Glossary

Quantitative Risk Skepticism

Healthy skepticism toward quantitative risk results, recognizing input uncertainty, model limits, and the risk of false precision, so numbers inform rather than mislead decisions.

Quantitative Risk Value

The reasons to use quantitative risk methods, comparability, aggregation, dollar-level decision-making, defensibility, that justify investing the extra effort beyond qualitative analysis.

Query Performance

How fast and efficiently SIEM queries return results. Good performance is essential to detection, hunting, and investigation, since slow queries throttle analyst workflow and degrade SOC effectiveness.

Query String

The part of a URL after the question mark that carries named parameters and values. Defenders read query strings to understand requests and to spot injection or tampering attempts in web traffic.

Query Tuning

The practice of refining SIEM queries to run faster, return more relevant results, and consume fewer resources, by reordering filters, narrowing time ranges, and reshaping logic.

Queue Management

The discipline of managing the SOC's alert queue, prioritizing, batching, and clearing items so the team handles the most important alerts in time without burning out or letting noise accumulate.

RAT Analysis

Analyzing Remote Access Trojan (RAT) samples to understand their command-and-control, capabilities, and persistence, producing indicators and detections for these long-running, attacker-controlled implants.

RBAC

Role-Based Access Control: an access model where permissions are assigned to roles, and users are granted access by being assigned roles, simplifying administration and supporting least privilege at scale.

RBAC at Scale

The challenges and patterns for using role-based access control across large cloud-native environments, role explosion, drift, and complexity, that require deliberate design and ongoing governance to keep RBAC working.

RDP

Remote Desktop Protocol: Microsoft's protocol for graphical remote access to Windows systems. Widely used by admins and frequently abused by attackers for lateral movement and initial access when exposed.

RDP Lateral Movement Detection

Detecting attackers using RDP to move between hosts, by spotting anomalous interactive logons, unusual source-to-destination patterns, and unexpected use of administrative accounts over RDP, mapped to ATT&CK.

REST API Security Testing

Penetration testing focused on REST APIs, examining authentication, authorization, input handling, business logic, rate limiting, and data exposure to find vulnerabilities specific to API surfaces.

RSA

A widely used asymmetric (public-key) cryptography algorithm based on the difficulty of factoring large numbers, foundational to TLS, signatures, and PKI alongside newer alternatives like elliptic-curve cryptography.

Rainbow Tables

Precomputed tables that reverse cryptographic hashes (especially of passwords) back to their inputs by trading storage for computation. Salting defeats them, which is why every password hash must be salted.

Ransomware

Malware that disrupts access to systems or data and demands payment.

Ransomware Analysis

Examining ransomware samples to understand how they encrypt, persist, communicate, and demand payment, producing indicators and detections, and informing both response and prevention.

Ransomware Recovery Design

Designing recovery so it can actually withstand ransomware, immutable backups, isolation, tested restoration, prioritization, since ransomware recovery is where many BC/DR plans first really break.

Ransomware Response

The incident-response approach for a ransomware event, containing spread, deciding on payment under legal guidance, restoring from backups, and coordinating with legal, regulators, and possibly law enforcement.

Rate Limiting

Restricting how often a user, IP, or system can perform an action in a time window.

ReBAC

Relationship-Based Access Control: an access model where permissions follow the relationships between entities (such as 'owns' or 'member of'), used in systems like file sharing and graph-based platforms.

Reading FAIR Output

Interpreting FAIR's quantitative results, loss distributions, exceedance curves, confidence ranges, so analysts and decision-makers understand what the numbers mean and don't read them as point estimates.

Real-Time Posture

Maintaining a continuously up-to-date view of cloud security posture, rather than relying on periodic snapshots, so deviations are seen and remediated quickly within compliance and security programs.

Rebuild vs Clean

An IR decision: rebuild a compromised system from a known-good image versus try to clean the existing one, weighed by confidence in eradication, system complexity, and downtime trade-offs.

Reconnaissance

Collecting information about a target before or during an attack.

Recovery

The phase of the incident lifecycle that restores normal operations, returning systems and services to function safely after an incident, while preventing reinfection and confirming the threat is gone.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time.

Recovery Process

The structured steps that move an organization from contained incident to restored operations, planning the sequence, executing restores, validating each step, and confirming safe return to business.

Recovery Time Objective

The maximum acceptable time to restore a service after disruption.

Recovery Validation

Confirming that recovery actually worked, restored systems function correctly, the threat is truly gone, and no compromise persists, before declaring the incident closed.

Recurring Findings

Audit findings that keep appearing audit after audit, signaling systemic root-cause issues rather than one-off mistakes, and demanding deeper remediation than fixing each instance.

Red Team Exercises

Adversarial security exercises where a dedicated team simulates real attackers against the organization to test defenses end to end, surfacing realistic gaps that vulnerability scans and tabletops miss.

Referrer-Policy

An HTTP response header that controls how much referrer information browsers send when navigating from a page, used to limit information leakage to other origins.