Terminology Index

Glossary

2953 terms

Evidence Practices

The end-to-end practices for handling compliance evidence in a security program, how it is collected, organized, validated, and presented, applied as part of building and running a coherent program in the capstone context.

Evidence Provenance

Evidence provenance is the traceable history of an artifact's source, collection method, time, custodian, transformations, approvals, and transfers.

Evidence Repository

A central, organized store where compliance evidence is kept, control proof, logs, policies, and records, so it is preserved, version-tracked, and easy to retrieve for audits and ongoing compliance.

Evidence Retention

Keeping compliance evidence for the required length of time, set by frameworks, regulations, or audit needs, so it remains available to demonstrate that controls operated over the relevant period, then disposing of it appropriately.

Evidence Retention Schedule

An evidence retention schedule assigns retention and defensible disposal rules to evidence classes based on their actual legal, contractual, assurance, operational, and litigation needs.

Evidence Reuse Boundaries

Evidence reuse boundaries define when one artifact may support multiple control assertions, mappings, or assurance requests.

Evidence Reuse and Efficiency

Reduction of duplicate assurance work by governing evidence once and reusing it only where requirement meaning, scope, timing, population, and quality align.

Evidence Source Health

Evidence source health describes whether a source was enabled, complete for the relevant population and time, correctly timestamped, retained, delivered, parsed, and protected from alteration.

Evidence Strategy

In threat hunting, the plan for what data and evidence a hunt will examine to test its hypothesis, which sources, fields, and time ranges, so the hunt actually has the visibility to confirm or refute what it is looking for.

Evidence Sufficiency and Appropriateness

Evidence sufficiency and appropriateness evaluate whether evidence is enough in quantity and suitable in relevance, reliability, authenticity, completeness, accuracy, timeliness, and source independence.

Evidence Types

The different forms compliance evidence can take, such as configuration exports, logs, screenshots, policies, tickets, and attestations, each suited to proving different kinds of controls. Knowing the types helps gather the right proof per control.

Evidence-Based Assessment

A security analyst practice of grounding every finding in concrete, verifiable evidence rather than assumption, so assessment conclusions are accurate, defensible, and credible to the people who must act on them.

Evidence-Based Conclusions

Findings whose confidence and scope are explicitly tied to collected evidence, method, provenance, limitations, and reasonable alternative explanations.

Evidence-Preserving Investigation

Evidence-preserving investigation collects and protects relevant technical records through authorized methods with source, time, collector, query, identifier, integrity, access, transformation, and retention context.

Exception Abuse Patterns

The recurring ways policy exceptions get misused, such as permanent 'temporary' exceptions, stacking exceptions to bypass a control entirely, or using them to avoid rather than manage risk, that undermine policy if left unchecked.

Exception Escalation

Routing a policy exception request to the appropriate level of authority for review and approval based on its risk, so higher-risk exceptions get senior scrutiny rather than being rubber-stamped at a low level.

Exception Expiration and Monitoring

Exception expiration and monitoring govern a temporary inability to meet an approved requirement through defined scope, risk, owner, authority, safeguards, review cadence, expiration, and exit plan.

Exception Process Design

Designing how policy exceptions are requested, reviewed, approved, tracked, and expired, so deviations from policy are managed as deliberate, time-bound, accountable risk decisions rather than uncontrolled loopholes.

Exception Tracking

Maintenance of approved deviations with owner, scope, rationale, affected assets, controls, approver, dates, review triggers, status, and closure evidence.

Excessive Permissions

A cloud misconfiguration where an identity or resource is granted far more access than it needs, violating least privilege and giving an attacker who compromises it broad reach. It is one of the most common and dangerous cloud weaknesses.

Exclusion

A deliberately defined condition under which a detection will not fire, used to suppress known-benign activity that would otherwise be a false positive, narrowing a detection without weakening its ability to catch real threats.

Exclusion vs Threshold

A tuning choice between removing a defined benign population from evaluation and changing the count, rate, rarity, or time condition that triggers a detection.

Executable Path

The full filesystem location a program runs from, which is valuable security context: legitimate software usually runs from expected directories, so a process running from an unusual path is a strong signal of suspicious activity.

Knowing where a process's executable lives helps defenders judge whether it is legitimate. System binaries run from known system directories, so a process executing from a temp folder, a user's download directory, or another unexpected path is a red flag often associated with malware. Combined with the command line, parent process, and signing status, the executable path is a key field for detection and investigation on endpoints.

Introduced in: Operating Systems for Defenders

Examples

Flagging a process running from a temp directory instead of a system path.
Spotting malware masquerading by running from an unusual location.
Using executable path with parent process to judge whether a process is suspicious.

Processrelates_to Command Linerelates_to Parent Processrelates_to DLL Search Order Hijackingrelates_to Process Treerelates_to Baseline Behaviorrelates_to Command Linerelates_to DLL Search Order Hijackingrelates_to GTFOBinsrelates_to Indicator Pivotrelates_to Parent Processrelates_to

Execution

The attacker tactic of running malicious code on a target system, the step where a payload, script, or command actually runs, turning access into action. It is a pivotal stage that detections heavily target.

Executive Communication

Briefing executives during an incident in clear, business-focused terms, what is happening, the impact, what decisions are needed, without technical jargon, so leadership can make timely decisions and fulfill their responsibilities.

Executive Crisis Communication

How incident leadership communicates with and on behalf of executives during a major incident, coordinating leadership messaging, decisions, and external statements at the highest level, often with legal and board involvement.

Executive Incident Communication

Executive incident communication summarizes observed events, current impact, services, confidence, actions, operational and data risks, decisions, legal workstream status, recovery, and next update.

Executive Risk Communication

Conveying risk to executives in a way they can act on, framing it in business and financial terms, focusing on decisions and trends rather than technical detail, so leaders can govern risk and set direction.

Executive Situation Report

An executive situation report summarizes supported facts, business and data impact, active harm, uncertainty, actions, options, decisions required, support needs, and the next update trigger.

Executive Summary Writing

Communication of a security assessment's purpose, scope, material findings, business consequence, uncertainty, decisions, and recommended actions for an executive audience.

Executive Summary for Assessments

An executive summary for assessments states the business reason, scope and dates, confidence and limitations, top verified risks, recurring root causes, and strategic actions in clear nontechnical language.

Exercise Corrective Action

An exercise corrective action assigns an observed gap an owner, risk, scope, priority, target, dependencies, completion evidence, exception route, and retest.