Additional resources

Administrative privileges: An account that has more control (to either modify, customize, or erase data) over a computer system or network than a regular user.

Adware: A form of malware that, once installed, shows the user advertising while they browse the internet, often through pop-up windows.

Allow list: A list of what or who is permitted to perform certain functions on a given system or network. Used to maintain control over the activities performed on the system or network.

Anti-virus software: Software that defends a device, system, or network against viruses, malware, and spyware, either by preventing infection or by disinfecting following an attack.

Asset: A resource used to perform a business task (for example, personnel, software, or equipment).

Authentication: The process of verifying software or a user’s genuine identity.

Authorization: Access privileges assigned by a network administrator to a user, program, or process to perform certain functions on that network.

Autodeposit: A procedure for allowing Interac e-Transfers to be automatically deposited into an account from pre-authorized contacts. Find out more about autodeposit.

Automated banking machine (ABM): An electronic device used to perform basic banking functions without the need for a bank teller or access to a branch. There are nearly 3,600 Scotiabank ABMs in Canada you can use to withdraw cash, check balances, and more. Get location information for Scotiabank branches and ABMs across Canada using our Scotiabank branch and ABM locator. 

Backdoor: A network entry point that is either private or undocumented.

Backing up: Copying data to a separate secure location (a physical hard drive or cloud-based storage system) for the purposes of safeguarding the information. 

Baiting: A scam technique that involves using physical media devices to install malware onto a computer or network. For example, scammers introduce free flash drives (USB devices) into a workplace, hoping that an employee will connect the device to their work computer, thereby installing the malware.

Biometrics: Human physical data points that are used to verify identity and control access (for example, your fingerprint, facial scans, or retinal scans).

Browser: A navigation tool for the internet. Common browsers include Chrome, Safari, Firefox, and Microsoft Edge.

Bug: A bug is an error in the software’s programming that causes it to produce unexpected results or crash altogether. Bugs can affect performance or even be used by hackers to bypass security protections that are in place.    

Business Email Compromise (BEC): A form of spear phishing that largely targets companies that conduct regular payment processing activities. Criminals will compromise a business’s email system and then pretend to be the CEO or senior management to request fraudulent money transfers.    

BYOD (Bring Your Own Device): A company policy that dictates whether, and to what extent, employees can use their own devices in the workplace and how these devices interface with company resources.

Cache: A hardware or software component that stores data so that websites can be accessed faster.  

Card skimming: Stealing information from credit cards or debit cards for fraudulent purposes using devices that are often disguised as part of an ABM or payment processor.

Clearing: A method of erasing all information from a data storage device so that the data can’t be retrieved through routine processes.

Confidentiality: The act of protecting private or sensitive information from being disclosed to anyone without being authorized to view that information.

Confidential information: Information that is only accessible by a select few individuals. Loss or theft of confidential information would cause great damage to your business and must be handled carefully. An example of confidential information is sensitive client data, such as private medical records or banking information. 

Cookies: Bundles of data used by websites to store information on a user’s browser that can be accessed later when the user visits the same website.

• First-party cookie: A cookie that matches the URL seen in the user’s web address bar
• Third-party cookie: A cookie that’s created not by the website that appears in the address bar, but by a third party whose function is to supply advertising to the user across multiple websites. Some browsers offer the option of blocking third-party cookies.

Credentials: The details or data that authenticate a user for the purpose of logging in to an online platform.

Cyber-attack: An attack on the vulnerable segments of a system or network for the purposes of fraud, gathering information, or damaging a business asset.

Cybersecurity: The practice of protecting networks, devices, and data from unauthorized access or criminal use.

Data breach: Internal data that has been stolen or obtained without authorization and that is generally made available to external entities.

Data theft: The act of stealing data, either by breaking into a system or network using the internet or by stealing a physical hard drive that contains data.

Decrypt/Decryption: The process of making a coded message readable and understandable. This can include data that has been encrypted (coded) for protection.

Detection: Monitoring system or network events for the purpose of becoming aware of malicious activity, such as a data breach or hacking.

Digital Subscriber Line (DSL): An internet connection in which data is distributed through telephone lines.

Encryption: The process of scrambling data so that only authorized parties can understand the information.

Encryption key: A random string of characters that passes through an encryption or decryption algorithm used to scramble (encrypt) and unscramble (decrypt) data. 

eStatements: A digital version of a paper bank statement. Instead of a physical statement sent by mail, customers receive a notification when an eStatement is ready to view digitally.

Firewall: A security tool that monitors and controls incoming and outgoing network traffic based on a set of security rules.

Firmware: A form of software that provides low-level support for how a device operates.

Fraudster (or scammer): A person who initiates a criminal plan or tactic to steal money or sensitive information for malicious purposes.   

Gateway: An intermediate device between two networks that allows data to flow through the networks (for example, a modem, server, or router). 

Hacker: An individual who uses computers, networking, or other skills to overcome a technical problem. May also refer to anyone who uses their abilities to gain illegal, unauthorized access to systems or networks.

Hosting: A service that allows digital resources to be stored by a service provider for the purposes of making that information available on the internet.

Hypertext Transfer Protocol (HTTP): A method of communication between client and server that is the foundation for the exchange of information on the internet.

Hypertext Transfer Protocol Secure (HTTPS): A version of Hypertext Transfer Protocol that uses an extra layer of encryption to create a more secure form of data exchange. The S stands for secure. 

Identity fraud: Occurs when someone uses stolen personal or financial information, often to commit another crime. For example, accessing someone else's computer, email, or bank accounts to apply for a new bank account, a passport, or a loan or to buy goods and services.

Identity theft: Stealing someone else's personal information for criminal purposes (for example, mail theft, phishing scams resulting in data breaches, or information theft due to computer viruses and malware).

InfoAlerts: A Scotiabank service that instantly informs you of activity on your accounts. With InfoAlerts, you’ll get an app notification, email, or both whenever there’s a transaction on your bank account, credit card, line of credit, or business accounts. Get more information on setting up InfoAlerts.

Internet of Things (IoT): The network of everyday devices that are connected to the internet and that can store or transmit data (for example, smartwatches, TVs, gaming systems, thermostats, home monitoring systems, or smart home locking systems). 

Keystrokes: The striking of keys on a keyboard.

Keystroke logger: Software that can record (log) the sequence of keys struck on a keyboard on a given device. The information collected by the logger can then be used to commit fraud or breach a system using confidential passwords.

LAN (Local Area Network): A connection between devices within a limited distance from one another, generally within one building or physical space.

Malicious: Characterized by the intention to do harm.

Malware (malicious software): Software that has been designed to compromise the security and privacy of a network or system by gaining unauthorized access to a network or system and/or disrupting, damaging, or disclosing confidential information.    

Modem: A device that encodes and decodes data in order to transmit and receive that data over the internet.

Multi-factor authentication (MFA): A method for certifying a user’s identity through different pieces of evidence (factors), such as objects only they would have or information only they would know (for example, confirming a PIN or password). 

One-time password (OTP): An automatically generated password intended for a single login session. Considered to be more secure than a user-generated password or a password that’s used more than once.

Operating system (OS): Software that supports hardware systems on a computer or device.    

Overwrite: To replace existing data with new data. The data that was overwritten generally can’t be recovered.

Pagejacking: The practice of copying a website’s style or content. Commonly used to create a fraudulent version of the original site.

Passphrase: A dynamic password composed from a sentence instead of a single word in order to create a complicated and therefore stronger authentication process.

Phishing: A form of fraud where cyber criminals use scam emails to trick you into providing personal or sensitive information that can be used for fraudulent purposes. You may be asked to disclose confidential financial and personal information, like passwords, credit card numbers, access codes, or tax identification numbers.

Personal identification number (PIN): A numerical code used by a bank’s customers to access their account information with an associated client card.

PIN pad: A device used to enter the code (or PIN) for financial transactions using an accompanying client card.

Pretexting: Presenting a false story (or pretext) for obtaining someone else’s information or money.    

Public information: Data that’s widely available, with no restrictions or ownership that prevent distribution.

Purging: Deleting data to ensure it can’t be recovered or reconstructed.

Ransomware: A type of malware where a hacker takes control of your infected device and encrypts (locks) your files. The hacker then demands a ransom payment to decrypt (unlock) the files.

Remote lock: To restrict access to a device from a distance for security purposes (for example, when the device has been lost).    

Restricted information: Information that requires a specific level of protection and is often limited to a select group of people, such as employees, specific clients, and vendors / service providers. An example of restricted information is payroll documentation that’s being accessed by your business’s accountant.    

Router: A device that connects packets of information between computer networks. Its primary function is to manage traffic between two networks and allow multiple devices to use the same internet connection. 

Scam: A type of fraud designed to obtain money or personal information from another party.

Security questions: A method of authenticating a user’s identity by gathering information that only they would know.

Sensitive information: Confidential data that requires protection from unauthorized access for the security and/or privacy of an individual or business. It can include both personal or financial information.

Service Set Identifier (SSID): The name used to identify a wireless network.

Smishing: The text message (SMS) equivalent to phishing. This scam involves a fraudster sending a message by way of a text message to obtain money or personal information for malicious purposes.

Social engineering: The practice of tricking people to overlook important security measures and give up their confidential information. Fraudsters make up a believable story to convince unsuspecting people to:

• Click on a malicious link
• Open a malicious attachment
• Hand over confidential information
• Grant unauthorized access to their personal and financial information
• Transfer funds
• Share passwords

Software: A set of instructions, data, or programs used to operate a device in order for it to perform its intended function.

Spear phishing: A targeted phishing scam that attempts to steal sensitive information, such as account credentials or financial information, from a small group of individuals or a specific victim for malicious reasons. Often these attempts are well researched and use information about the subject inside the email, like someone’s name or job.

Spyware: A form of malware that, once installed, spies on you and steals data or personal information.

Spoof (spoofing): The act of disguising a malicious message as coming from a trusted source.

Tailgating: A form of physical security breach where an unauthorized person attempts to follow an authorized person into a restricted area.

Trojan horse: A form of malware that presents as something useful or desirable, but which is malicious in intent. 

Two-factor authentication: A security measure that adds a second layer of identification to protect access to your business’s sensitive data. Also known as multi-factor authentication.

Uniform Resource Locator (URL): A website’s address.

Universal Serial Bus (USB): An industry-standard connection for electronic devices that’s commonly used for cables, data storage, and power supply. 

Virtual Private Network (VPN): Allows those who are granted access to connect to your business’s internal network over the internet. The internet isn’t an inherently secure place to send and receive confidential information. That’s why a VPN is useful as it encrypts data, rendering it unusable to anyone other than the sender and the intended receiver.

Virus: A form of malware that replicates itself across a network by injecting its own code. Successful replication leads to devices that are then “infected.”

Vulnerability: The weakness in a given network’s defences that could be exploited by a fraudster.

Vishing: The telephone equivalent of phishing. It’s the act of using the phone to scam people into surrendering sensitive information that will be used for identity theft. 

Wipe: To remove all data from a computer or data storage device. Some devices offer the option of performing a wipe remotely in the case of loss or theft.