Glossary

RAT Analysis

Analyzing Remote Access Trojan (RAT) samples to understand their command-and-control, capabilities, and persistence, producing indicators and detections for these long-running, attacker-controlled implants.

RBAC

Role-Based Access Control: an access model where permissions are assigned to roles, and users are granted access by being assigned roles, simplifying administration and supporting least privilege at scale.

RBAC at Scale

The challenges and patterns for using role-based access control across large cloud-native environments, role explosion, drift, and complexity, that require deliberate design and ongoing governance to keep RBAC working.

RDP

Remote Desktop Protocol: Microsoft's protocol for graphical remote access to Windows systems. Widely used by admins and frequently abused by attackers for lateral movement and initial access when exposed.

RDP Lateral Movement Detection

Detecting attackers using RDP to move between hosts, by spotting anomalous interactive logons, unusual source-to-destination patterns, and unexpected use of administrative accounts over RDP, mapped to ATT&CK.

RSA

A widely used asymmetric (public-key) cryptography algorithm based on the difficulty of factoring large numbers, foundational to TLS, signatures, and PKI alongside newer alternatives like elliptic-curve cryptography.

Rainbow Tables

Precomputed tables that reverse cryptographic hashes (especially of passwords) back to their inputs by trading storage for computation. Salting defeats them, which is why every password hash must be salted.

Ransomware

Malware that disrupts access to systems or data and demands payment.

Ransomware Analysis

Examining ransomware samples to understand how they encrypt, persist, communicate, and demand payment, producing indicators and detections, and informing both response and prevention.

Ransomware Recovery Design

Designing recovery so it can actually withstand ransomware, immutable backups, isolation, tested restoration, prioritization, since ransomware recovery is where many BC/DR plans first really break.

Ransomware Response

The incident-response approach for a ransomware event, containing spread, deciding on payment under legal guidance, restoring from backups, and coordinating with legal, regulators, and possibly law enforcement.

Rate Limiting

Restricting how often a user, IP, or system can perform an action in a time window.

ReBAC

Relationship-Based Access Control: an access model where permissions follow the relationships between entities (such as 'owns' or 'member of'), used in systems like file sharing and graph-based platforms.

Reading FAIR Output

Interpreting FAIR's quantitative results, loss distributions, exceedance curves, confidence ranges, so analysts and decision-makers understand what the numbers mean and don't read them as point estimates.

Real-Time Posture

Maintaining a continuously up-to-date view of cloud security posture, rather than relying on periodic snapshots, so deviations are seen and remediated quickly within compliance and security programs.

Rebuild vs Clean

An IR decision: rebuild a compromised system from a known-good image versus try to clean the existing one, weighed by confidence in eradication, system complexity, and downtime trade-offs.

Reconnaissance

Collecting information about a target before or during an attack.

Recovery

The phase of the incident lifecycle that restores normal operations, returning systems and services to function safely after an incident, while preventing reinfection and confirming the threat is gone.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time.

Recovery Process

The structured steps that move an organization from contained incident to restored operations, planning the sequence, executing restores, validating each step, and confirming safe return to business.

Recovery Time Objective

The maximum acceptable time to restore a service after disruption.

Recovery Validation

Confirming that recovery actually worked, restored systems function correctly, the threat is truly gone, and no compromise persists, before declaring the incident closed.

Recurring Findings

Audit findings that keep appearing audit after audit, signaling systemic root-cause issues rather than one-off mistakes, and demanding deeper remediation than fixing each instance.

Red Team Exercises

Adversarial security exercises where a dedicated team simulates real attackers against the organization to test defenses end to end, surfacing realistic gaps that vulnerability scans and tabletops miss.

Referrer-Policy

An HTTP response header that controls how much referrer information browsers send when navigating from a page, used to limit information leakage to other origins.

Refresh Token

In OAuth, a long-lived token used to obtain new short-lived access tokens without prompting the user again. Refresh tokens carry significant power and must be stored and rotated carefully.

Regional Regulations

Cloud-relevant regulations specific to a country, state, or region (such as GDPR in the EU or state privacy laws in the US) that organizations must comply with where they operate or serve users.

Registry Run Key Detection

Detecting persistence via Windows registry run keys, common autostart locations attackers abuse, by monitoring changes to those keys and writing detections (often mapped to ATT&CK) for suspicious entries.

Regression Testing

In detection engineering, retesting detections after changes to ensure they still work and don't break expected behavior, so improvements don't silently degrade coverage of existing threats.

Regulations

Mandatory rules imposed by governments or regulators on how organizations must protect information, secure systems, and handle incidents. Regulations are foundational drivers of security and privacy programs.

Regulatory Notification

The legally required notification of regulators (and sometimes affected individuals) after qualifying incidents, with timelines, content, and channels that vary by jurisdiction and regulation.