Glossary

First-Seen Detection

A SIEM detection technique that flags activity occurring for the first time in an environment, a new domain, a never-before-seen process, a first login from a location, since novelty often signals something worth investigating.

Flow Data

Network telemetry that records metadata about connections, source and destination, ports, protocol, bytes, and timing, without capturing packet contents. It gives broad, efficient visibility into who talked to whom across a network.

Flux ArgoCD

Two leading GitOps tools, Flux and Argo CD, that continuously deploy and reconcile Kubernetes workloads from a Git repository, making Git the source of truth and automatically correcting drift from the declared state.

Follow the Sun

Follow the sun is a multi-region operating model that transfers security work as local teams start and end their day using controlled access, overlap, case standards, and acknowledged handoffs.

Follow-the-Sun

A SOC staffing model where monitoring and response are handed between teams in different time zones, so coverage follows daylight hours around the globe, giving 24/7 operations without overnight shifts for any single team.

Foothold

The initial access an attacker establishes on a system or network, the beachhead from which they expand. Gaining a foothold turns an external threat into an internal one and starts the clock on dwell time.

Forced Browsing

A web attack technique of directly requesting URLs or resources that are not linked or shown in the interface, to reach hidden pages, files, or functions that the application failed to properly protect.

Forensic Analysts

Blue-team specialists who investigate compromised systems in depth, collecting and analyzing evidence, disk, memory, logs, to reconstruct what an attacker did. They provide the deep analysis that supports incident response and lessons learned.

Forensic Considerations

The factors a cloud engineer must plan for so containers and workloads can be investigated after an incident, capturing ephemeral evidence, retaining logs, and enabling the visibility forensics needs before an incident occurs.

Forensic Readiness Coordination

Forensic readiness coordination prepares people, logging, tools, authority, and procedures so evidence can be preserved without unnecessarily delaying safe recovery.

Forensics

The disciplined collection, preservation, and analysis of digital evidence to reconstruct what happened in an incident, performed soundly enough that the findings are accurate and could withstand legal scrutiny.

Forward Secrecy

A property of encrypted connections where compromising a server's long-term private key later does not let an attacker decrypt past sessions, because each session used a unique, ephemeral key that was never stored.

Fourth Party Risk

Risk arising from the vendors of your vendors, the subcontractors and service providers your third parties depend on, which can affect you even though you have no direct relationship with them.

Fragment

The part of a URL after the '#' symbol, used to point to a location within a page. It is handled by the browser and not normally sent to the server, which matters when reasoning about what a server actually receives.

Frame

The unit of data at the data-link layer of a network, wrapping a packet with addressing (MAC addresses) for delivery across a local network segment. It is the lowest-level container in the common networking models.

Framework Anti-Patterns

Common mistakes organizations make when adopting security frameworks, such as treating the framework as a checklist, chasing certification without real security, or adopting too many frameworks without mapping them, that undermine the framework's value.

Framework Crosswalk Governance

Framework crosswalk governance maintains reviewed, versioned relationships between a control and multiple source outcomes or requirements, including rationale, scope, confidence, reviewer, and change trigger.

Framework Ecosystem

The landscape of security frameworks, standards, and regulations and how they relate, reference frameworks, certifiable standards, control catalogs, and regulations, that an organization navigates and maps between rather than treating any one in isolation.

Framework Mapping

Creating crosswalks between the requirements of different security frameworks, so a control implemented once can be shown to satisfy multiple frameworks and gaps across them become visible. It is the key to efficient multi-framework compliance.

Framework Mapping Limitation

A framework mapping limitation records differences in source version, wording, scope, intent, evidence, frequency, and assurance that prevent mapped items from being treated as equivalent proof.

Framework Purpose

Understanding what a given security framework is actually for, risk management, certification, regulatory compliance, or prescriptive guidance, so it is applied to the right ends rather than misused for a purpose it was not designed to serve.

Framework Roadmap

A phased plan for adopting and maturing security frameworks over time, sequencing which frameworks to implement, in what order, and toward what milestones, so framework adoption is deliberate rather than reactive or overwhelming.

Framework Selection

The GRC analyst's task of choosing which security framework or frameworks an organization should adopt, based on its industry, regulatory obligations, customer demands, risk, and resources, so the choice fits real needs.

Framework Selection Criteria

The specific factors used to decide which security framework fits an organization, such as regulatory drivers, customer and contractual demands, industry, risk profile, certifiability, and the team's capacity to implement and maintain it.

Fraud and Authentication Separation

Fraud and authentication separation recognizes that control of an authenticator does not establish authorization or legitimacy of a transaction.

Frequency Analysis

A hunting and analysis technique that counts how often values occur in a dataset, so rare occurrences stand out, on the principle that unusual, infrequent activity is more likely to be malicious than common, high-volume activity.

Full Domain Compromise Indicators

Full domain compromise indicators are evidence that an attacker may control Active Directory's highest-trust credentials, replication paths, domain controllers, or administrative configuration.

Function Code Security

Securing the code inside a serverless function, validating inputs, avoiding injection and insecure dependencies, and handling secrets safely, since the function's own logic is part of the attack surface even though the platform manages the servers.

Function Dependencies

The third-party libraries a serverless function bundles, which can carry known vulnerabilities the function inherits, so they must be inventoried, scanned, and kept updated as part of securing serverless workloads.

Function Execution Identity

A function execution identity is the cloud principal and permission set used by function code to access services, data, networks, and secrets after invocation.

Function IAM

Applying least-privilege IAM to serverless functions, granting each function only the permissions it needs, so a compromised function cannot reach far beyond its narrow purpose.