Glossary

BC/DR Applied

Putting business continuity and disaster recovery into practice within a real security program: producing the plans, recovery objectives, and tested procedures rather than treating BC/DR as a theoretical document.

BC/DR Metrics

The measurements used to judge business continuity and disaster recovery readiness, most centrally recovery time objective (RTO) and recovery point objective (RPO), plus test results and plan coverage. They show whether recovery capability matches what the business needs.

BC/DR Plan Structure

The standard components a business continuity and disaster recovery plan should contain, such as scope, roles, recovery procedures, communication steps, and recovery objectives, organized so people can actually follow it under pressure.

BC/DR Policy

The governing document that mandates business continuity and disaster recovery: who is responsible, what must be planned and tested, and the standards the program must meet. It gives BC/DR organizational authority and consistency.

BC/DR Program Design

Architecting an end-to-end business continuity and disaster recovery program: the governance, business impact analysis, recovery strategies, plans, and testing that together let an organization withstand and recover from disruptions.

BC/DR Testing

Exercising business continuity and disaster recovery plans to confirm they actually work, ranging from tabletop walkthroughs to full failover drills. Testing reveals gaps before a real disruption does.

BEC Communication Specifics

The particular communication considerations when responding to business email compromise, such as notifying affected parties, warning recipients of fraudulent messages, and coordinating with finance and partners, while being careful what is said over potentially compromised channels.

BEC Response

The response to business email compromise, where an attacker controls or spoofs a trusted email account to commit fraud. It combines account-compromise containment with stopping fraudulent transactions and notifying affected parties.

BGP

The routing protocol used to exchange reachability information between internet networks.

BIA Governance

The oversight that keeps a business impact analysis accurate and authoritative: who owns it, how its findings are validated and approved, and how often it is refreshed, so recovery priorities reflect the real business.

BIA Output

The deliverables of a business impact analysis: prioritized critical processes, their dependencies, maximum tolerable downtime, and the recovery objectives (RTO and RPO) that drive recovery planning.

BYOK and HYOK

Two cloud encryption key models. Bring Your Own Key (BYOK) lets a customer supply keys that the cloud provider then manages, while Hold Your Own Key (HYOK) keeps keys entirely under the customer's control, never handing them to the provider.

Backup Architecture

The design of how data is backed up, where copies are stored, how often, and how they are protected and isolated, so the organization can recover after data loss, corruption, or a ransomware attack.

Backup Tampering

An attacker technique of deleting, encrypting, or corrupting backups so the victim cannot recover without paying. Modern ransomware deliberately targets backups first to remove the defender's safety net.

Backup Testing

Regularly verifying that backups can actually be restored, by performing test restores rather than assuming backups work. Untested backups frequently fail when needed most, so testing is what makes recovery real.

Banner Disclosure

When a service openly advertises its software name and version in a connection banner or response header, handing attackers easy reconnaissance about what to exploit. Suppressing or minimizing banners is a basic hardening step.

Baseline Analysis

Establishing what normal activity looks like in an environment so that deviations stand out as worth investigating. In detection and SIEM work, the baseline is the reference against which anomalies are measured.

Baseline Behavior

The normal pattern of activity for a host or process, such as which programs usually run, their typical parent processes, and expected network connections. Knowing it lets defenders recognize when something on a system is abnormal.

Bash History

A file that records the shell commands a Linux or Unix user has run. For defenders it is a useful source of evidence about what an attacker or user did on a host, though a savvy attacker may try to clear or disable it.

Bastion Hosts

A hardened, tightly controlled gateway server that administrators connect through to reach systems in a private network, so those systems are never directly exposed. It concentrates and monitors administrative access at one defensible point.

Beacons

The periodic check-ins a compromised host makes to an attacker's command-and-control server to receive instructions. Their regular, often-disguised pattern is a key signal defenders hunt for to find hidden footholds.

Behavioral Anomaly Detection

In identity governance, detecting access behavior that deviates from a user's or peer group's norm, such as accessing systems they never use or acting outside their role, to surface risky or compromised identities.

Behavioral Detection

Detecting threats by what an entity does, its behavior and sequences of actions, rather than by matching known-bad signatures. It catches novel and fileless attacks that signature-based detection misses.

Behavioral Indicators

Observable signs in how people act that reveal the strength of a security culture, such as whether staff report suspicious emails, follow secure practices, or raise near-misses. They show culture in behavior, not just stated attitudes.

Behavioral Operationalization

Turning an abstract description of attacker behavior into something a threat hunter can actually search for, by defining the data sources, queries, and observable traces that the behavior would produce.

Behavioral Pivoting

During an investigation, expanding from one observed behavior to find related malicious activity, asking what else an attacker exhibiting this behavior would likely do, and searching for it. It widens an investigation beyond a single alert.

Behavioral Science

The study of why people act as they do, applied to security to design awareness and culture programs that actually change behavior rather than just delivering information. It explains why people click, comply, or take shortcuts.

Benign True Positive

An alert that correctly fired on the activity it was designed to detect, but where that activity turns out to be legitimate, such as an admin tool used by an authorized administrator. The detection worked; the behavior was simply expected.

Biometric Authentication

Authentication that uses a physical trait such as a fingerprint or face scan.

Blame Culture

An environment where mistakes lead to punishment and finger-pointing, which makes people hide errors and avoid reporting incidents. It is corrosive to security because it suppresses the very information defenders need.

Blameless Postmortem

A review after an incident that focuses on understanding what happened and why, in terms of systems and processes, rather than assigning fault to individuals. It produces honest analysis and concrete improvements.