Glossary

NAT

Network Address Translation lets multiple private devices share one or more public IP addresses by rewriting address information as traffic crosses a boundary.

NIST CSF Structure

The high-level structure of the NIST Cybersecurity Framework, organized around core functions (Govern, Identify, Protect, Detect, Respond, Recover), categories, and subcategories, with profiles and tiers for risk-based management.

NIST Cybersecurity Framework

A framework for organizing cybersecurity outcomes across identify, protect, detect, respond, and recover functions.

NIST RMF

The NIST Risk Management Framework: a structured process (categorize, select, implement, assess, authorize, monitor) for managing security and privacy risk for systems, widely used in US federal government and influential more broadly.

NIST SP 800-207

NIST Special Publication 800-207, the influential definition of zero-trust architecture from NIST, laying out core principles, components, and deployment models that have become the reference for understanding zero trust.

NIST SP 800-53

NIST Special Publication 800-53: a comprehensive catalog of security and privacy controls used by US federal systems and as a reference across the broader framework ecosystem. It is the canonical detailed control catalog.

NIST SP 800-53 Structure

The organization of NIST 800-53, control families, individual controls, control enhancements, and prepared baselines, that lets practitioners navigate the large catalog and pick the controls relevant to their system.

Nation-State Actors

Threat actors backed by national governments, well-resourced, persistent, often highly skilled, who pursue strategic objectives like espionage, sabotage, or geopolitical influence and pose the most capable adversary class.

Near-Miss Reporting

Encouraging staff to report close calls, like a phishing email almost clicked, a process nearly bypassed, so the organization learns from situations that did not become incidents but could have, strengthening culture and defenses.

Negligent Insiders

Insiders who cause harm through carelessness or mistakes rather than malice, such as misconfiguring a system, falling for phishing, or mishandling data, a major source of incidents despite no malicious intent.

Network

The interconnected systems and the paths between them over which data flows. Understanding what a network is, its devices, protocols, and connections, is foundational to defending it, monitoring it, and reasoning about attacks.

Network ACLs

Stateless rules that allow or deny traffic at the subnet level in cloud networks, providing a coarse layer of network access control complementary to stateful security groups around individual resources.

Network Alerts

SOC alerts generated from network-level signals, IDS/IPS hits, suspicious connections, DNS anomalies, that analysts triage to find network-based attacks like command-and-control, scanning, and exfiltration.

Network Anomaly Detection

Detecting unusual network behavior, traffic that deviates from baselines, rare destinations, atypical volumes or patterns, on the premise that abnormality often indicates malicious activity. A core network-detection technique.

Network Behavior Analysis

In malware analysis, examining the network activity a sample produces, DNS lookups, connections, command-and-control traffic, downloads, to understand its capabilities and extract network indicators.

Network Evidence

Evidence collected from network sources, logs, captures, flow data, IDS alerts, that defenders use to investigate incidents and prove what happened on the wire. It is a core form of incident evidence.

Network Firewalls

Devices or services that filter network traffic between zones, allowing or denying flows by rules to enforce segmentation and perimeter control. Among the oldest and most foundational network-security controls.

Network Policies (K8s)

Kubernetes resources that restrict which pods can communicate with which, enforcing network segmentation inside a cluster so a compromised pod cannot freely reach others. A core part of cluster workload protection.

Network Policies Production

Operating Kubernetes network policies in real production at scale, designing them sustainably, rolling them out without breaking apps, monitoring effectiveness, and maintaining them as workloads change.

Network Reconnaissance

Attacker activity that probes a network to map its devices, services, and weaknesses, scans, sweeps, and queries, that often precedes intrusion. Recognizing it is foundational to detecting attacks early.

Network Segmentation

Separating a network into smaller zones to reduce exposure and limit movement.

Network Telemetry

The data network devices and tools produce, flow records, packet captures, DNS, proxy, firewall, and IDS logs, that defenders collect for detection, hunting, and investigation. The lifeblood of network monitoring.

Network Threat Model

A model of how an attacker might attack the network, what enters and leaves, where boundaries are, what is trusted, used to anticipate threats and design controls so the network defends what matters.

Network Visibility

How much of what happens on the network defenders can actually see and analyze, determined by the telemetry collected, monitoring tools, and instrumentation. Without visibility, network defense and investigation are blind.

NetworkService

A built-in Windows service account with limited local privileges but ability to authenticate to the network as the computer itself. Defenders recognize it as a normal context, and abnormal behavior from it as suspicious.

Next-Generation Firewalls

Firewalls that inspect traffic beyond ports and addresses, looking at applications, users, and content, with features like deep packet inspection, IPS, and identity awareness, providing richer policy and detection than traditional firewalls.

Non-Repudiation

The property that a party cannot credibly deny having performed an action, since cryptographic or audit evidence ties them to it. It supports accountability alongside the CIA triad's other properties.