Glossary

3-2-1 Rule

A backup-resilience heuristic that keeps at least three data copies on two storage types with one copy offsite, while still requiring separation, integrity checks, and restore testing.

72-Hour Notification

A 72-hour notification is a regulatory deadline that requires an organization to report certain security or privacy incidents within 72 hours of becoming aware of them.

90% Confidence Intervals

A 90% confidence interval in expert elicitation expresses the estimator's intended ninety-percent probability that an uncertain value lies within the stated bounds, given current information.

A Record

An A record is a DNS record that maps a domain name to an IPv4 address.

AAAA Record

An AAAA record is a DNS record that maps a domain name to an IPv6 address.

ABAC

Attribute-based access control uses attributes such as user role, device state, location, data sensitivity, or request context to decide whether access should be allowed.

AD Attack Surfaces

The parts of an Active Directory environment that an attacker can target or abuse, including privileged accounts, service accounts and their tickets, group memberships, domain controllers, trusts, and misconfigured permissions.

AD Compromise Response

The specialized response to an incident where an attacker has gained control of Active Directory itself, which often means assuming every credential and trust is suspect and may require rebuilding or restoring the directory from a clean state.

AD Privileged Account Hardening

Securing the high-power accounts in Active Directory, such as Domain Admins and service accounts, by limiting their number and rights, restricting where they can log in, enforcing strong authentication, and monitoring their use closely.

AD Recovery Timeline

An Active Directory recovery timeline is the rehearsed, dependency-aware sequence and duration for restoring trusted identity services after corruption or compromise.

AES

The Advanced Encryption Standard, the most widely used symmetric encryption algorithm, meaning the same key encrypts and decrypts data. It protects data at rest and in transit and is considered secure when used correctly with key sizes of 128, 192, or 256 bits.

AI and Compliance

The compliance questions raised when organizations use AI services in the cloud, including how training data is handled, where it is processed, whether use meets emerging AI regulations, and how to demonstrate accountability for automated decisions.

AI in Cloud Architecture

The design considerations for safely incorporating AI and machine-learning services into a cloud security architecture, covering where AI workloads sit in the network, how their data is protected, and how their access and logging fit existing controls.

API Gateway Security

Securing the API gateway, the entry point that sits in front of backend services and APIs, by enforcing authentication, authorization, rate limiting, and input checks centrally so individual services do not each have to.

API Schema and Version Discovery

API schema and version discovery inventories current, legacy, documented, and observed operations from approved specifications, client traffic, schemas, and supplied architecture information.

API Server Security

Protecting the Kubernetes API server, the central control plane component that every cluster action passes through. Because it governs the whole cluster, hardening its authentication, authorization, and exposure is critical.

ARP

The Address Resolution Protocol, which maps a local IP address to the hardware (MAC) address needed to deliver a frame on a local network. Because it trusts unsolicited replies, it can be abused for spoofing, which is why defenders monitor it.

AS-REP Roasting

AS-REP roasting is offline password guessing against Kerberos response material returned for an account that does not require preauthentication.

AS-REP Roasting Detection

AS-REP roasting detection identifies accounts and requests that use Kerberos without preauthentication, then distinguishes approved legacy behavior from credential-access attempts.

ATT&CK Coverage Maintenance

ATT&CK coverage maintenance reconciles rules, test evidence, sensor health, threat priorities, incidents, exercises, platforms, blind spots, and ATT&CK versions over time.

ATT&CK Coverage Map

An ATT&CK coverage map relates prioritized adversary behaviors to telemetry, analytics, response, tests, owners, confidence, and known gaps.

ATT&CK Coverage Mapping

Charting an organization's detections against the MITRE ATT&CK matrix to see which adversary techniques are covered, which are weakly covered, and which are blind spots, so detection effort can be focused.

ATT&CK Hunt Mapping

ATT&CK hunt mapping links a hunt question or observed procedure to an appropriate current technique, platform, analytic reference, local observable evidence, and framework version.

ATT&CK Knowledge Base Use

ATT&CK knowledge base use applies MITRE's real-world tactic, technique, sub-technique, procedure, and defensive content to local threat research, detection design, testing, and communication.

ATT&CK Navigator

A free tool for working with the MITRE ATT&CK matrix visually, letting defenders annotate, color, and layer techniques to track detection coverage, map threat-actor behavior, or plan detection work.

ATT&CK Navigator Layer Semantics

ATT&CK Navigator layer semantics define the local meaning of colors, scores, comments, links, metadata, filters, and enabled states in a layer.

ATT&CK Technique Mapping

ATT&CK technique mapping links a local detection to the most specific adversary behavior supported by its hypothesis, observable evidence, and validation cases.

ATT&CK Version and Domain Scope

ATT&CK version and domain scope records the release or collection date, Enterprise, Mobile, or ICS domain, platform filters, and selected objects that informed an analysis or layer.

AWS CloudTrail Investigation

Using AWS CloudTrail logs, which record API calls and account activity, to investigate a cloud incident: who did what, from where, and when. It is the primary evidence source for AWS control-plane actions.

AWS Control Tower

AWS Control Tower is an AWS service for establishing and governing a multi-account environment through a landing zone, shared audit and log-archive accounts, account provisioning, and preventive, detective, or proactive controls.

AWS GuardDuty

An AWS threat-detection service that analyzes account, network, and DNS activity to flag suspicious behavior, such as compromised credentials, cryptomining, or reconnaissance, without needing agents on workloads.

AWS IAM Assessment

AWS IAM assessment evaluates federation, Identity Center, users, roles, permission sets, policies, trust, organizational controls, boundaries, sessions, access keys, and delegated administration.