Terminology Index

Glossary

2953 terms

PCI DSS

The Payment Card Industry Data Security Standard: a mandatory set of security requirements for organizations that handle payment-card data, aimed at protecting cardholder information and reducing card fraud.

PCI DSS Cloud Architecture

Designing a cloud architecture that meets PCI DSS requirements for handling cardholder data, with the segmentation, encryption, access control, logging, and scope reduction needed to protect the cardholder data environment.

PCI DSS Requirements

The specific control requirements that make up PCI DSS, spanning network security, data protection, access control, monitoring, and testing, that organizations map to and implement to protect cardholder data.

PCI DSS Scope

PCI DSS scope identifies people, processes, technologies, and connected components that store, process, transmit, or can affect the security of payment account data.

PCI Merchant Levels

The tiers that classify organizations by payment-card transaction volume, determining how rigorously they must validate PCI DSS compliance, from self-assessment for smaller merchants to full external assessment for the largest.

PCI Validation Programs

PCI SSC-defined assessment and reporting paths whose applicability depends on entity type, transaction environment, brand or acquirer direction, scope, and current program rules.

PCI-DSS Cloud

Meeting PCI DSS in cloud environments, addressing how the standard applies when cardholder data is processed in the cloud, including shared responsibility, scope, and provider attestations within the cloud compliance landscape.

PE Memory Layout

PE memory layout describes how executable sections, permissions, imports, relocations, and resources map from raw file offsets to virtual addresses in a loaded Windows image.

PE Static Analysis

PE static analysis examines a Windows Portable Executable's headers, sections, imports, exports, resources, certificates, entry point, and other structure without executing it.

PEAK Hunting Framework

A structured threat-hunting framework (Prepare, Execute, Act with Knowledge) that organizes hunts into clear phases, emphasizing preparation, hypothesis-driven execution, and turning findings into lasting knowledge and detections.

PIM Activation Monitoring

PIM activation monitoring reviews privileged eligibility, activation, approval, denial, extension, expiration, and role-setting changes together with the actions performed during the privileged window.

PIM Implementation for Meridian

A capstone exercise implementing Privileged Identity Management for the fictional organization Meridian, designing how privileged roles are granted just-in-time, approved, and monitored as part of building its identity program.

PKCE

Proof Key for Code Exchange: an OAuth 2.0 extension that protects the authorization code flow from interception, especially for mobile and single-page apps, by binding the code to a secret only the legitimate client holds.

PKI

Public Key Infrastructure: the system of certificate authorities, certificates, and trust relationships that binds public keys to identities, enabling trusted use of public-key cryptography for TLS, signing, and authentication.

PMapper Analysis

Using the PMapper tool to analyze a cloud account's IAM and discover privilege-escalation paths, building a graph of identities, permissions, and connections to surface routes an attacker could chain to gain higher access.

PaaS

Platform as a Service: a cloud model where the provider manages the underlying infrastructure and platform (OS, runtime, scaling) and the customer focuses on their applications and data, sitting between IaaS and SaaS in shared responsibility.

Packet

The unit of data routed across networks at the network layer, carrying a payload plus addressing (IP) so it can travel from source to destination. Packets are fundamental units defenders inspect and analyze.

Packing and Obfuscation Indicators

Packing and obfuscation indicators are structural or code clues that content may be compressed, encrypted, transformed, hidden, or reconstructed at runtime.

Parameterized Queries

A coding technique that separates SQL code from user-supplied data by using placeholders bound to values, so input cannot be interpreted as commands, the primary defense against SQL injection.

Parameterized Query

A database operation that sends code structure separately from bound data values so input is not interpreted as query syntax in supported parameter positions.

Parent Process

The process that created another process. Parent-child relationships are crucial context for defenders, since unusual parentage (like a document spawning a command shell) is a strong indicator of malicious activity.

Parent-Child Process Analysis

Parent-child process analysis evaluates process ancestry, executable identity, arguments, user, integrity, session, and timing to understand how execution began.

Parser and Schema Validation

Testing that incoming records conform to expected structures, types, meanings, and field-preservation rules.

Partial Remediation

Partial remediation reduces one exploit path or part of the affected scope while the underlying weakness or another reachable variant remains.

Pass-the-Hash

An attack that authenticates using a stolen password hash directly, without cracking it to the plaintext password, letting an attacker move laterally using captured credential hashes on Windows networks.

Pass-the-Hash Detection

Detecting pass-the-hash attacks by spotting the abnormal authentication patterns they create, such as logons using hashes in ways or from places that legitimate authentication would not, mapped to ATT&CK techniques.

Pass-the-Ticket

An attack that reuses stolen Kerberos tickets to authenticate as a user without their password, letting an attacker access resources and move laterally in Active Directory using captured or forged tickets.

Pass-the-ticket steals or forges Kerberos tickets (ticket-granting tickets or service tickets) and presents them to authenticate as the associated user, bypassing the need for a password. With a stolen TGT, an attacker can request access to many services; forged tickets (golden/silver) extend this further. It is a key Active Directory lateral-movement and persistence technique. Defenses include protecting ticket material, limiting privileged exposure, and detecting anomalous ticket use.

Introduced in: Threat Landscape and Attacker Thinking

Examples

Reusing a stolen ticket-granting ticket to access services as a user.
Moving laterally in AD with a captured Kerberos ticket.
Detecting anomalous ticket use as a sign of pass-the-ticket.

Pass-the-Hashrelates_to Kerberosrelates_to Kerberos Ticket Forgery Detectionrelates_to Lateral Movementrelates_to Mimikatzrelates_to Pass-the-Hashrelates_to Privileged Access Threat Landscaperelates_to

Passkey

A phishing-resistant sign-in method based on public key cryptography instead of shared passwords.

Passkey Adoption

The practice and challenges of rolling out passkeys to users in a consumer identity context, driving uptake of phishing-resistant passwordless credentials while supporting fallback and diverse devices.

Passkey Registration and Recovery

Passkey registration and recovery bind WebAuthn public-key credentials to the correct relying party and subject and provide safe handling for device loss, syncing, replacement, and unsupported users.

Passkeys

Phishing-resistant, passwordless credentials based on FIDO/public-key cryptography that let users sign in with a device or biometric instead of a password, syncable across devices for a smooth, secure experience.

Password Hashing Function

A specialized, deliberately slow hash function (like bcrypt, scrypt, or Argon2) designed for storing passwords, so that even if the hash store is stolen, cracking the passwords is computationally expensive.