Glossary

Culture Assessment Process

A structured way to evaluate an organization's security culture, combining surveys, behavioral indicators, and other signals to understand how people actually think about and act on security, and where the culture needs strengthening.

Culture Survey Design

Crafting surveys that accurately measure security attitudes and culture, with questions worded to avoid bias, elicit honest answers, and capture the dimensions of culture that matter, so the results genuinely reflect how people think.

Curriculum Structure

How a security awareness program organizes its training content over time, sequencing topics, tailoring to roles, and reinforcing through repetition, so learning builds coherently rather than being a one-off annual session.

Customer Communication

Communicating with affected customers during an incident, informing them accurately about impact and required actions while meeting obligations and preserving trust, coordinated carefully because what is said carries legal and reputational weight.

Customer Compliance Scope

The portion of cloud compliance obligations that fall to the customer rather than the provider under the shared-responsibility model, the controls the customer must implement, operate, and evidence for their own configuration and use.

Customer Managed Keys

Encryption keys that the customer controls within a cloud key-management service, rather than relying on provider-managed default keys, giving the customer authority over key rotation, access, and revocation for their encrypted data.

Customer Trust Center

A dedicated, often public-facing page or portal where an organization shares its security and compliance posture, certifications, audit reports, and policies, so prospects and customers can verify trust without lengthy back-and-forth.

Customer-Implemented Controls

The security controls that, under shared responsibility, the customer must build and operate themselves in the cloud, such as configuring identity, encryption, network rules, and logging, as opposed to controls inherited from the provider.

Cyber Kill Chain

A model that breaks an intrusion into sequential stages, from reconnaissance through to actions on objectives, so defenders can understand an attack's progression and intervene at any link to break the chain.

Cyber Risk in ERM

Positioning cybersecurity risk as one component of enterprise risk management, so cyber is assessed, aggregated, and reported alongside financial, operational, and strategic risks rather than managed in a security silo.

Cybersecurity

The practice of protecting systems, networks, and data from digital attack, unauthorized access, and damage, by preserving the confidentiality, integrity, and availability of information. It is the overarching discipline this whole field sits within.

DAST in DevSecOps

Dynamic Application Security Testing integrated into the DevSecOps pipeline, automatically testing a running application for vulnerabilities by probing it from the outside, like an attacker would, to find flaws that only appear at runtime.

DCSync Detection

Detecting the DCSync attack, in which an adversary with sufficient privilege abuses Active Directory replication to request password hashes from a domain controller as if it were one, a powerful credential-theft technique against AD.

DE Skills

The competencies a detection engineer needs, spanning understanding attacker behavior and ATT&CK, querying and data analysis, writing and tuning detections, scripting and automation, and testing detections against real techniques.

DE-Adjacent Roles

The roles that sit next to detection engineering, such as SOC analyst, threat hunter, incident responder, and security engineer, clarifying what a detection engineer uniquely owns (building and maintaining detections) versus what overlapping roles do.

DE-Hunting Interface

The working relationship between detection engineering and threat hunting, where hunters discover new attacker behaviors and detection engineers turn the repeatable ones into automated detections, creating a loop that steadily expands coverage.

DE-SOC Interface

The working relationship between detection engineering and the SOC, where the SOC operates and gives feedback on detections, and detection engineers use that feedback, false positives, missed threats, tuning needs, to improve them.

DHCP

DHCP is a network protocol that automatically assigns IP addresses and other network settings to devices.

DLL Search Order Hijacking

A Windows attack technique where an adversary plants a malicious DLL in a location that a program searches before the legitimate one, so the program loads the attacker's code, used for execution, persistence, and privilege escalation.

DMZ

A demilitarized zone: a network segment that sits between the untrusted internet and the trusted internal network, hosting public-facing services so that a compromise there does not directly expose internal systems.

DNS

DNS is the naming system that translates domain names into network addresses and related records.

DNS Cache

A temporary store of recent DNS lookups kept by resolvers and hosts so repeated queries can be answered quickly without asking authoritative servers again. It speeds resolution but can be a target for poisoning attacks.

DNS Logs

Records of DNS queries and responses, capturing which domains hosts looked up and when. They are a high-value telemetry source for detecting malware, command-and-control, data exfiltration, and suspicious domains.

DNS Record

An entry in the DNS that maps a name to information, such as an address (A/AAAA), an alias (CNAME), a mail server (MX), or text (TXT). Records are the data DNS serves to answer lookups.

DNS Resolution

The process of turning a human-readable domain name into the IP address needed to connect, by querying through resolvers and authoritative servers. It is a fundamental step before most network communication.

DNS Tunneling

A technique that hides data inside DNS queries and responses.

DNS over HTTPS (DoH)

A protocol that sends DNS queries encrypted inside HTTPS, hiding them from network observers. It improves user privacy but complicates defensive monitoring, since DNS lookups no longer appear in plain network traffic.

DNS-Based Detection

Detection techniques that use DNS query data to find threats, spotting lookups of malicious, newly registered, or algorithmically generated domains, beaconing patterns, and DNS tunneling, often written as SIEM queries over DNS logs.

DPIA Process

The step-by-step method for conducting a Data Protection Impact Assessment under the GDPR, systematically describing a processing activity, assessing its privacy risks, and identifying measures to reduce them before the processing begins.

DPIA Requirements

The conditions under the GDPR that determine when a Data Protection Impact Assessment is mandatory, namely when a processing activity is likely to result in a high risk to individuals' rights and freedoms.

Data Access Alerts

SOC alerts triggered when data is accessed in unusual or sensitive ways, such as bulk downloads, access to restricted records, or an account reaching data it never normally touches, which can indicate theft or insider misuse.