Glossary

Data Classification

Labeling data based on sensitivity, value, or handling requirements.

Data Classification (Cloud)

Categorizing cloud-stored data by sensitivity, such as public, internal, confidential, or regulated, so the right protections, encryption, access control, and DLP, can be applied proportionately to how sensitive each dataset is.

Data Collection

The attacker activity of gathering targeted data within a compromised environment in preparation for theft, identifying, accessing, and staging files, records, or communications before exfiltrating them.

Data Exfiltration Response

The response to an incident where data is being or has been stolen, focused on stopping the outflow, scoping exactly what left, preserving evidence, and meeting notification obligations triggered by the loss of data.

Data Lakes

Large, scalable repositories that store vast amounts of raw log and telemetry data in one place for security analytics, letting defenders retain and query more data over longer periods than a traditional SIEM alone.

Data Loss Prevention

Controls that try to detect or prevent sensitive data from leaving approved places.

Data Mapping Foundation

The basic concept and purpose of data mapping in privacy practice: documenting what personal data an organization holds, where it comes from, where it flows, and where it is stored, as the groundwork for all privacy compliance.

Data Mapping Process

The step-by-step method for building and maintaining a data map, discovering personal data, documenting its sources, flows, purposes, and storage, validating with stakeholders, and keeping it current as systems change.

Data Mapping at Scale

Performing data mapping across large, complex organizations with many systems and data flows, using automation, discovery tooling, and governance to keep the map accurate when manual methods alone cannot keep up.

Data Minimization

Collecting and keeping only the data needed for a clear purpose.

Data Protection

The set of controls and practices that keep data safe across its lifecycle and all three states, at rest, in transit, and in use, through encryption, access control, classification, and loss prevention, preserving its confidentiality and integrity.

Data Protection Officer

A designated role, required by laws like the GDPR for certain organizations, responsible for overseeing data-protection strategy and compliance, advising on privacy obligations, and serving as a contact point for regulators and data subjects.

Data Residency

The requirement or practice of keeping data physically located in a specific country or region, often to satisfy legal, regulatory, or contractual obligations. In the cloud, it is controlled mainly through region selection.

Data Sovereignty

The principle that data is subject to the laws of the country in which it is located, meaning where data resides determines which government's legal authority and access rights apply to it. It is a key driver of cloud region and provider choices.

Data Subject Rights Portfolio

The full set of rights that privacy laws grant individuals over their personal data, such as access, correction, deletion, portability, and objection, that an organization must be able to recognize and fulfill.

Data at Rest

Data stored on disk, in databases, backups, or other storage systems.

Data in Transit

Data moving across a network, between systems, services, or users, where it is exposed to interception and tampering. Protecting it, primarily with encryption like TLS, is one of the core states of data protection.

Data in Use

Data actively being processed in memory or by an application, where it is typically decrypted and therefore exposed. It is the hardest of the three data states to protect, addressed by emerging techniques like confidential computing.

Data-Driven Hunting

A threat-hunting approach that starts from the data itself, applying analytical techniques like frequency analysis, stack counting, and long-tail analysis to large datasets to surface anomalies worth investigating, rather than starting from a known threat.

Day-to-Day GRC Work

The recurring practical tasks of a governance, risk, and compliance analyst, maintaining controls and evidence, running risk assessments, mapping and testing controls, tracking findings, and communicating status, that keep a GRC program operating.

Declarative Infrastructure

Defining infrastructure by describing the desired end state in code, and letting tooling make reality match, rather than scripting step-by-step changes. It is foundational to cloud-native systems and enables consistent, auditable, self-correcting configuration.

Default Configurations

The out-of-the-box settings software and systems ship with, which prioritize ease of setup over security and often leave unnecessary features, default accounts, and permissive options enabled. Replacing them is a first step in hardening.

Default Deny

A security principle of blocking everything by default and explicitly allowing only what is needed, applied to firewalls, access control, and network policy. It fails safe, since anything not expressly permitted is denied.

Default Gateway

The network device, usually a router, that a host sends traffic to when the destination is outside its own local network. It is the exit point from a subnet to the wider network and internet.

Defender

Anyone whose role is to protect systems, networks, and data from attack, spanning SOC analysts, incident responders, detection engineers, and security architects. The defender's perspective frames how security work is approached.

Defense Cost Asymmetry

The imbalance between attacker and defender effort: a defender must secure every possible way in, while an attacker needs to find just one. Hardening aims to flip this, raising the attacker's cost relative to the defender's.

Defense Evasion

The attacker tactic of avoiding detection and defeating security controls, such as disabling logging, obfuscating code, using legitimate tools, or hiding in normal activity, so the intrusion can continue unnoticed.

Defense Evasion Hunts

Threat hunts that specifically look for signs attackers are hiding or defeating defenses, such as logging gaps, disabled security tools, obfuscation, or masquerading, since evasion itself leaves detectable traces.

Defense Evolution

The way cloud-native security defenses have developed to keep pace with the architecture's changes, shifting from perimeter and host controls toward identity, policy-as-code, admission control, and runtime observability suited to containers and orchestration.

Defense in Depth

Defense in depth uses multiple layers of controls so one failure does not leave an asset fully exposed.

Dependency Security

Securing the third-party libraries and components a web application relies on, by tracking them, scanning for known vulnerabilities, and updating promptly, since a flaw in a dependency becomes a flaw in your application.

Deployment Authorization

Controlling what is allowed to be deployed into a cloud-native environment, ensuring only approved, signed, and policy-compliant workloads run, typically enforced at deploy time through admission control and signature verification.