# Glossary

IT and cybersecurity terms explained in plain language.

### [Backup](https://amensecurity.ca/en/glossary/backup.md)

Backup is a point-in-time copy of data and systems so you can restore files or entire servers after deletion, hardware failure, or ransomware. The 3-2-1 rule means three copies, two media types, one offsite.

Cloud backup to Canadian or approved regions helps meet data residency expectations while protecting against office fires or theft. Immutable snapshots prevent attackers from encrypting your last good copy.

Backups fail when nobody tests restores. Schedule quarterly restore drills for critical apps and document Recovery Time Objectives (RTO) so staff know how long operations may be down.

### [Disaster Recovery](https://amensecurity.ca/en/glossary/dr.md)

Disaster Recovery (DR) is the planned process to restore IT services after a major incident — datacenter loss, cyberattack, or extended outage — not just a single deleted file.

A DR plan defines roles, communication trees, failover order (email first vs. ERP), and how to invoke cloud replicas or warm standby environments. Canadian businesses should align DR with insurance, legal hold, and privacy breach notification under PIPEDA.

DR differs from backup: backup provides data; DR provides continuity. Test the full runbook annually; tabletop exercises reveal gaps in contact lists and vendor dependencies.

### [EDR](https://amensecurity.ca/en/glossary/edr.md)

Endpoint Detection and Response (EDR) monitors laptops and servers for malicious behavior — not just known virus signatures — and can isolate a compromised device before ransomware spreads.

Traditional antivirus misses fileless attacks and living-off-the-land techniques. EDR records process trees and network connections so analysts can roll back or contain threats. Microsoft Defender for Endpoint and other platforms integrate with Entra ID and SIEM.

Deploy EDR on every managed endpoint, including remote Macs and PCs. Pair with MFA and patch management; EDR is most effective when the baseline hygiene is already solid.

### [Entra ID](https://amensecurity.ca/en/glossary/entra-id.md)

Microsoft Entra ID (formerly Azure Active Directory) is the cloud directory for user accounts, groups, and sign-in policies used by Microsoft 365 and thousands of integrated SaaS apps.

Entra ID enables conditional access (require MFA, compliant device), self-service password reset, and hybrid identity when on-premises Active Directory syncs to the cloud. It is the control plane for who may access what.

Harden Entra ID by protecting Global Administrator accounts with phishing-resistant MFA, limiting standing admin roles, and reviewing sign-in logs for impossible travel or legacy authentication protocols.

### [IaaS](https://amensecurity.ca/en/glossary/iaas.md)

Infrastructure as a Service (IaaS) delivers virtual machines, storage, and networking in a cloud provider’s datacenter — you manage the OS and applications; the vendor manages physical hardware and facilities.

Canadian teams use IaaS to replace aging servers, spin up dev/test environments, or host line-of-business apps with pay-as-you-go pricing. Data residency choices (Canada Central, Canada East) matter for PIPEDA and provincial rules.

IaaS still requires patching, backup, and security hardening. Many SMBs pair IaaS with an MSP for monitoring and governance rather than running VMs as "set and forget."

### [Law 25](https://amensecurity.ca/en/glossary/law-25.md)

Quebec’s Law 25 (modernization of private-sector privacy law) imposes stricter rules on organizations that collect personal information about Quebec residents — even if the company is based elsewhere in Canada.

Key IT-related themes include appointing a privacy officer, conducting privacy impact assessments for certain projects, tightening consent for sensitive uses, and reporting breaches to the Commission d’accès à l’information. Bilingual privacy notices and data minimization in apps and CRM systems are common compliance tasks.

If you serve Quebec customers or employees, align backup retention, access logs, and vendor subprocessors with Law 25 alongside PIPEDA.

### [MFA](https://amensecurity.ca/en/glossary/mfa.md)

Multi-Factor Authentication (MFA) requires users to prove identity with two or more factors — something they know (password), something they have (phone or security key), or something they are (biometric).

Passwords alone are the top entry point for ransomware and business email compromise. Enabling MFA on Microsoft 365, VPN, and admin consoles blocks most credential-stuffing attacks even when passwords leak.

Roll out MFA with a phased plan: protect global admins first, then all staff. Prefer authenticator apps or passkeys over SMS where possible, and document recovery procedures so lockouts do not halt operations.

### [MSP](https://amensecurity.ca/en/glossary/msp.md)

A Managed Service Provider (MSP) is an IT partner that runs day-to-day technology for your organization under a recurring agreement — monitoring, patching, backups, and support — instead of unpredictable break-fix invoices.

Canadian small and mid-sized businesses typically rely on an MSP for Microsoft 365 administration, endpoint security, network health, and after-hours coverage. A strong MSP documents service levels, reports on ticket trends, and helps you plan upgrades before hardware or software reaches end of life.

Compared with hiring an in-house team, an MSP spreads specialist skills (security, cloud, networking) across many clients, which often lowers total cost while improving response times and compliance readiness for PIPEDA and sector rules.

### [PIPEDA](https://amensecurity.ca/en/glossary/pipeda.md)

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in commercial activity.

IT decisions affect PIPEDA: where data is stored, who can access backups, how long logs are kept, and how quickly you notify the Privacy Commissioner after a breach that poses real risk of significant harm. MSPs handling personal data are often considered service providers with contractual obligations.

Practical steps include data inventories, least-privilege access, encryption in transit and at rest, and written agreements with vendors that describe security safeguards and breach reporting timelines.

### [PaaS](https://amensecurity.ca/en/glossary/paas.md)

Platform as a Service (PaaS) provides a managed runtime for applications — web apps, containers, or databases — so developers deploy code without patching underlying Windows or Linux servers.

Examples include Azure App Service, Azure SQL, and managed Kubernetes. PaaS reduces operational toil but requires secure CI/CD, secret management, and network integration with on-prem systems.

Choose PaaS when your team wants faster releases and elastic scale; choose IaaS when you need full OS control or legacy software that cannot run on managed platforms.

### [Phishing](https://amensecurity.ca/en/glossary/phishing.md)

Phishing is social engineering that tricks people into revealing passwords, approving fake payments, or installing malware — usually through urgent email, SMS, or voice calls pretending to be banks, CRA, Microsoft, or executives.

Business email compromise costs Canadian organizations millions annually. Defenses combine user training, simulated phishing tests, email authentication (SPF, DKIM, DMARC), attachment sandboxing, and MFA so stolen passwords alone are useless.

Report suspicious messages to your MSP or IT team; never click "verify account" links from unsolicited mail. Verify wire transfers and gift-card requests through a second channel.

### [RPO](https://amensecurity.ca/en/glossary/rpo.md)

Recovery Point Objective (RPO) is the maximum age of data you can afford to lose, measured in time — for example, four hours of email or 15 minutes of orders.

If your RPO is one hour, backups or replication must run at least that often. Tighter RPOs cost more storage and bandwidth but reduce loss during ransomware or accidental bulk deletes.

Work with finance and operations to set RPO per system: accounting may need 15 minutes; internal wiki may tolerate 24 hours. Document choices in your DR plan.

---
Source page: https://amensecurity.ca/en/glossary
Markdown version for AI agents · Amen Security
Email: info@amensecurity.ca
Phone: +1 (204) 514-3536