Glossary

LDAP

Lightweight Directory Access Protocol: the protocol used to query and modify directory services like Active Directory, central to authentication and identity lookups, and a frequent target for reconnaissance and attack.

LD_PRELOAD

A Linux environment variable that forces a program to load a specified shared library first, which attackers abuse to inject malicious code into processes or hook functions, a stealthy technique defenders should recognize.

LINDDUN Methodology

A privacy-focused threat-modeling methodology that helps identify privacy threats in a system, structured around categories like linkability, identifiability, and non-compliance, complementing security-focused models like STRIDE.

LOLBin Detection

Detecting the malicious use of legitimate built-in binaries (living-off-the-land binaries) by spotting abnormal usage patterns, since the tools themselves are trusted and present by default, only their misuse is malicious.

LOLBin Hunting Methodology

A structured approach to hunting for living-off-the-land binary abuse, systematically examining how trusted binaries are used across the environment to find malicious misuse hiding among legitimate activity.

LOLBins

Living-off-the-land binaries: legitimate, pre-installed system tools that attackers abuse to carry out malicious actions while blending in, since using trusted built-in binaries evades many defenses.

LSASS

The Windows process (Local Security Authority Subsystem Service) that handles authentication and holds credentials in memory, making it a prime target for attackers who dump its memory to steal credentials.

LSASS Memory Dumping Detection

Detecting attempts to dump the memory of the Windows LSASS process, a strong sign of credential theft, by monitoring for suspicious processes accessing LSASS or known dumping techniques.

Lateral Movement

Movement from one system or account to others inside an environment.

Lateral Movement Hunts

Threat hunts focused on finding attacker movement between systems inside a network, searching for signs of remote access, credential reuse, and pivoting that indicate an intruder spreading from an initial foothold.

Leadership Modeling

When leaders visibly practice the security behaviors they expect of others, setting the tone that security matters. It is one of the strongest influences on an organization's security culture.

Leading and Lagging Indicators

Two kinds of security-culture metrics: leading indicators predict future outcomes (like training engagement or reporting rates), while lagging indicators measure past results (like incidents that occurred), used together to gauge and steer culture.

Learning Sharing

Spreading the lessons from incidents and operations across the team and organization, so insights from one responder's experience or one incident improve everyone's practice rather than staying siloed.

Least Privilege

The principle of giving users and systems only the access they need to do their job.

Legal Communication

Communicating with and through legal counsel during an incident, ensuring legally sensitive matters, disclosure, evidence, liability, are handled with legal guidance and sometimes under privilege, so the response is legally sound.

Legal and HR Coordination

Working with legal and human-resources teams when writing policies, so policies are enforceable, compliant with law and employment rules, and aligned with how the organization handles people-related matters.

Lessons Learned

A review after an incident that identifies improvements to people, process, and technology.

Lessons from Practice

Insights drawn from real-world security operations experience, what actually works, common pitfalls, and hard-won judgment, that complement theory by grounding blue-team skills in how things play out in practice.

Let's Encrypt

A free, automated certificate authority that issues TLS certificates at no cost, making HTTPS easy and ubiquitous. Its automation (via the ACME protocol) lets sites obtain and renew certificates without manual effort.

Lightweight Threat Modeling

A streamlined, practical approach to threat modeling that fits into fast development, using quick, focused techniques to identify key threats without the overhead of heavyweight formal methods, so modeling actually gets done.

Likelihood

How probable it is that a threat will affect a system or asset.

Likelihood Estimation

Judging how probable it is that a risk will occur, a core part of risk assessment that, paired with impact, determines a risk's level so it can be prioritized and treated appropriately.

Linked Cases

Connecting related investigation cases so analysts can see that separate alerts or incidents are part of the same activity, revealing broader patterns and the true scope of an attack that isolated cases would hide.

Linkerd

A lightweight service mesh for Kubernetes that secures and manages communication between microservices, providing automatic mutual TLS and observability with a focus on simplicity and low overhead.

Linux Capabilities

A Linux feature that breaks root's all-or-nothing power into discrete privileges (capabilities) that can be granted individually, so a process can be given just the specific elevated rights it needs instead of full root.

Living off the Land

Using built-in tools or normal system features to perform malicious actions.

Local Admin Restriction

Limiting which users have local administrator rights on endpoints, removing unnecessary admin access so a compromised user account or malware cannot easily gain full control of the machine. A high-impact hardening measure.

Local Administrator Password Solution

A Microsoft solution (LAPS) that automatically sets a unique, random local administrator password on each Windows machine and stores it securely, preventing the widespread risk of shared or identical local admin passwords.

LocalService

A built-in low-privilege Windows service account used to run services that need minimal local rights and limited network access. Defenders recognize it as a normal low-privilege context, and abnormal behavior from it as suspicious.

Log Gaps

Missing or incomplete logging that leaves activity unrecorded, creating blind spots where attacks can occur undetected and investigations hit dead ends. Identifying and closing log gaps is essential to detection and visibility.

Log Integrity

Ensuring logs cannot be secretly altered or deleted, so they remain trustworthy for detection, investigation, and evidence. Attackers often try to tamper with logs to hide activity, making integrity protection important.

Log Management Platforms

Systems that collect, store, index, and make logs searchable from across an environment, the backbone for centralizing telemetry so it can be used for detection, investigation, and compliance.