7. Glossary

AbuseIPDB — Community database of IP addresses reported for malicious activity including spam, scanning, and command and control. Used to assess the reputation of destination IPs during incident investigation.

Active defense — Proactively engaging with adversary activity to gather intelligence, increase attacker cost, or disrupt operations. Includes honeypots and deception technology. Distinguished from passive defense by intentional adversary engagement.

APT (Advanced Persistent Threat) — Nation-state or state-sponsored threat actor characterized by advanced technical capabilities and long-term, stealthy campaigns designed to achieve specific intelligence or operational objectives without detection.

Asset discovery — The process of identifying all devices, systems, and services present on a network. The prerequisite to vulnerability scanning and security monitoring. See: 2.1.1, 3.1.1.

Attack surface — The sum of all points where an attacker could attempt to enter or extract data from an environment. Minimizing attack surface reduces risk.

Beaconing — Regular, periodic outbound communications from a compromised system to a command-and-control server. A key indicator of malware infection. Characterized by consistent interval, destination, and payload size. See: 2.2.1.

CASB (Cloud Access Security Broker) — Security control layer between users and cloud services enforcing security policy, providing visibility into cloud application usage, and enabling DLP for cloud data.

Chain of custody — Documentation tracking the collection, handling, transfer, and storage of digital evidence from collection to disposition. Required for evidence to be legally admissible. See: 4.2.1.

CIA Triad — The three fundamental security objectives: Confidentiality (unauthorized access prevention), Integrity (unauthorized modification prevention), Availability (ensuring authorized access). Framework for classifying security impact. See: 1.1.2.

CVSS (Common Vulnerability Scoring System) — Standardized scoring system (0–10) measuring the inherent severity of a vulnerability. Base score measures worst-case severity; temporal and environmental modifiers contextualize to specific environments. See: 3.3.1.

Cyber Kill Chain — Lockheed Martin's seven-stage model of targeted intrusions: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives. Used for gap analysis and defense planning. See: 4.1.1.

DKIM (DomainKeys Identified Mail) — Cryptographic email authentication that adds a digital signature to outgoing emails, verifiable via DNS. Proves email content integrity and that the signing domain authorized the message. See: 2.3.2.

DLP (Data Loss Prevention) — Controls that monitor and restrict movement of sensitive data in motion (network), at rest (storage), and in use (endpoint). Matches defined data patterns; cannot prevent all exfiltration. See: 2.1.7.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) — Email authentication policy that builds on SPF and DKIM, instructing receiving servers to quarantine or reject unauthenticated messages. Also provides reporting to domain owners. See: 2.3.2.

EDR (Endpoint Detection and Response) — Security platform providing deep endpoint visibility (process creation, file changes, network connections, registry modifications) and response capabilities (isolation, process termination, forensic collection). See: 2.3.1.

EPSS (Exploit Prediction Scoring System) — A probability-based metric (0–100%) predicting the likelihood a vulnerability will be exploited in the wild within 30 days. Complements CVSS: use CVSS for theoretical severity, EPSS for active exploitation risk. A low-CVSS vulnerability with high EPSS may represent greater real-world risk than a critical-CVSS vulnerability with low EPSS. See: 3.3.1.

False positive — A scanner or detection system incorrectly identifies a benign item as malicious. High false positive rates cause alert fatigue and waste analyst resources. See: 3.3.2.

False negative — A scanner or detection system fails to detect a real vulnerability or threat. The most dangerous failure mode — creates false confidence. See: 3.3.2.

Honeypot — Decoy system with no legitimate business function. Any interaction is inherently suspicious. Used to detect internal threats, attacker reconnaissance, and credential abuse. See: 2.4.3.

IoC (Indicator of Compromise) — Observable artifact indicating potential compromise: file hash, IP address, domain name, registry key, user agent string. Used in both reactive detection and proactive threat hunting. See: 2.4.3, 4.2.1.

ISAC (Information Sharing and Analysis Center) — Sector-specific organizations facilitating threat intelligence sharing among member organizations. FS-ISAC (financial), H-ISAC (healthcare), E-ISAC (energy). See: 2.4.2.

Kill Chain — See: Cyber Kill Chain.

KEV (Known Exploited Vulnerabilities) — CISA's catalog of vulnerabilities confirmed as actively exploited in the wild. The highest-priority remediation signal: federal agencies must patch within mandated timeframes; private organizations treat KEV listing as immediate-action priority regardless of CVSS score. See: 3.3.1, 3.5.2.

Legal hold — Directive to preserve all potentially relevant data in anticipation of litigation or regulatory investigation. Halts normal data deletion schedules. Must be coordinated between IT and legal counsel. See: 4.2.1.

Living off the land (LOL) — Attacker technique using legitimate system tools (PowerShell, WMI, certutil) for malicious purposes, avoiding detection by not introducing new executables. See: 2.2.2.

MITRE ATT&CK — Comprehensive, community-maintained taxonomy of adversary tactics, techniques, and sub-techniques organized into a matrix. Used for detection coverage mapping, threat hunting, and incident documentation. See: 4.1.2.

MTTD (Mean Time to Detect) — Average time from incident start to detection. Measures monitoring and detection quality. See: 5.2.2.

MTTR (Mean Time to Respond) — Average time from detection to containment. Measures response process efficiency. Distinct from MTTD — they measure different SOC capabilities. See: 5.2.2.

MTTRemediate (Mean Time to Remediate) — Average time from detection to full remediation. Measures the complete response and recovery lifecycle. See: 5.2.2.

NTP (Network Time Protocol) — Protocol for synchronizing system clocks across a network. Essential for log correlation across multiple systems — time skew creates false correlations and misses true correlations in forensic analysis. See: 2.1.1.

OSINT (Open Source Intelligence) — Intelligence gathered from publicly available sources: social media, government publications, CERT advisories, domain registration data, certificate transparency logs. See: 2.4.2.

OWASP Top 10 — Periodically updated list (2013, 2017, 2021 editions) of the most critical web application security risks. Includes injection, broken access control, cryptographic failures, insecure design, and security misconfiguration. See: 3.4.3.

PAM (Privileged Access Management) — Security solution controlling and monitoring access to privileged accounts. Features: just-in-time access, session recording, credential vaulting, dual control. See: 2.1.5.

Parameterized query — Database query technique that separates SQL code from user-supplied data, making SQL injection structurally impossible. The primary defense against SQL injection. See: 3.4.1, 3.5.3.

PCI DSS (Payment Card Industry Data Security Standard) — Security standard for organizations handling cardholder data. Requires quarterly external scans by an ASV and internal scans at least quarterly and after significant changes. See: 3.1.3.

PIR (Post-Incident Review) — A structured debrief conducted after incident resolution to identify what worked, what failed, and what must change. Produces a documented action item list with owners and deadlines. Distinct from the Incident Report (factual documentation); the PIR uses the report as input but focuses on organizational learning and process improvement. See: 4.3.2.

Penetration testing — Authorized, controlled attack simulation testing whether identified vulnerabilities are actually exploitable in the context of the real environment and defenses. Complements, but does not replace, vulnerability scanning. See: 3.5.3.

SASE (Secure Access Secure Edge) — Cloud-delivered security architecture converging network security and WAN capabilities. Enforces Zero Trust policy for users connecting from anywhere. See: 2.1.4.

SIEM (Security Information and Event Management) — Platform aggregating, normalizing, and correlating logs from across the environment. Generates alerts when correlation rules match. The primary log analysis tool in a SOC. See: 2.3.1.

SOAR (Security Orchestration, Automation, and Response) — Platform automating defined, repeatable response workflows triggered by SIEM alerts. Distinct from SIEM: SIEM detects; SOAR responds. Does not replace human judgment for novel threats. See: 2.3.1, 2.5.1.

SPF (Sender Policy Framework) — DNS record listing IP addresses authorized to send email for a domain. A passing SPF check confirms the sending IP is authorized — it does not confirm the domain is legitimate. See: 2.3.2.

SSRF (Server-Side Request Forgery) — Vulnerability where an attacker causes the server to make outbound HTTP requests to attacker-controlled URLs. In cloud environments, can expose metadata service credentials. See: 3.4.2.

Tabletop exercise — Simulated scenario walkthrough for an IR team in a discussion format. No systems are affected. Surfaces gaps in playbooks, communication breakdowns, and unclear decision-making authority. See: 4.3.1.

TTP (Tactics, Techniques, and Procedures) — Describes how threat actors operate. Tactics are high-level goals; techniques are specific methods; procedures are specific implementations. TTP-based detection is more durable than indicator-based detection. See: 2.4.1.

UEBA (User and Entity Behavior Analytics) — Analytics platform establishing behavioral baselines for users and systems, flagging deviations. Detects compromised credentials through impossible travel, bulk access, and abnormal activity patterns. See: 2.3.4.

XSS (Cross-Site Scripting) — Web vulnerability where attacker-injected JavaScript executes in other users' browsers. Reflected XSS targets individuals via crafted links; stored (persistent) XSS affects all users viewing the compromised page. Stored XSS is more severe. See: 3.4.1.

Zero Trust — Security architecture where every access request is authenticated and authorized regardless of network location. Eliminates implicit trust based on being inside the network. "Never trust, always verify." See: 2.1.4.