Plain-English glossary of IT, network and security terms

Cabling and networks

Cat5e, Cat6, Cat6a Categories of network cable, in increasing capability. Cat5e handles gigabit speeds and is what most older buildings have. Cat6 handles more and is the common default for new work. Cat6a supports 10 gigabit over the full distance and costs more to buy and to install because it is thicker and less flexible. Which one you need depends on the building, not the year.

Permanent link and channel The permanent link is the fixed cable in the walls, from the patch panel to the wall jack. The channel is that plus the patch cables at each end. Standards set a 90 metre limit on the permanent link and 100 metres for the whole channel. Exceeding it is the most common cause of a run that works intermittently.

Patch panel The bank of ports in your rack where every cable in the building terminates. Cables from the wall come here, and short patch cables connect them to the switch. It exists so nobody ever has to re-terminate a wall cable to move a connection.

Plenum and riser rated Fire ratings for cable jackets. Plenum-rated cable is required in air-handling spaces, typically above a suspended ceiling used for return air, because it produces less smoke and does not spread flame the same way. Riser-rated is for vertical runs between floors. Both cost more than general-purpose cable, which is why a suspiciously cheap quote is sometimes a quote for the wrong cable.

Fire stopping Sealing the hole where a cable passes through a fire-rated wall or floor, using an approved product, so the wall still does its job. A required and frequently skipped step. If a cabling quote does not mention it and your cables cross rated walls, ask.

Fiber optic cable Glass rather than copper, carrying light. Goes much further than copper without loss, immune to electrical interference, and does not carry electricity between buildings, which matters for lightning. Most buildings do not need it, and some very much do.

OM3, OM4, OS2 Fiber types. OM3 and OM4 are multimode, used for shorter runs inside and between nearby buildings, with OM4 going further. OS2 is single-mode, for long distances. Multimode equipment is cheaper, single-mode goes further.

Fusion splicing Joining two fibers by melting the glass ends together. Produces a stronger, lower-loss join than a mechanical connector. Requires a specific and expensive machine, which is why not every contractor does it.

Wire map test The basic check that each of the eight wires in a network cable goes to the correct pin at both ends and nothing is crossed, broken or shorted. This is verification, and it is the minimum. It is not certification.

Certification testing Measuring a cable against the performance limits in the standard using an instrument that produces a pass or fail report for each run. This is what you should receive at handover. The difference between tested and certified is not a marketing distinction.

Insertion loss How much signal strength is lost along a cable run. Every metre of cable, every connector and every splice adds some. Too much and the link fails, or worse, works badly in a way that looks like a software problem.

OTDR Optical Time Domain Reflectometer. An instrument that sends light down a fiber and measures what bounces back, producing a trace showing exactly how far along the fiber each connector, splice or fault sits. This is how you locate a break in a buried fiber without digging up the whole run.

As-built drawing A drawing of what was actually installed, as opposed to what was designed. Cable routes, jack locations, panel numbering. The single most useful document a cabling contractor can hand you, and the one most often not produced.

PoE, Power over Ethernet Delivering electrical power over the same network cable that carries data. It is why a camera or an access point needs only one cable rather than a cable and an electrician. There are power classes, and a switch has a total power budget across all its ports, which is a real constraint when adding devices.

Switch The box that connects everything on your network to everything else. Managed switches allow configuration, network separation and monitoring. Unmanaged switches just pass traffic. The distinction matters when you want cameras on a separate network from your computers.

VLAN A way of splitting one physical network into separate logical networks. Used to keep guest Wi-Fi away from your files, cameras away from your computers, and building controls away from everything. Requires managed switches.

Wireless

Access point, AP The device broadcasting your Wi-Fi. Not a router, though home equipment combines them. A business installation uses several access points, each cabled, coordinated so devices hand off between them.

Coverage versus capacity Coverage is whether a signal reaches. Capacity is how many devices it can serve at once at usable speed. A single access point can give full-signal coverage across a floor and still collapse when thirty devices connect. This is the most common Wi-Fi complaint and the most misdiagnosed.

Mesh Access points that relay traffic wirelessly to each other rather than each having its own cable. Convenient in a building where cabling is impractical. The cost is throughput, because a relaying access point uses radio time to both receive and resend, roughly halving what it can deliver. Cabled beats mesh whenever cabling is possible.

Site survey Measuring the actual radio environment in your building, either predictively from a floor plan or on site with instruments. It determines how many access points you need and where. Skipping it is why some installations need a second visit.

Co-channel interference Two nearby access points using the same radio channel, so they take turns rather than working in parallel. More access points does not always mean more capacity, and badly planned ones make things worse.

Wireless bridge, point-to-point link A radio link connecting two buildings’ networks without a cable in the ground. Needs line of sight. Extends your network, does not provide internet.

Wi-Fi calling Routing mobile calls over your internet connection instead of the cellular network. Free, supported by every major Canadian carrier, and often the answer to poor indoor mobile signal before buying any hardware.

Cameras and security

Pixels on target How many pixels of the image actually land on the thing you care about. A 4K camera covering a whole parking lot has very few pixels on any individual face. This is the number that determines whether you can identify someone, and resolution alone does not tell you it. It is the difference between seeing that something happened and knowing who did it.

NVR, Network Video Recorder The box on site that records footage from network cameras to its own disks. No monthly fee for the recording. The footage lives in your building, which is both the advantage and the risk.

VMS, Video Management System Software managing cameras and recordings, often cloud-hosted. Adds remote access, multi-site views and analytics, usually for a subscription. Choosing between a local recorder and cloud video is a real decision with real trade-offs.

Retention How many days of footage you keep before it is overwritten. Determined by camera count, resolution, frame rate and disk space. It is a decision, not a default, and the right number depends on how long it typically takes you to discover an incident.

Lux A measure of light level. Cameras and analytics have minimum lux requirements. A yard that seems adequately lit to your eye may be well below what the camera needs to do anything useful.

Video analytics Software detecting things in footage: people, vehicles, line crossings, loitering, plate numbers. Works reliably inside specific limits for object size, lighting and mounting. What it does well and what is oversold are quite different lists.

Access control Managing who can open which door and when, using fobs, cards, codes or phones, with a record of every use. The main difference from keys is that a fob can be switched off at 4pm without rekeying anything.

Maglock and electric strike Two ways of holding a door electrically. A maglock holds the door shut with an electromagnet. An electric strike replaces the door frame’s strike plate and releases the latch. They behave differently in a power failure and interact differently with fire code, which is why the choice is not just about price.

Anti-passback A rule preventing one credential being used to let several people through, or being handed back through the door to someone else. Relevant where access is tied to time and attendance.

Central station, ULC listing A central station is the facility receiving alarm signals and acting on them. ULC listing is a certification standard for those facilities and for certain kinds of alarm work. Fire alarm monitoring in Ontario is ULC-listed work and requires a ULC-listed fire alarm contractor. We do not do fire alarm work for that reason.

Virtual guard tour An operator remotely viewing your cameras on a schedule, checking the site as a patrol would, rather than only responding to alarms.

Audio warn-off A speaker at the site through which a monitoring operator can speak. Someone in your yard at 2am being addressed by name and told they are being recorded usually leaves. This is the practical difference between recording and monitoring.

Managed IT, cloud and security

MSP, Managed Service Provider A company managing your IT for a recurring fee rather than charging per incident. Fully managed means they handle everything. Co-managed means they work alongside your own person. The choice depends on whether you have someone internal.

MFA, multi-factor authentication Requiring something beyond a password, usually a code or an approval on a phone. The single most effective control against the way small businesses actually get compromised. Also the question every cyber insurance application asks, in three separate places.

EDR, Endpoint Detection and Response Security software on computers that watches behaviour rather than only matching known virus signatures, and can isolate a machine that starts acting like it is compromised. A step beyond traditional antivirus.

DMARC, SPF, DKIM Three email authentication records published in your domain’s DNS. Together they tell receiving mail servers which servers are allowed to send email as you, and what to do about messages that fail. Without them, anyone can send email appearing to come from your domain, and your own legitimate email is more likely to land in spam.

DNS The system translating names into addresses, so that your domain name points at your website and your email goes to the right place. Whoever controls your DNS controls where your web and email traffic goes, which makes it one of the most important logins your business has.

Tenant Your organisation’s own space in a cloud service such as Microsoft 365. A tenant takeover is the process of gaining proper administrative control of one that was set up by someone else, which comes up regularly when an IT person leaves.

Global admin The highest level of administrative access in Microsoft 365. Can do anything, including removing other administrators. Should be used rarely, protected with MFA, and never be the account somebody reads email with.

Shared responsibility model The division of duties between a cloud provider and you. The provider keeps the service running. You are responsible for your data, your access control, and recovering from your own mistakes. Which is why Microsoft does not back up your mailbox.

Immutable backup A backup that cannot be altered or deleted for a set period, even by an administrator. The point is that ransomware with full access to your systems still cannot destroy the copy you need.

Offline backup, air gap A backup that your production systems cannot reach. If someone with full network access could delete your backups, they are not offline, whatever the software cost. This is the specific thing insurance applications ask about.

ESU, Extended Security Updates Microsoft’s paid programme keeping security patches flowing to an operating system past its end of support. Priced per device per year and cumulative, so buying it late costs more. Relevant right now to anyone still running Windows 10.

Clear, purge, destroy Three levels of data sanitisation defined in NIST Special Publication 800-88. Clear overwrites normally accessible space. Purge resists laboratory recovery. Destroy physically ruins the media. Which level you need depends on what was on it and where it is going.

PIPEDA Canada’s federal private-sector privacy law. For a provincially regulated Ontario business it governs customer and client personal information, and includes an obligation to report certain breaches and to keep a record of every breach for 24 months. It does not govern your own employees’ personal information unless you are a federally regulated business.

Business continuity plan A written answer to what you do when something is unavailable. Not a backup, though it depends on one. It covers who decides, who calls whom, how you operate while systems are down, and in what order things come back.