Glossary

HIPAA

The US Health Insurance Portability and Accountability Act, which sets requirements for protecting the privacy and security of health information, obligating healthcare organizations and their partners to safeguard patient data.

HIPAA Cloud

Meeting HIPAA requirements when health information is processed or stored in the cloud, ensuring PHI is safeguarded through the shared-responsibility model, business-associate agreements, and appropriate cloud controls.

HIPAA Cloud Architecture

Designing a cloud architecture that meets HIPAA's safeguards for protected health information, with the segmentation, encryption, access control, and logging needed to handle PHI compliantly built into the design.

HIPAA Security Rule

The part of HIPAA that sets required safeguards, administrative, physical, and technical, for protecting electronic protected health information, mapped to controls when implementing HIPAA in a framework context.

HITRUST CSF

A comprehensive, certifiable security framework widely used in healthcare that harmonizes many standards and regulations (including HIPAA) into one set of prescriptive, assessable controls, so one certification can demonstrate broad compliance.

HITRUST Cycles

The assessment and certification timelines of the HITRUST framework, including the periodic interim and recertification activities organizations must complete to obtain and maintain HITRUST certification over time.

HKCU

HKEY_CURRENT_USER: the Windows registry hive holding settings for the currently logged-in user. Defenders examine it for per-user persistence and configuration that attackers modify, such as user-level autorun entries.

HKLM

HKEY_LOCAL_MACHINE: the Windows registry hive holding system-wide settings affecting all users. Because changes here are machine-wide and often require privilege, attacker modifications signal significant, system-level persistence or configuration tampering.

HMAC

Hash-based Message Authentication Code: a construction that combines a secret key with a hash function to produce a code verifying both a message's integrity and its authenticity, that it was not altered and came from someone holding the key.

HSTS

HTTP Strict Transport Security: a web security header that tells browsers to only connect to a site over HTTPS, preventing downgrade to insecure HTTP and protecting against certain interception and stripping attacks.

HTTP

HTTP is the protocol browsers and applications use to request and transfer web content.

HTTP Method

The verb in an HTTP request, such as GET, POST, PUT, or DELETE, that indicates the action the client wants to perform. Methods carry security meaning, since some change data and access control must account for which are allowed.

HTTPS

HTTPS is HTTP protected with TLS so web traffic is encrypted and the server can prove its identity.

Hacktivists

Attackers motivated by a political, social, or ideological cause rather than profit, who use hacking, defacement, leaks, or disruption to make a statement, draw attention, or punish a target they oppose.

Handling Disagreement

Navigating disputes that arise when writing and approving policies, where stakeholders object to requirements or push competing interests, resolving them constructively so the final policy is sound, supported, and actually followed.

Handoff

The transfer of an alert, investigation, or incident from one analyst or shift to another, passing along context and status so work continues smoothly without losing information or momentum.

Hands-On Practice

Learning security skills by doing, through labs, ranges, CTFs, and real tools, rather than only studying theory, building the practical ability and muscle memory an analyst needs to perform effectively.

Hardcoded Keys

Cryptographic keys or secrets embedded directly in source code or configuration, a serious mistake because anyone who can read the code or binary can extract them, defeating the encryption they were meant to provide.

Hardening Guides

Authoritative documents that specify secure configuration settings for a system, application, or device, such as CIS Benchmarks and DISA STIGs, giving step-by-step baselines to lock systems down from their insecure defaults.

Hash Functions

Algorithms that take input of any size and produce a fixed-size, unique-looking output (a hash), designed so the same input always yields the same hash and it is infeasible to reverse or to find two inputs with the same hash.

Hash Value

The fixed-size output produced by running data through a hash function, a digest that uniquely represents the input. Comparing hash values is how integrity is verified and how files are identified as indicators.

Hashing

The process of running data through a hash function to produce a fixed-size digest, used to verify integrity, identify data, and (with proper protections) store passwords. It is a foundational security primitive.

Heat Map

A visual that uses color to show detection coverage or risk across a grid, commonly an ATT&CK matrix shaded by how well each technique is detected, so gaps and strengths are obvious at a glance.

Historical Replay

Testing a new or changed detection against stored historical telemetry to see what it would have caught or missed, validating it without waiting for live activity and revealing its false-positive behavior on real past data.

Homemade Cryptography

Inventing your own cryptographic algorithm or protocol instead of using established, vetted ones, a serious anti-pattern, since custom crypto almost always contains subtle, exploitable flaws that peer-reviewed standards have eliminated.

Horizontal Privilege Escalation

A web access-control attack where a user accesses another user's data or actions at the same privilege level, such as viewing someone else's account, by exploiting missing checks that they are the rightful owner.

Host

In a URL, the part identifying the server to connect to, typically a domain name or IP address. It tells the browser where to send the request and is key context when judging whether a request goes where expected.

Host Firewall

A firewall running on an individual device or server.

Hot Leads

Promising investigative leads that strongly suggest malicious activity and warrant immediate follow-up, as opposed to cold leads, used by analysts to prioritize where to dig during triage and investigation.

Hot Standby

A disaster-recovery setup where a fully running duplicate system stands ready to take over almost instantly if the primary fails, giving very fast recovery at higher cost than colder standby options.

Hot vs Cold Storage

The tradeoff in log and data storage between hot storage, fast and immediately searchable but costly, and cold storage, cheap for long retention but slow to access, used to balance cost against analysis needs.

HttpOnly Flag

A cookie attribute that prevents JavaScript from reading the cookie, so that even if a site has a cross-site scripting flaw, an attacker's script cannot steal the protected cookie, such as a session token.