Glossary

MAC Addresses

Hardware addresses assigned to network interfaces that identify devices on a local network segment, used for delivery at the data-link layer. They are local in scope, unlike IP addresses, which route across networks.

MD5

An older cryptographic hash function (128-bit) once widely used but now broken for security: collisions can be created practically, so MD5 must not be used for integrity guarantees or signatures, though it still appears as a non-security checksum.

MDR

Managed Detection and Response: a service in which an external provider monitors a customer's environment, detects threats, and assists with response, often 24/7, giving organizations advanced security operations without building it all in-house.

MFA

Multi-factor authentication: requiring at least two distinct factors (knowledge, possession, inherence) to authenticate, so a stolen password alone is not enough. It is one of the highest-impact controls against credential attacks.

MFA Fatigue

An attack that bombards a user with MFA push prompts until they approve one out of annoyance, exploiting a human weakness rather than a technical flaw to bypass MFA on accounts protected by push notifications.

MFA Implementation

How an organization actually deploys MFA, choice of factors, coverage of users and apps, enrollment and recovery, fallback, and protection of the MFA system itself, so MFA delivers real security rather than gaps and friction.

MITRE ATT&CK

A knowledge base that organizes observed attacker tactics and techniques.

MITRE ATT&CK Framework

A widely used knowledge base of adversary tactics, techniques, and procedures, organized into a matrix, that defenders use as a common language to describe attacks, plan detections, and assess coverage.

MSSPs

Managed Security Service Providers: vendors that deliver outsourced security operations, often log monitoring and alerting, used by organizations that want external operational capacity without building it in-house.

MX Record

A DNS record that specifies the mail servers responsible for receiving email for a domain. Defenders use it to understand email routing, recognize legitimate mail infrastructure, and spot signs of email-related attacks.

Macro Restriction

Limiting or blocking macros in documents (such as Office files), a high-impact hardening measure, since malicious macros are a common way attackers gain initial execution from phishing attachments.

Major Incident Declaration

The formal step of declaring an incident 'major' based on its severity, scope, or impact, which activates senior leadership, additional resources, and the full crisis-response apparatus rather than handling it as a routine incident.

Major Incident Roles

The defined roles activated during a major incident, incident commander, technical lead, communications lead, legal liaison, scribe, and others, so authority and responsibilities are clear across the larger response.

Malware Analysis Philosophy

The mindset and principles behind malware analysis, asking why and how a sample behaves, working safely and methodically, balancing depth with the actionable questions defenders need answered, that guide good analytic practice.

Malware Lab Setup

An isolated environment built for safely analyzing malware, with network segmentation, snapshots, and the tools needed for static and dynamic analysis, so samples can be examined without risking production or the analyst's host.

Malware Obfuscation

Techniques attackers use to make malware harder to analyze and detect, such as packing, encryption, code transformations, and anti-analysis tricks, that defenders must work through to understand a sample.

Management Network

A separate, isolated network used exclusively for administering devices and infrastructure, so management traffic and interfaces are not exposed to general networks and not reachable from compromised user systems.

Maturity Assessments

Evaluations that judge how mature a security function or process is, often against a defined maturity model, so an organization can see where it stands and plan improvements toward higher maturity.

Mean Time to Detect (MTTD)

The average time from when an attack or incident begins to when defenders detect it. Lower MTTD means earlier detection and less dwell time, so it is a key metric for monitoring program effectiveness.

Mean Time to Respond (MTTR)

The average time from detection of an incident to its response or resolution, depending on how it is defined. Lower MTTR means faster response, limiting damage, so it is a key SOC performance metric.

Meaningful Certification Practice

Running access certification campaigns that actually drive correct access decisions, rather than rubber-stamping exercises, by providing context, focusing on risk, and following through on revocations identified.

Mentorship

A more experienced person guiding a less experienced colleague's growth, in security a powerful accelerator that transfers tacit knowledge, judgment, and confidence that training alone cannot, helping analysts develop and stay in the field.

Mesh Observability

The visibility a service mesh provides into communication between microservices, metrics, tracing, and logs of every request, giving deep insight into who is calling whom and how, which security analysts and operators use for detection and investigation.

Mesh Operational Security

Securing how a service mesh is operated and maintained, the mesh's own control plane, configuration changes, certificate rotation, and upgrades, so the mesh itself does not become a weak spot in the cloud-native environment.

Mesh Trade-offs

The downsides and costs of adopting a service mesh, operational complexity, performance overhead, learning curve, and an added attack surface, weighed against its benefits so the choice fits the environment.

Metrics Reporting

Reporting policy and program metrics to leadership and stakeholders, awareness scores, exception trends, compliance rates, so they can see whether policies are working and decide on changes, framed within policy writing in practice.

Metrics and Reporting

The measures and reports that show how well cloud workload protection is performing, vulnerability and configuration findings, coverage, remediation pace, so leadership can see effectiveness and direct improvement.

Microsegmentation

Fine-grained network segmentation that limits communication between workloads or systems.

Microsegmentation Principles

The principles behind microsegmentation in zero trust, granular, identity-aware segmentation between workloads so each can only reach what it needs, with default-deny and continuous policy enforcement.

Microservices

An architectural style where an application is built as many small, independent services that communicate over the network, common in cloud-native systems and carrying distinctive security characteristics for defenders to address.

Microservices Resilience

Designing microservices so the system stays available and degrades gracefully despite failures, partial outages, slow dependencies, or misbehavior, through patterns like timeouts, retries, circuit breakers, and isolation.