Terminology Index

Glossary

2953 terms

Customer Managed Keys

Encryption keys that the customer controls within a cloud key-management service, rather than relying on provider-managed default keys, giving the customer authority over key rotation, access, and revocation for their encrypted data.

Customer Notification Coordination

Customer notification coordination aligns incident facts, contracts, law, relationship ownership, accessibility, delivery, support, and follow-up before customer communication.

Customer Security Notifications

Customer security notifications inform established channels about consequential sign-in, recovery, authenticator, contact, session, tenant-role, and transaction events with a safe review and reporting path.

Customer Trust Center

A dedicated, often public-facing page or portal where an organization shares its security and compliance posture, certifications, audit reports, and policies, so prospects and customers can verify trust without lengthy back-and-forth.

Customer and Third-Party Coordination

Customer and third-party coordination uses verified contacts and approved contractual or operational paths to exchange the minimum necessary incident facts, actions, evidence, and commitments.

Customer-Implemented Controls

The security controls that, under shared responsibility, the customer must build and operate themselves in the cloud, such as configuring identity, encryption, network rules, and logging, as opposed to controls inherited from the provider.

Cyber Insurance Coordination

Cyber insurance coordination applies the organization's executed policy, notice instructions, consent requirements, coverage terms, and authorized contacts during an incident.

Cyber Kill Chain

A model that breaks an intrusion into sequential stages, from reconnaissance through to actions on objectives, so defenders can understand an attack's progression and intervene at any link to break the chain.

Originally from Lockheed Martin, the kill chain describes the phases of a targeted attack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Its value to defenders is the idea that disrupting any single stage stops the attack, so detection and response can be mapped to each phase. It is a foundational mental model, complementary to the more granular MITRE ATT&CK framework.

Introduced in: Threat Landscape and Attacker Thinking

Examples

Mapping a phishing intrusion to delivery, exploitation, and installation stages.
Disrupting an attack at the command-and-control stage to break the chain.
Using the model to ensure detections exist at multiple attack phases.

MITRE ATT&CKrelates_to Reconnaissancerelates_to Initial Accessrelates_to Command and Controlrelates_to Attack Patternsrelates_to Attack Patternsrelates_to Collectionrelates_to Data Collectionrelates_to Discoveryrelates_to Executionrelates_to Network Reconnaissancerelates_to

Cyber Risk Scenario

A cyber risk scenario describes a plausible threat or failure acting through conditions against assets or processes to create defined consequences over a time horizon.

Cyber Risk in ERM

Positioning cybersecurity risk as one component of enterprise risk management, so cyber is assessed, aggregated, and reported alongside financial, operational, and strategic risks rather than managed in a security silo.

Cybercriminal

An actor who uses cyber-enabled activity primarily for illicit financial benefit, including fraud, extortion, theft, brokerage, or sale of access and data.

Cybersecurity

The practice of protecting systems, networks, and data from digital attack, unauthorized access, and damage, by preserving the confidentiality, integrity, and availability of information. It is the overarching discipline this whole field sits within.

DAST Safety Controls

DAST safety controls bound an active scan through explicit authorization, targets, techniques, credentials, rate limits, exclusions, stop conditions, monitoring, test data, and cleanup.

DAST in DevSecOps

Dynamic Application Security Testing integrated into the DevSecOps pipeline, automatically testing a running application for vulnerabilities by probing it from the outside, like an attacker would, to find flaws that only appear at runtime.

DCSync

DCSync is abuse of Active Directory replication permissions to request credential data while impersonating the behavior of a domain controller.

DCSync Detection

Detecting the DCSync attack, in which an adversary with sufficient privilege abuses Active Directory replication to request password hashes from a domain controller as if it were one, a powerful credential-theft technique against AD.

DE Skills

The competencies a detection engineer needs, spanning understanding attacker behavior and ATT&CK, querying and data analysis, writing and tuning detections, scripting and automation, and testing detections against real techniques.

DE-Adjacent Roles

The roles that sit next to detection engineering, such as SOC analyst, threat hunter, incident responder, and security engineer, clarifying what a detection engineer uniquely owns (building and maintaining detections) versus what overlapping roles do.

DE-Hunting Interface

The working relationship between detection engineering and threat hunting, where hunters discover new attacker behaviors and detection engineers turn the repeatable ones into automated detections, creating a loop that steadily expands coverage.

DE-SOC Interface

The working relationship between detection engineering and the SOC, where the SOC operates and gives feedback on detections, and detection engineers use that feedback, false positives, missed threats, tuning needs, to improve them.

DHCP

DHCP is a network protocol that automatically assigns IP addresses and other network settings to devices.

DLL Search Order Hijacking

A Windows attack technique where an adversary plants a malicious DLL in a location that a program searches before the legitimate one, so the program loads the attacker's code, used for execution, persistence, and privilege escalation.

DMZ

A demilitarized zone: a network segment that sits between the untrusted internet and the trusted internal network, hosting public-facing services so that a compromise there does not directly expose internal systems.

DNS

DNS is the naming system that translates domain names into network addresses and related records.

DNS Cache

A temporary store of recent DNS lookups kept by resolvers and hosts so repeated queries can be answered quickly without asking authoritative servers again. It speeds resolution but can be a target for poisoning attacks.

DNS Logs

Records of DNS queries and responses, capturing which domains hosts looked up and when. They are a high-value telemetry source for detecting malware, command-and-control, data exfiltration, and suspicious domains.

DNS Query

A request for a named DNS record type and class, whose response may come from cache, recursion, forwarding, or an authoritative source.

DNS Record

An entry in the DNS that maps a name to information, such as an address (A/AAAA), an alias (CNAME), a mail server (MX), or text (TXT). Records are the data DNS serves to answer lookups.

DNS Resolution

The process of turning a human-readable domain name into the IP address needed to connect, by querying through resolvers and authoritative servers. It is a fundamental step before most network communication.

DNS Resolver

A DNS resolver is the service that receives a DNS query from a client and finds the records needed to answer it.

DNS Tunneling

A technique that hides data inside DNS queries and responses.

DNS over HTTPS

DNS messages carried over HTTPS, protecting the resolver connection while shifting visibility and trust to the selected HTTPS resolver and endpoint.