be logged in the register; those presenting a risk of serious injury must also be reported. Read the guide
Confidentiality incident register
In French : Registre des incidents de confidentialité
- A register that every business subject to Law 25 must keep to record all of its confidentiality incidents, including those with no risk of serious injury (s. 3.8). It describes the information involved, the circumstances, the risk assessment and the measures taken. Entries must be kept for at least five years, and the CAI can ask for a copy. Read the guide
Content Security Policy (CSP)
In French : Politique de sécurité du contenu (CSP)
- A security header that tells the browser which sources a site may load scripts, images or stylesheets from. If an attacker manages to inject code into a page (cross-site scripting), the browser refuses to run it. It is especially valuable on checkout pages and forms, where injected scripts can steal card data. Read the guide
CPCSC
In French : CPCSC (Programme canadien de certification en cybersécurité)
- The Canadian Program for Cyber Security Certification, aimed at suppliers that want to win or keep certain defence contracts. Level 1, available since April 1, 2026, is an annual self-assessment against 13 requirements; Level 2 requires an assessment by an accredited body and Level 3 an assessment by National Defence, both every three years. It has appeared in some defence contracts since summer 2026, which matters for Québec's aerospace supply chain. Read the guide
Credential stuffing
In French : Bourrage d'identifiants
- An automated, large-scale attack that replays email and password pairs stolen in breaches of other websites. It exploits a common habit: using the same password everywhere. A password manager (one unique password per service) and multi-factor authentication largely neutralize it. Read the guide
CVE
In French : CVE
- Common Vulnerabilities and Exposures: a unique public identifier assigned to a known vulnerability, in the form CVE-year-number; CVE-2021-44228, for example, is the Log4Shell flaw. The CVE Program, operated by MITRE, lets vendors, tools and audit reports refer to exactly the same flaw. With a CVE number, you can quickly check whether a patch exists. Read the guide
CVSS
In French : CVSS
- The Common Vulnerability Scoring System, published by FIRST, rates a vulnerability's severity from 0 to 10 (low, medium, high or critical). Version 4.0 was released in November 2023. The base score ignores your context: a 'critical' flaw on an isolated server can be less urgent than a 'medium' one exposed to the internet. Read the guide
Cyber insurance
In French : Assurance cyber
- An insurance policy that covers part of the cost of a cyberattack: investigation, system recovery, notifying affected people, business interruption and sometimes wire fraud (often under a separate coverage). Insurers increasingly require baseline controls such as multi-factor authentication and offline backups, which they check through an application questionnaire. Read the guide
CyberSecure Canada
In French : CyberSécuritaire Canada
- A voluntary federal cyber security certification program for small and medium-sized businesses. The business implements a set of baseline controls, then is assessed by a third-party certification body accredited by the Standards Council of Canada. Certification lets it show customers and partners that it meets a recognized baseline. Read the guide
Cybersecurity audit
In French : Audit de cybersécurité
- A structured assessment of an organization's security that combines interviews, document review and technical checks (accounts, configurations, backups, network). It compares what is in place with recognized good practice and produces a prioritized list of findings. Unlike a penetration test, an audit does not try to exploit weaknesses: it gives you the big picture. Read the guide
D
Data exfiltration
In French : Exfiltration de données
- The unauthorized transfer of data out of an organization, for example to a cloud storage account controlled by the attacker. It is often the step that comes right before encryption in a ransomware attack. If personal information is involved, it is a confidentiality incident to assess and record under Law 25. Read the guide
Deepfake
In French : Hypertrucage
- Audio, video or images created or altered by artificial intelligence to imitate a real person's face or voice with striking realism. For a business, the most concrete risk is a call or voicemail from a fake executive demanding an urgent wire transfer. The main defence is a procedure: confirm any unusual payment request through another channel, using a phone number you already have on file. Québec's OQLF recommends the French term hypertrucage. Read the guide
Denial of service (DoS, DDoS)
In French : Déni de service
- An attack that makes a website, service or network unavailable by flooding it with requests. When the traffic comes from thousands of hijacked devices at once, it is a distributed denial of service (DDoS). For an online store the effect is immediate: no sales while the attack lasts. Hosting providers and content delivery networks (CDNs) offer protection. Read the guide
DKIM
In French : DKIM
- DomainKeys Identified Mail: a digital signature added to each outgoing email, verified with a public key published in the domain's DNS. It proves the message was authorized by the signing domain and was not altered in transit. Every service that sends email on your behalf (Microsoft 365, newsletter, invoicing) needs to be set up to sign. Read the guide
DMARC
In French : DMARC
- A DNS record that tells receiving servers what to do with an email that claims to come from your domain but fails SPF and DKIM checks: deliver it (p=none), quarantine it (p=quarantine) or reject it (p=reject). It also sends you reports on who is sending email in your name. It is the main defence against spoofing of your domain. Read the guide
Double extortion
In French : Double extorsion
- A ransomware tactic: steal the data before encrypting it, then apply two kinds of pressure, paying to get access back and paying to stop publication. Even if your backups let you restore everything, the leak remains. When personal information is involved, it is also a confidentiality incident under Law 25. Read the guide
E
EDR (endpoint detection and response)
In French : EDR (détection et réponse sur les terminaux)
- Security software installed on workstations and servers that continuously monitors their behaviour (processes, connections, file changes) to detect an attack, isolate the device and support the investigation. Unlike traditional antivirus, which relies mostly on signatures, it can flag abnormal activity even without known malware. Someone still has to watch its alerts. Read the guide
Email spoofing
In French : Usurpation d'adresse courriel
- Sending an email that displays a sender address that isn't really yours, such as your president's address or your company domain. The email protocol does not prevent this by default. SPF, DKIM and DMARC records let receiving servers detect and reject those messages. Read the guide
Encryption
In French : Chiffrement
- Transforming data with a key so it is unreadable to anyone who does not hold the decryption key. Data is encrypted at rest (laptop drives, backups) and in transit (TLS, VPN). Example: a stolen laptop whose drive is encrypted with BitLocker or FileVault does not give up the files stored on it. Read the guide
End of support
In French : Fin de support
- The date after which a vendor stops releasing security patches for a product. For example, Windows 10 reached end of support on October 14, 2025; paid Extended Security Updates are available for a limited time. A system past end of support keeps accumulating flaws that will never be fixed. Read the guide
F
FIDO2
In French : FIDO2
- An open authentication standard developed by the FIDO Alliance and the W3C (WebAuthn) that replaces or supplements passwords with cryptographic proof. It powers physical security keys, which plug in over USB or tap against a phone, as well as passkeys. Because the proof is tied to the legitimate website, it resists phishing. Read the guide
Firewall
In French : Pare-feu (coupe-feu)
- A device or software that filters traffic between two networks, for example between the internet and your office network, based on defined rules. So-called next-generation firewalls add application inspection, web filtering and intrusion prevention. A firewall is only as good as its rules and its firmware updates. Read the guide
H
Hardening
In French : Renforcement de la sécurité (durcissement)
- The settings that shrink a system's attack surface: turning off unneeded services, changing default passwords, removing unnecessary admin rights and applying reference configurations such as the CIS Benchmarks. Most hardening costs little beyond time, and it closes the easy doors attackers look for first. Read the guide
HSTS
In French : HSTS
- HTTP Strict Transport Security: a header a website sends to tell the browser 'from now on, only connect to me over HTTPS.' It blocks attacks that try to force an unencrypted connection, for example on public Wi-Fi. It is configured with a duration (max-age) and, if appropriate, extended to subdomains. Read the guide
I
Immutable backup
In French : Sauvegarde immuable
- A backup copy that cannot be changed or deleted during a set retention period, not even by an administrator account. Because ransomware groups try to wipe backups first, this guarantees a clean copy survives the attack. Many cloud services and backup appliances offer it, sometimes under the name object lock. Read the guide
Incident response plan
In French : Plan de réponse aux incidents
- A document that decides, before anything happens, who does what: who to call (IT provider, insurer, legal counsel), how to isolate systems, how to communicate and what must be reported. For a small business it fits on a few pages. Keep a printed copy, since the network may be down, and rehearse it at least once a year. Read the guide
Information security policy
In French : Politique de sécurité de l'information
- A document approved by leadership that sets the company's security rules: passwords and MFA, personal devices, backups, access management and incident reporting. It is the reference for employees and vendors, and insurers and customers often ask to see it. A few clear pages beat a long document nobody reads. Read the guide
ISO/IEC 27001
In French : ISO/IEC 27001
- The international standard that sets out requirements for an information security management system (ISMS): risk assessment, policies, controls and continual improvement. Organizations can be certified by an accredited body, with annual surveillance audits and recertification every three years. The current edition dates from 2022, and its Annex A lists 93 controls. Read the guide
IT recovery plan (disaster recovery plan)
In French : Plan de reprise informatique
- The technical side of business continuity: it lists critical data, applications and processes, the order in which to restore them and the backups to use. It sets a recovery time objective (RTO) and a recovery point objective (RPO) for each system. The Canadian Centre for Cyber Security stresses testing, ideally in a separate environment to avoid disrupting operations: a plan that has never been tested holds surprises. Read the guide
L
Lateral movement
In French : Mouvement latéral
- After an initial break-in, often a workstation compromised through phishing, the attacker hops from one machine to another to reach servers, backups or admin accounts. This is the step that turns an isolated incident into a company-wide shutdown. Network segmentation and separate admin accounts slow it down. Read the guide
Law 25
In French : Loi 25
- The common name of the Québec statute passed in 2021 to modernize privacy protection; among other things, it amended the Act respecting the protection of personal information in the private sector. Its obligations, phased in from 2022 to 2024, include appointing a person in charge of privacy, managing confidentiality incidents and conducting privacy impact assessments. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover. Confirm your situation with your legal counsel. Read the guide
Least privilege
In French : Principe du moindre privilège
- The rule that every person, account or program gets only the access strictly needed for its task, and only for as long as needed. Example: reception has no access to payroll files, and nobody uses an admin account for day-to-day work. If an account is compromised, the damage stays contained. Read the guide
Logging
In French : Journalisation
- Automatically recording a system's events: sign-ins, configuration changes, file access and alerts. Logs let you detect an intrusion and reconstruct what happened. They only help if they are turned on, kept long enough and protected from deletion; some services keep them for a short time by default. Read the guide
M
Malware
In French : Logiciel malveillant (maliciel)
- The umbrella term for any software designed to cause harm: stealing data, spying, encrypting files or taking control of a device. Viruses, Trojan horses, spyware and ransomware are all malware. Modern protection relies on EDR tools that watch behaviour, not just known signatures. Read the guide
Managed security service provider (MSSP)
In French : Fournisseur de services de sécurité gérés (MSSP)
- A firm that specializes in managed security services: round-the-clock monitoring (SOC), firewall, EDR or SIEM management and vulnerability scanning. An MSSP often complements an MSP, which runs day-to-day IT without necessarily having deep security expertise. The contract should spell out who does what when an alert fires at night or on a weekend. Read the guide
Managed service provider (MSP)
In French : Fournisseur de services gérés (MSP)
- A company that remotely manages all or part of an organization's IT, usually for a monthly fee: workstations, servers, Microsoft 365, network and user support. MSPs often hold broad admin access across all of their clients, which makes them a prime target for attackers. Their own security practices are worth checking. Read the guide
MDR (managed detection and response)
In French : MDR (détection et réponse gérées)
- A service in which an outside team monitors your detection tools (often EDR or XDR) day and night, analyzes alerts and steps in during an attack, for example by isolating a workstation. It gives a small business continuous monitoring without building its own team. Check what is included: some services only alert, others act. Read the guide
MTA-STS
In French : MTA-STS
- Mail Transfer Agent Strict Transport Security: a mechanism that lets your domain require that email sent to you travel over an encrypted, verified TLS connection. Without it, an attacker on the network path could force a plain-text delivery. It is set up with a DNS record and a small policy file hosted on a web subdomain, and is often paired with TLS-RPT, which sends failure reports.
Multi-factor authentication (MFA)
In French : Authentification multifacteur (AMF)
- A sign-in method that requires at least two different kinds of proof: something you know (password), something you have (phone, security key) or something you are (fingerprint). A stolen password is no longer enough to get in. Not all methods are equal: a text-message code is easier to intercept than a FIDO2 key or a passkey. Read the guide
N
NAS (network-attached storage)
In French : Stockage en réseau (NAS)
- A storage device connected to the office network, often used to share files or receive backups from workstations and servers. It allows fast restores, but the Canadian Centre for Cyber Security warns that threat actors can attack NAS devices and ransomware can spread to them. A NAS should never hold your only copy: keep another one off site, offline or immutable, and manage the NAS with a separate account. Read the guide
Network segmentation
In French : Segmentation réseau
- Dividing a network into separate zones (offices, guest Wi-Fi, cameras, production, servers) with filtered traffic between them. If a device in one zone is compromised, the attacker cannot easily reach the others. Example: guest Wi-Fi should never be able to see the accounting server. Read the guide
NIST Cybersecurity Framework (CSF)
In French : NIST CSF (cadre de cybersécurité du NIST)
- A cybersecurity framework published by the U.S. National Institute of Standards and Technology and widely used outside the United States. Version 2.0, released in February 2024, organizes activities into six functions: Govern, Identify, Protect, Detect, Respond and Recover. There is no certification: it is a tool for assessing maturity and setting priorities. Read the guide
O
Operational technology (OT)
In French : Informatique industrielle (OT)
- Systems that run physical equipment: programmable logic controllers, CNC machines, supervisory systems and building controls. They often stay in service for decades and cannot be patched as easily as an office PC. That is why they should be separated from the business (IT) network. Read the guide
OWASP Top 10
In French : OWASP Top 10
- The reference list of the ten main categories of web application security risk, published by the OWASP Foundation, a non-profit. The 2025 edition puts broken access control first and adds, among other things, software supply chain failures. It is an awareness document and a starting point for testing a web application, not a certification standard. Read the guide
P
Passkey
In French : Clé d'accès
- A passwordless sign-in method built on the FIDO2 standard: a cryptographic key pair whose private key stays on your device or in your password manager, unlocked with your fingerprint, face or PIN. It cannot be guessed or handed over to a fake site. Microsoft 365 and Google Workspace both support passkeys. Read the guide
Password manager
In French : Gestionnaire de mots de passe
- Software that generates, stores and fills in long, unique passwords for every service, protected by a master password and multi-factor authentication. In a business, it also lets you share access in a controlled way and revoke it when someone leaves. It ends password reuse, the fuel of credential stuffing. Read the guide
Patch management
In French : Gestion des correctifs
- The process of identifying, testing and installing security updates for operating systems, software, network equipment and firmware, within deadlines set by severity. Many attacks exploit flaws for which a patch already existed. A written policy states who is responsible and how fast patches must go in. Read the guide
Payment gateway
In French : Passerelle de paiement
- A service that securely passes card data entered on an online store or terminal to the payment network, then returns the authorization. When the payment page is fully hosted by the gateway, through a redirect or an embedded form, card numbers never pass through your servers, which lightens your PCI DSS obligations. Your website still needs protecting: an attacker who tampers with it can send customers to a fake payment page. Read the guide
PCI DSS
In French : PCI DSS
- The Payment Card Industry Data Security Standard, set by the PCI Security Standards Council. It applies to any business that accepts, processes, stores or transmits data from cards such as Visa, Mastercard or American Express. The current version is 4.0.1; what you must do depends on your transaction volume and how payments are handled (terminal, hosted payment page, etc.). Read the guide
Penetration test (pentest)
In French : Test d'intrusion
- A simulated attack, carried out by specialists with the organization's written authorization, to find weaknesses and show how far an attacker could get. It can target the internet perimeter (external test), the internal network, a web application or employees. Without authorization, trying to access a computer system can be an offence under the Criminal Code (s. 342.1). Read the guide
Personal information
In French : Renseignement personnel
- Any information about a natural person that allows them to be identified, directly or indirectly: name, address, social insurance number, health record, but also an employee number or location data. In Québec, businesses must protect it with reasonable security measures based on how sensitive it is, how much they hold and how it is used. Read the guide
Phishing
In French : Hameçonnage
- A fraudulent message (email, text, phone call) that impersonates a trusted organization to get you to click a link, open an attachment or hand over your credentials. Example: a fake refund or delivery notice that leads to a page imitating the Microsoft 365 sign-in. It is one of the most common ways attackers get into small businesses. Read the guide
Phishing simulation
In French : Simulation d'hameçonnage
- An exercise in which a company sends its employees fake phishing emails, designed and managed in-house or by a provider, to measure reflexes and train the team. The goal is not to catch people out but to teach them to spot and report a suspicious message. Results show where training should focus. Read the guide
Phishing-resistant MFA
In French : Authentification résistante à l'hameçonnage
- Multi-factor authentication that a fake sign-in page cannot intercept or relay, because it is cryptographically bound to the real website. FIDO2 security keys, passkeys and Windows Hello for Business are examples. By contrast, a text-message code or a push notification approved out of habit can be hijacked by a fraudster. Read the guide
PIPEDA
In French : LPRPDE
- The Personal Information Protection and Electronic Documents Act, the federal law governing personal information in Canada's private sector. In Québec, the provincial law applies to most businesses for their activities within the province, but PIPEDA covers federally regulated businesses (banks, telecoms, interprovincial transportation) and information that crosses provincial or national borders. For a breach that creates a real risk of significant harm, it requires a report to the Office of the Privacy Commissioner of Canada. Confirm your situation with your legal counsel. Read the guide
Plugin
In French : Plugiciel (module d'extension)
- A software component added to an application such as WordPress to give it an extra feature: a form, a store, SEO tools, online booking. Each plugin is code written by a third party, with its own flaws and its own update schedule: a plugin abandoned by its author or left unpatched can open a hole in the whole site. Keep only the ones you need, and keep them up to date. Read the guide
Privacy impact assessment (PIA)
In French : EFVP (évaluation des facteurs relatifs à la vie privée)
- An analysis, required by Québec's Law 25, of the risks a project poses to personal information and the measures to reduce them. It is mandatory for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3), and before such information is communicated outside Québec. Example: replacing your payroll or client management software. Read the guide
Privacy officer
In French : Responsable de la protection des renseignements personnels
- Under Law 25, the person in charge of the protection of personal information in a Québec business. By default it is the person with the highest authority, often the president, who can delegate the role in writing. Their title and contact information must be published on the company website (s. 3.1). Read the guide
Q
Quishing (QR code phishing)
In French : Hameçonnage par code QR
- Phishing that hides the malicious link in a QR code instead of a clickable link: in an email, a PDF attachment, or a fake sticker placed over the real one on a parking meter, menu or invoice. The code is scanned with a phone, where the real address is harder to check and the protections on an office computer don't always apply. Before entering a password or paying after a scan, check the address that appears. Read the guide
R
Ransomware
In French : Rançongiciel
- Malware that encrypts an organization's files and systems, then demands a ransom for the decryption key. Many groups also steal the data before encrypting it and threaten to publish it. Offline or immutable backups, tested regularly, are the best way to restart without paying. Read the guide
Red team
In French : Équipe rouge
- A realistic, extended attack exercise in which a team imitates a criminal group with a specific objective (say, reaching payroll data), combining technical, physical and psychological methods. It also tests the organization's ability to detect and respond. It suits mature organizations; for most small businesses, a targeted penetration test is more useful. Read the guide
Remote Desktop Protocol (RDP)
In French : Protocole de bureau à distance (RDP)
- Microsoft's protocol for controlling a Windows computer remotely. Exposed directly to the internet, it is a classic target for brute-force attacks and ransomware groups. It should only be reachable through a VPN or a ZTNA solution, with multi-factor authentication. Read the guide
Risk of serious injury
In French : Risque de préjudice sérieux
- The threshold that, under Law 25, triggers the duty to notify the CAI and the affected people 'promptly' after a confidentiality incident (s. 3.5). It is assessed based on the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be misused. Unlike Europe's GDPR, the law sets no 72-hour deadline. Confirm your assessment with your legal counsel. Read the guide
RPO (recovery point objective)
In French : Objectif de point de rétablissement
- How much data the business can afford to lose, expressed in time: the point to which data must be recoverable after an outage. With a nightly backup, you could lose up to a full day of work; if that's too much, you need to back up more often. The RPO therefore sets backup frequency, just as the RTO sets the restore speed you need. Read the guide
RTO (recovery time objective)
In French : Objectif de délai de rétablissement
- How long a system can stay down before the outage seriously harms the business. If your RTO for invoicing is 24 hours, your backups and recovery plan must let you restore it in under 24 hours, and only a timed test restore can confirm that. NIST defines it as the overall time a system can be in recovery before negatively affecting the organization's mission or business processes. Read the guide
S
Security awareness training
In French : Formation de sensibilisation à la cybersécurité
- Activities that teach employees to recognize common threats (phishing, payment fraud, weak passwords) and to report an incident. The Canadian Centre for Cyber Security recommends baseline training for everyone, practical exercises, role-based modules and individual training records. The UK NCSC finds short, frequent refreshers more effective than a single session once a year. Read the guide
Security operations centre (SOC)
In French : Centre des opérations de sécurité (SOC)
- A team, in-house or outsourced, that continuously monitors an organization's security: analyzing alerts, investigating and coordinating incident response. Few small businesses run their own SOC; they rely on a managed security service provider or an MDR service. Not to be confused with a SOC 2 report, which is an audit attestation. Read the guide
security.txt
In French : security.txt
- A small text file published at /.well-known/security.txt on a website that explains how to report a vulnerability to the organization: contact address, disclosure policy and expiry date. Standardized in RFC 9116, it makes sure a good-faith researcher knows who to write to. Read the guide
SIEM
In French : SIEM (gestion des informations et des événements de sécurité)
- Security information and event management: a platform that centralizes logs from many systems (firewalls, servers, Microsoft 365, applications) to retain them, correlate them and raise alerts. It is valuable for post-incident investigations and for demonstrating compliance. Without staff to tune the rules and handle alerts, it mostly produces noise. Read the guide
SIM swapping
In French : Échange de carte SIM
- A fraud in which a criminal talks your mobile carrier into moving your number to a SIM card they control, often by posing as you. They then receive your calls and texts, including sign-in and password reset codes. It's one reason SMS is the weakest form of multi-factor authentication. Ask your carrier to add a PIN or password to your account. Read the guide
Single sign-on (SSO)
In French : Authentification unique (SSO)
- A mechanism that lets you sign in once, with a central account (for example Microsoft Entra ID or a Google Workspace account), to reach many applications. The upside: one account to protect with MFA, and one access to cut off when an employee leaves. The trade-off: that central account becomes very valuable and needs strong protection. Read the guide
Smishing
In French : Hameçonnage par texto
- Phishing sent by text message rather than email. The messages often impersonate a delivery service, a bank or a government agency and push the victim to tap a link. On a phone, the real link address is harder to check, which is what makes the scam work. Read the guide
SOC 2
In French : SOC 2
- An attestation report issued by a CPA firm against the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report assesses control design at a point in time; a Type II report tests that controls operated over a period, often 3 to 12 months. It is mostly requested from software and cloud service vendors by their North American customers. Read the guide
Spear phishing
In French : Harponnage (hameçonnage ciblé)
- Personalized phishing aimed at a specific person or organization, built on information gathered in advance: the boss's name, suppliers, current projects. That makes it far more convincing than a mass mailing. Example: an email addressed by name to the controller, citing a real supplier and a real invoice number. Read the guide
SPF
In French : SPF
- Sender Policy Framework: a DNS record listing the servers allowed to send email for your domain, so the receiving server can check the sender. It is capped at 10 DNS lookups, a limit that is quickly reached as you add sending services. On its own, SPF does not protect the 'From' address the recipient sees: pair it with DKIM and DMARC. Read the guide
Spyware
In French : Logiciel espion
- Malware that quietly watches a device's activity: keystrokes, passwords, screenshots and browsing history. The data is sent to the attacker, who uses it to get into your accounts or sells it. It usually arrives through an attachment, a fake app or software downloaded outside official sources. Read the guide
SSL/TLS certificate
In French : Certificat SSL/TLS
- An electronic file issued by a certificate authority that proves a website matches the domain shown and enables an encrypted TLS connection. It expires: an expired certificate triggers a browser warning that drives customers away. The maximum validity of public certificates has been shrinking in stages since 2026, which makes automatic renewal practically essential. Read the guide
Supply chain attack
In French : Attaque de la chaîne d'approvisionnement
- An attack that reaches an organization through a trusted supplier: a hijacked software update, an IT provider whose remote management tools are compromised, an infected code library. The victim did nothing wrong but inherits the supplier's weakness. That is why assessing your vendors' security and limiting their access matters. Read the guide
T
Tabletop exercise
In French : Exercice sur table
- A discussion-based exercise in which leadership and key staff walk through a fictional cyberattack scenario around a table: who decides to disconnect systems, who calls the insurer, who notifies the regulator? No systems are touched. The Canadian Centre for Cyber Security recommends this type of exercise so everyone knows their role, and free scenarios are available, such as the UK NCSC's Exercise in a Box. Read the guide
TLS
In French : TLS
- Transport Layer Security: the protocol that encrypts communications between two systems, such as a browser and a website (the 's' in https and the padlock) or two mail servers. It succeeded SSL, a name that has stuck in everyday use. Versions 1.2 and 1.3 are the ones to use; older versions should be turned off. Read the guide
Trojan horse
In French : Cheval de Troie
- Malware disguised as a legitimate program or file: a fake invoice, a fake PDF reader, 'free' software. Once opened, it quietly installs a back door for the attacker or other malware. It does not spread on its own: the victim runs it, often after a phishing email. Read the guide
Typosquatting
In French : Typosquattage
- Registering a domain name nearly identical to a well-known company's, off by one letter or by the extension (for example .co instead of .ca). Fraudsters use these domains for fake websites, phishing or emails that appear to come from a real supplier. Monitoring look-alike domains lets you act before your customers get caught. Read the guide
V
Vendor banking change fraud
In French : Fraude au changement de coordonnées bancaires
- A fraud in which a fake supplier, or a real supplier whose mailbox has been hacked, announces a 'new bank account' for upcoming invoices. The next payments go to the fraudster, often unnoticed until the real supplier asks to be paid. Any change in banking details should be confirmed by phone, at a number already on file. Read the guide
Virtual CISO (vCISO)
In French : RSSI virtuel (vCISO)
- A part-time CISO provided by an outside firm for a few hours or days a month. They set the security roadmap, oversee vendors, prepare answers to insurer and customer questionnaires and advise leadership. The business gets CISO-level expertise without the cost of a full-time hire. Read the guide
Virtual private network (VPN)
In French : Réseau privé virtuel (RPV)
- An encrypted tunnel that connects a remote device or another office to the company network over the internet. It protects data in transit, but a user on the VPN often has access to a large part of the network. VPN appliances are frequent targets: keep them patched and protected with multi-factor authentication. Read the guide
Vishing
In French : Hameçonnage vocal
- Voice phishing, by phone call or voicemail. The fraudster poses, for example, as your IT provider's help desk or your bank to get an authentication code or have you install remote access software. AI tools can now imitate the voice of someone you know. Read the guide
Vulnerability
In French : Vulnérabilité (faille de sécurité)
- A weakness in software, a device, a configuration or a process that an attacker can exploit. Examples: unpatched software, a default password never changed, a file share open to everyone. Known software vulnerabilities are usually assigned a CVE identifier and a CVSS severity score. Read the guide
Vulnerability scan
In French : Analyse de vulnérabilités (scan)
- An automated check of your systems, run with a tool called a scanner, that looks for known weaknesses: outdated software, exposed services, misconfigurations. It is fast and can be repeated often, but it does not confirm whether flaws are actually exploitable and it produces false positives. It complements a penetration test rather than replacing it. Read the guide
W
Web application firewall (WAF)
In French : Pare-feu applicatif Web (WAF)
- A filter placed in front of a website or web application that blocks known malicious requests, such as SQL injection or attempts to exploit common flaws. It is often offered by the host or the content delivery network (CDN). It lowers risk but does not replace fixing the application's own vulnerabilities. Read the guide
WPA3
In French : WPA3
- Wi-Fi Protected Access 3, the newest Wi-Fi security protocol, certified by the Wi-Fi Alliance since 2018. In shared-password mode, it better resists attacks that try to guess the password offline. WPA2 remains acceptable with a long passphrase; the older WEP and WPA protocols should no longer be used. Read the guide
X
XDR
In French : XDR (détection et réponse étendues)
- Extended detection and response: an evolution of EDR that gathers and correlates data from several sources, including endpoints, email, cloud accounts and the network. The aim is to reconstruct an attack end to end rather than handle isolated alerts. The term is largely a marketing one, and what it covers varies a lot from vendor to vendor. Read the guide
Z
Zero Trust
In French : Zero Trust (vérification systématique)
- A security model built on the idea that no user, device or network is trusted by default, even inside the office. Every access request is checked against identity, device health and context, then limited to what is strictly needed. The Canadian Centre for Cyber Security's French materials call it a 'modèle à vérification systématique'. Read the guide
Zero-day vulnerability
In French : Vulnérabilité du jour zéro
- A vulnerability the software vendor does not know about yet, or for which no patch exists at the time it is exploited. You cannot fix it in advance, but segmentation, least privilege and EDR limit the damage, and the patch should go in as soon as it ships. Once a fix is published, the flaw is no longer a zero-day, but it stays dangerous on every system left unpatched. Read the guide
ZTNA
In French : ZTNA (accès réseau zéro confiance)
- Zero trust network access: a remote access approach that, instead of opening up the whole network the way a traditional VPN does, grants access to a specific application after checking the user's identity and device health on every connection. The applications are not exposed directly to the internet. It is Zero Trust applied to remote work. Read the guide
Social engineering
In French : Piratage psychologique (ingénierie sociale)