Samples of the malware, to analyse its origin, functionality and impact (cf. evidence at a physical crime scene)

A sequence of numbers used to uniquely identify a computer on a network. Every network-enabled device has its own IP address

An automatically generated log file that records processes and actions on a computer or network

Information and details of how communication took place with a potential perpetrator in the run-up to the attack

Two contrasting definitions are in common use:

• A website where you can check whether your own data (email addresses, passwords, etc.) has been affected by a data breach and published online.
• Platforms on which data from data breaches is published or sold by criminals.

An account with extended access rights. Unlike a standard user, an administrator can make changes to the system settings without restriction. 

A summary of key events in the computer system, login attempts and driver issues. 

Isolation or separation of systems or network segments to prevent the problem from spreading

Malware that can damage or take control of systems

Separation of different networks (private and work)

Describes the way in which the computer system is or was accessed:

• local use = Access is via the use of the relevant device (e.g. computer or tablet) on site
• Remote access = Access to a system via the internet or a local network. Remote maintenance systems frequently use this method.
• VPN connection (Virtual Private Network) = A VPN connection can be used to conceal the IP address and mask the location in order to protect data from unauthorised third parties. A VPN connection enables an encrypted connection.
• Cloud access = Cloud access allows data to be stored, retrieved and shared from any internet-enabled device. The data is stored in the cloud on external servers on the internet. There are various providers offering these services, some of which are free of charge.

The state of files or the entire system, for example following an IT incident. They may be lost or no longer traceable, encrypted – meaning they cannot be accessed – or there may simply be no further information available about them.

Describes the visible or measurable abnormalities, in a similar way to a medical condition. These may include:

• Locked files
• Login errors, e.g. due to locked-out accounts
• Systems are unavailable
• Systems are running more slowly than usual 
• Error messages displayed, including error codes

Describes a method of manipulation using psychological tricks with the aim of persuading the victim to carry out specific, ill-considered actions. The individual is exploited as a weak point in order to gain access to data, systems or assets.

Messages, phone calls or even advertising mail that reach recipients in large numbers and without their consent. Often for advertising or fraudulent purposes.

A cyberattack in which servers, websites or networks are deliberately overwhelmed by massive volumes of requests, thereby preventing normal operation.

A cyberattack that attempts to trick people into revealing sensitive data via fraudulent messages, phone calls or websites.

Malware that can encrypt individual files or entire computer systems. Criminals use this method to extort a ransom in exchange for decryption.

Malware that replicates itself automatically and can thus infect or damage multiple files or systems. There are various types, such as Trojans and ransomware.