Glossary

KPIs

Key performance indicators: metrics that measure how well a security program or function is performing against its objectives, used to track effectiveness, demonstrate value, and guide improvement.

KRIs

Key risk indicators: metrics that signal changes in risk exposure, giving early warning when a specific risk is increasing so the organization can act before it materializes. The abbreviation of key risk indicators.

Kerberoasting

An Active Directory attack where an attacker requests service tickets for accounts and cracks them offline to recover the service accounts' passwords, exploiting weak passwords on service accounts to gain access.

Kerberoasting Detection

Detecting kerberoasting by watching for its telltale signs in Active Directory, such as unusual volumes of service-ticket requests or requests using weak encryption, so the stealthy credential attack can be caught.

Kerberos

A network authentication protocol that uses tickets issued by a trusted authority to let users and services prove their identity without sending passwords over the network. It is central to Active Directory authentication.

Kerberos Ticket Forgery Detection

Detecting forged Kerberos tickets, such as golden and silver tickets, that attackers create after compromising key material to impersonate users or services, by spotting anomalies the forgeries reveal.

Kernel

The core part of an operating system that controls hardware, memory, processes, and system calls.

Kernel Exploits

Attacks that exploit vulnerabilities in the operating-system kernel to gain the highest level of privilege, since kernel code runs with full control, a successful kernel exploit can completely compromise a system.

Key

In cryptography, the secret (or paired secret/public) value that controls an algorithm's operation, determining how data is encrypted, decrypted, signed, or verified. The security of cryptography rests on protecting keys, not on hiding the algorithm.

Key Distribution Problem

The fundamental challenge of securely sharing a secret key between parties who want to communicate, since the key itself must somehow be exchanged without an eavesdropper obtaining it. It is what asymmetric cryptography helps solve.

Key Management

Creating, storing, rotating, using, and retiring cryptographic keys safely.

Key Pair

In asymmetric cryptography, the linked pair of a public key (shared openly) and a private key (kept secret), where what one key does the other reverses, enabling encryption, digital signatures, and secure key exchange.

Key Risk Indicators

Metrics that signal changes in an organization's risk exposure, giving early warning when risk is rising so leadership can act before a risk materializes. They complement key performance indicators in risk management.

Knowledge Capture

Recording what analysts learn, investigation steps, findings, decisions, and tradecraft, so knowledge is preserved and shared across the team rather than lost, strengthening consistency and onboarding in the SOC.

Knowledge Factor

An authentication factor based on something you know, such as a password, PIN, or answer to a security question, used to verify identity. It is one of the three classic factor categories alongside possession and inherence.

Knowledge Operationalization

Turning what threat hunts and analysis reveal into operational defenses, detections, enrichment, playbooks, and process changes, so hard-won knowledge actively improves the SOC rather than staying as findings on a page.

Kubernetes Detection

Detecting threats and malicious activity in Kubernetes environments, by monitoring audit logs, runtime behavior, and configuration for signs of attacks like privilege escalation, container escapes, or abuse of the cluster API.

Kubernetes RBAC

Kubernetes' role-based access control system, which governs what users and service accounts can do in a cluster. Properly scoped RBAC is essential, since over-permissive roles are a leading Kubernetes security risk.

Kubernetes Security

The overall practice of securing Kubernetes clusters and the workloads they run, spanning the cluster control plane, RBAC, network policy, workload configuration, secrets, and runtime, since Kubernetes' power and complexity create broad attack surface.

Kubernetes Security Domains

The distinct areas that make up Kubernetes security, such as cluster/control-plane, workloads and pods, network, identity and RBAC, secrets, and supply chain, used to organize a comprehensive approach to securing clusters.

Kubernetes-Specific Attacks

Attack techniques unique to or characteristic of Kubernetes environments, such as container escapes, abusing the API server or service accounts, RBAC privilege escalation, and pivoting through the cluster, that defenders must anticipate.

Kusto Query Language

KQL, the query language used to search and analyze data in Microsoft's security and log platforms (such as Sentinel and Defender), letting analysts write detections and investigate by filtering, correlating, and aggregating telemetry.