Glossary

DAST in DevSecOps

Dynamic Application Security Testing integrated into the DevSecOps pipeline, automatically testing a running application for vulnerabilities by probing it from the outside, like an attacker would, to find flaws that only appear at runtime.

DCSync Detection

Detecting the DCSync attack, in which an adversary with sufficient privilege abuses Active Directory replication to request password hashes from a domain controller as if it were one, a powerful credential-theft technique against AD.

DE Skills

The competencies a detection engineer needs, spanning understanding attacker behavior and ATT&CK, querying and data analysis, writing and tuning detections, scripting and automation, and testing detections against real techniques.

DE-Adjacent Roles

The roles that sit next to detection engineering, such as SOC analyst, threat hunter, incident responder, and security engineer, clarifying what a detection engineer uniquely owns (building and maintaining detections) versus what overlapping roles do.

DE-Hunting Interface

The working relationship between detection engineering and threat hunting, where hunters discover new attacker behaviors and detection engineers turn the repeatable ones into automated detections, creating a loop that steadily expands coverage.

DE-SOC Interface

The working relationship between detection engineering and the SOC, where the SOC operates and gives feedback on detections, and detection engineers use that feedback, false positives, missed threats, tuning needs, to improve them.

DHCP

DHCP is a network protocol that automatically assigns IP addresses and other network settings to devices.

DLL Search Order Hijacking

A Windows attack technique where an adversary plants a malicious DLL in a location that a program searches before the legitimate one, so the program loads the attacker's code, used for execution, persistence, and privilege escalation.

DMZ

A demilitarized zone: a network segment that sits between the untrusted internet and the trusted internal network, hosting public-facing services so that a compromise there does not directly expose internal systems.

DNS

DNS is the naming system that translates domain names into network addresses and related records.

DNS Cache

A temporary store of recent DNS lookups kept by resolvers and hosts so repeated queries can be answered quickly without asking authoritative servers again. It speeds resolution but can be a target for poisoning attacks.

DNS Logs

Records of DNS queries and responses, capturing which domains hosts looked up and when. They are a high-value telemetry source for detecting malware, command-and-control, data exfiltration, and suspicious domains.

DNS Record

An entry in the DNS that maps a name to information, such as an address (A/AAAA), an alias (CNAME), a mail server (MX), or text (TXT). Records are the data DNS serves to answer lookups.

DNS Resolution

The process of turning a human-readable domain name into the IP address needed to connect, by querying through resolvers and authoritative servers. It is a fundamental step before most network communication.

DNS Tunneling

A technique that hides data inside DNS queries and responses.

DNS over HTTPS (DoH)

A protocol that sends DNS queries encrypted inside HTTPS, hiding them from network observers. It improves user privacy but complicates defensive monitoring, since DNS lookups no longer appear in plain network traffic.

DNS-Based Detection

Detection techniques that use DNS query data to find threats, spotting lookups of malicious, newly registered, or algorithmically generated domains, beaconing patterns, and DNS tunneling, often written as SIEM queries over DNS logs.

DPIA Process

The step-by-step method for conducting a Data Protection Impact Assessment under the GDPR, systematically describing a processing activity, assessing its privacy risks, and identifying measures to reduce them before the processing begins.

DPIA Requirements

The conditions under the GDPR that determine when a Data Protection Impact Assessment is mandatory, namely when a processing activity is likely to result in a high risk to individuals' rights and freedoms.

DSAR Operations

The operational work of handling Data Subject Access Requests, the process and tooling to receive, verify, fulfill, and respond to individuals exercising their privacy rights within legal deadlines.

Data Access Alerts

SOC alerts triggered when data is accessed in unusual or sensitive ways, such as bulk downloads, access to restricted records, or an account reaching data it never normally touches, which can indicate theft or insider misuse.

Data Classification

Labeling data based on sensitivity, value, or handling requirements.

Data Classification (Cloud)

Categorizing cloud-stored data by sensitivity, such as public, internal, confidential, or regulated, so the right protections, encryption, access control, and DLP, can be applied proportionately to how sensitive each dataset is.

Data Collection

The attacker activity of gathering targeted data within a compromised environment in preparation for theft, identifying, accessing, and staging files, records, or communications before exfiltrating them.

Data Exfiltration Response

The response to an incident where data is being or has been stolen, focused on stopping the outflow, scoping exactly what left, preserving evidence, and meeting notification obligations triggered by the loss of data.

Data Lakes

Large, scalable repositories that store vast amounts of raw log and telemetry data in one place for security analytics, letting defenders retain and query more data over longer periods than a traditional SIEM alone.

Data Loss Prevention

Controls that try to detect or prevent sensitive data from leaving approved places.

Data Mapping Foundation

The basic concept and purpose of data mapping in privacy practice: documenting what personal data an organization holds, where it comes from, where it flows, and where it is stored, as the groundwork for all privacy compliance.

Data Mapping at Scale

Performing data mapping across large, complex organizations with many systems and data flows, using automation, discovery tooling, and governance to keep the map accurate when manual methods alone cannot keep up.

Data Minimization

Collecting and keeping only the data needed for a clear purpose.

Data Protection

The set of controls and practices that keep data safe across its lifecycle and all three states, at rest, in transit, and in use, through encryption, access control, classification, and loss prevention, preserving its confidentiality and integrity.