Glossary

Diffie-Hellman

A key-exchange method that lets two parties establish a shared secret over an insecure channel without ever transmitting the secret itself, foundational to setting up encrypted connections like TLS.

Digital Signature

A cryptographic proof that data came from a private key holder and has not changed.

Digital Signatures

A cryptographic technique that proves a message or file came from a specific signer and was not altered, by signing with a private key that anyone can verify with the matching public key. It provides authenticity, integrity, and non-repudiation.

Directory Services

Systems that store and organize identity information, accounts, groups, attributes, and devices, and answer authentication and lookup requests, serving as the authoritative source of identities for an organization. Active Directory is the classic example.

Disaster Recovery

Plans and capabilities for restoring systems after a major disruption.

Discovery

The attacker tactic of exploring a compromised environment to learn about it, enumerating systems, accounts, networks, and defenses, to plan the next moves like lateral movement and privilege escalation.

Disk Encryption

Encrypting the contents of a storage device so the data is unreadable without the key, protecting data at rest if a device is lost, stolen, or improperly disposed of. Full-disk encryption is a baseline endpoint hardening control.

Disposition

The decision an analyst records to close out an alert or case, classifying it as a true positive, false positive, benign true positive, or escalation. It is the formal conclusion of triage and creates an accountable record.

Distributed Tracing for Security

Using distributed tracing, which follows a single request across the many services it touches, for security purposes, reconstructing how a request flowed through a microservices system to investigate anomalies and attacks.

Dockerfile Security

Writing container build files (Dockerfiles) securely, using minimal trusted base images, avoiding embedded secrets, running as non-root, and pinning versions, so the images they produce are secure from the start of the supply chain.

Domain

In a web address, the human-readable name that identifies a site (like example.com), which DNS resolves to a server. It is a core component of a URL and a key piece of context when assessing whether a link or request is trustworthy.

Domain Controller

A server that runs Active Directory and handles authentication and authorization for a Windows domain, validating logins and enforcing policy. Because it holds the keys to the domain, it is one of the most security-critical systems an organization runs.

Double Extortion

A ransomware tactic where attackers both encrypt a victim's data and steal a copy, then threaten to leak it publicly, so paying only for decryption is not enough to prevent exposure. It pressures victims even if they have backups.

Drift Detection

Identifying when a system's actual configuration has drifted away from its intended secure baseline, so the deviation can be investigated and corrected before it becomes a vulnerability or compliance gap.

Drift Management

In cloud-native and GitOps systems, the practice of keeping running infrastructure aligned with its declared desired state, detecting when reality diverges from the Git source of truth and reconciling it back automatically.

Dwell Time

The length of time an attacker remains undetected in an environment, from initial compromise to discovery. Shorter dwell time means less opportunity for damage, so reducing it is a key goal of detection and response.

Dynamic Analysis Methodology

The approach to analyzing malware by running it in a controlled, isolated environment and observing its behavior, what files, processes, registry keys, and network connections it creates, to understand what it does without reading its code.

ECDH

Elliptic Curve Diffie-Hellman: the elliptic-curve version of the Diffie-Hellman key exchange, letting two parties establish a shared secret efficiently and securely with much smaller keys than traditional Diffie-Hellman.

ECDSA

Elliptic Curve Digital Signature Algorithm: a widely used algorithm for creating digital signatures using elliptic-curve cryptography, providing authenticity and integrity with smaller keys and faster operation than RSA signatures.

EDR

Endpoint Detection and Response: software on endpoints that continuously records activity, detects malicious behavior, and lets responders investigate and act, such as isolating a host, giving deep visibility and control over what happens on each device.

EdDSA

Edwards-curve Digital Signature Algorithm: a modern elliptic-curve signature scheme (notably Ed25519) designed for speed, strong security, and resistance to common implementation mistakes that have undermined older signature algorithms.

Egress

Network traffic leaving a network or host, outbound flows toward the internet or another network. Controlling and monitoring egress is key to stopping data exfiltration and command-and-control communication.

Egress Control

Restricting and inspecting outbound traffic from cloud workloads so they can only reach approved destinations, limiting an attacker's ability to exfiltrate data or reach command-and-control if a workload is compromised.

Egress Filtering

Controlling outbound network traffic to limit data loss and attacker movement.

Email Alerts

SOC alerts generated from email security signals, such as detected phishing, malicious attachments or links, or suspicious sender behavior, which analysts triage to catch one of the most common attack delivery channels.

Emergency Patches

Patches applied urgently outside the normal schedule to fix a critical, actively threatened vulnerability, accepting the risk and disruption of fast deployment because the danger of leaving it unpatched is greater.

Encapsulation

Wrapping data with protocol headers as it moves through network layers.

Encryption

Transforming readable data into an unreadable form using a key and algorithm, so only those with the key can recover the original. It is the primary technical means of protecting confidentiality for data at rest and in transit.

Encryption at Rest (Cloud)

Encrypting data stored in cloud services, disks, databases, object storage, so it is unreadable without the keys, protecting it if the underlying storage is accessed improperly. A cloud engineer enables and manages it across services.

Encryption in Transit (Cloud)

Encrypting data as it moves between cloud services, users, and systems, using TLS and related protocols, so it cannot be intercepted or tampered with on the network. A cloud engineer enforces it across connections.

Endpoint Alerts

SOC alerts originating from endpoint security tools like EDR and antivirus, flagging suspicious processes, malware, persistence, or anomalous host behavior. Endpoints are where much attacker activity executes, making these alerts high-value.