Glossary

Opportunistic Attackers

Attackers who target whatever is easy and vulnerable rather than a specific victim, exploiting widely scanned weaknesses and known vulnerabilities at scale. Most organizations face them constantly.

Organizational Incident Learning

How an organization, not just individuals, learns from incidents, capturing lessons, changing processes and controls, and building institutional memory, so it gets measurably better after each incident.

Organizational Threat Modeling Capability

An organization's overall ability to do threat modeling consistently and well, the skills, processes, tools, and culture that make threat modeling a routine practice rather than an occasional or ad-hoc activity.

Organizational Units

Containers within a directory (like Active Directory) used to group and organize users, computers, and other objects, so administration, policy, and delegation can be applied to logical groupings.

Origin

The scheme, host, and port that define where a web page or request comes from.

Outlier Detection

A hunting and analysis technique that finds data points deviating markedly from the norm, unusual hosts, accounts, or behaviors, on the principle that statistical outliers often warrant investigation as possible threats.

Output Encoding

Safely representing data for a specific context so it is treated as text instead of code.

PAM

Privileged Access Management: the discipline and tools for securing, controlling, and monitoring access to privileged accounts, the powerful admin and service accounts attackers prize, through vaulting, just-in-time access, and session control.

PAM Program Governance

The oversight structures that keep a privileged access management program effective, ownership, policies, scope, approval workflows, and review, so privileged access stays controlled and accountable over time rather than degrading.

PAM Program Metrics

Measures that show how well a privileged access management program is working, coverage of privileged accounts, use of just-in-time access, session recording, vaulted credentials, so the program's effectiveness is visible and improvable.

PAM SIEM Integration

Feeding privileged access management activity, session logs, credential checkouts, access grants, into the SIEM, so privileged-account use is monitored, correlated, and alerted on alongside other telemetry.

PAM Vault Architecture

The design of the secure vault at the heart of a PAM system, where privileged credentials are stored, encrypted, rotated, and access-controlled, so privileged secrets are protected and brokered rather than held by users.

PASTA Methodology

Process for Attack Simulation and Threat Analysis: a risk-centric, seven-stage threat-modeling methodology that ties technical threats to business impact, producing attacker-informed, prioritized findings.

PAT

Port Address Translation: a form of NAT that lets many devices share one public IP address by mapping each connection to a different port, common on networks and relevant to interpreting addresses in traffic.

PBAC

Policy-Based Access Control: an access model where access decisions are driven by centrally defined policies (often using attributes and context) rather than static role assignments, enabling fine-grained, dynamic authorization.

PBKDF2

Password-Based Key Derivation Function 2: a widely used function that derives a cryptographic key (or password hash) from a password by applying a hash many times with a salt, deliberately slow to resist brute-forcing.

PCI Audit Cycle

The recurring assessment cycle for PCI DSS compliance, annual validation (by self-assessment or external assessor) plus ongoing requirements, that organizations handling payment-card data must complete to stay compliant.

PCI DSS

The Payment Card Industry Data Security Standard: a mandatory set of security requirements for organizations that handle payment-card data, aimed at protecting cardholder information and reducing card fraud.

PCI DSS Cloud Architecture

Designing a cloud architecture that meets PCI DSS requirements for handling cardholder data, with the segmentation, encryption, access control, logging, and scope reduction needed to protect the cardholder data environment.

PCI DSS Requirements

The specific control requirements that make up PCI DSS, spanning network security, data protection, access control, monitoring, and testing, that organizations map to and implement to protect cardholder data.

PCI Merchant Levels

The tiers that classify organizations by payment-card transaction volume, determining how rigorously they must validate PCI DSS compliance, from self-assessment for smaller merchants to full external assessment for the largest.

PCI-DSS Cloud

Meeting PCI DSS in cloud environments, addressing how the standard applies when cardholder data is processed in the cloud, including shared responsibility, scope, and provider attestations within the cloud compliance landscape.

PEAK Hunting Framework

A structured threat-hunting framework (Prepare, Execute, Act with Knowledge) that organizes hunts into clear phases, emphasizing preparation, hypothesis-driven execution, and turning findings into lasting knowledge and detections.

PIM Implementation for Meridian

A capstone exercise implementing Privileged Identity Management for the fictional organization Meridian, designing how privileged roles are granted just-in-time, approved, and monitored as part of building its identity program.

PKCE

Proof Key for Code Exchange: an OAuth 2.0 extension that protects the authorization code flow from interception, especially for mobile and single-page apps, by binding the code to a secret only the legitimate client holds.

PKI

Public Key Infrastructure: the system of certificate authorities, certificates, and trust relationships that binds public keys to identities, enabling trusted use of public-key cryptography for TLS, signing, and authentication.

PMapper Analysis

Using the PMapper tool to analyze a cloud account's IAM and discover privilege-escalation paths, building a graph of identities, permissions, and connections to surface routes an attacker could chain to gain higher access.

PaaS

Platform as a Service: a cloud model where the provider manages the underlying infrastructure and platform (OS, runtime, scaling) and the customer focuses on their applications and data, sitting between IaaS and SaaS in shared responsibility.

Packet

The unit of data routed across networks at the network layer, carrying a payload plus addressing (IP) so it can travel from source to destination. Packets are fundamental units defenders inspect and analyze.

Parameterized Queries

A coding technique that separates SQL code from user-supplied data by using placeholders bound to values, so input cannot be interpreted as commands, the primary defense against SQL injection.

Parent Process

The process that created another process. Parent-child relationships are crucial context for defenders, since unusual parentage (like a document spawning a command shell) is a strong indicator of malicious activity.