Terminology Index

Glossary

2953 terms

Role Explosion

Role explosion is uncontrolled growth of composite roles for every scope, region, product, limit, and exception until assignments and reviews become unreliable.

Role Explosion and Exceptions

Role explosion and exceptions describe the loss of manageability when near-duplicate or user-specific roles multiply and temporary access becomes permanent.

Role Mining Methodology

Systematically deriving role definitions from existing access data and job-function information, top-down (from organization roles) or bottom-up (from entitlements analysis), producing roles grounded in real use.

Role Mining Tools

Software tools that automate role mining, clustering entitlements, identifying candidate roles, and presenting them for review, making large-scale role engineering practical for sizeable organizations.

Role Model Implementation

Putting a designed role model into operation, defining roles in the IGA system, migrating users to them, and managing day-to-day, so the engineered roles actually drive access in practice.

Role Ownership and Lifecycle

Role ownership and lifecycle assign accountability for a role's purpose, eligible population, target mappings, changes, review, versioning, and retirement.

Role and Relationship Mapping

Role and relationship mapping identifies who determines processing purposes and essential means, who acts on instructions, and which parties jointly make decisions.

Role and Tenant Test Matrix

A role and tenant test matrix states which subject classes should be allowed or denied each action on each object across ownership and tenant boundaries.

Role-Based Access Control (RBAC)

Role-based access control assigns permissions to defined roles and gives users or workloads access through their approved role memberships.

Role-Based Training

Training whose scenarios, decisions, and required actions are tailored to a person's actual responsibilities, access, tools, and escalation paths.

Roles

Collections of permissions assigned together to identities to grant access by job function. Roles are a foundational mechanism in IAM, simplifying administration and enabling least privilege at scale.

Root

The conventional Linux or Unix UID 0 superuser identity, whose effective power may still be constrained by capabilities, namespaces, mandatory access controls, mounts, or virtualization.

Root Account

The all-powerful original account of a cloud provider account or tenant. Because it can do anything, including disabling controls, the root account must be locked down, with MFA enforced and day-to-day use avoided.

Root CA

A top-level certificate authority whose self-signed certificate sits at the apex of a PKI hierarchy. Browsers and operating systems ship with trusted root CAs that anchor the chain of trust for all subordinate certificates.

Root Cause Analysis

A review focused on the underlying conditions that allowed a problem to happen.

Root Cause Depth

Root cause depth examines technical, identity, process, observability, staffing, dependency, incentive, and risk-decision conditions beyond the final error or exploited weakness.

Root Cause Verification

Root cause verification determines whether remediation changed the unsafe design, code, configuration, dependency, or process that enabled a finding rather than blocking one observed payload or route.

Root Cause and Access Path

Root cause and access path analysis separates initiating conditions, exploited weaknesses, identity or execution routes, privilege expansion, persistence, command paths, and organizational contributors.

Routing

The process by which packets find their way across networks from source to destination, hop by hop through routers that decide where to send each packet. Foundational to how internetworking works.

Routing Table

A set of destination prefixes, next hops, interfaces, preferences, and metrics used to select where packets should be forwarded.

Routing Tables

Data structures routers use to decide where to forward each packet, mapping destination networks to next hops. Understanding routing tables is foundational to network defense and to investigating traffic paths.

Row-Level Security (RLS)

Row-level security lets a database enforce policies that determine which rows a role can read, insert, update, or delete.

Rubber-Stamping Detection

Rubber-stamping detection identifies review behavior inconsistent with an informed access decision without treating approval rate or elapsed time alone as proof.

Rule Logic Design

Designing the logic of a detection rule, the conditions, thresholds, joins, and exclusions, so it accurately flags malicious activity with manageable false positives and stable behavior over time.

Rule-logic design is the craft of writing the actual conditions inside a detection: which fields, what comparisons, which time windows, what exclusions, how multiple conditions combine. Good logic balances sensitivity, specificity, and maintainability, catches the threat reliably, avoids false positives, and doesn't break when fields or behavior shift slightly. It is a core detection-engineering skill where small choices have big effects on detection quality and analyst load.

Introduced in: Detection Engineering

Examples

Choosing the right time window for a correlation rule.
Adding exclusions to remove a noisy benign case while keeping coverage.
Combining conditions so the rule is sensitive without being noisy.

Detection engineeringrelates_to False Positivesrelates_to Detection Robustnessrelates_to Detection Coveragerelates_to Sequence Detectionrelates_to Sigma Rulesrelates_to Threat to Detectionrelates_to Threshold Detectionrelates_to

Rules of Engagement

Rules of engagement are the detailed constraints and procedures that govern how an authorized security test is executed, communicated, paused, escalated, cleaned up, and evidenced.

Run Key

A Windows registry key whose entries point to programs the OS launches automatically at logon. Run keys are a classic persistence location attackers abuse and defenders inspect.

Runbook

A procedural guide for carrying out a repeatable technical task.

Runbooks

Concrete step-by-step guides for handling specific situations in the SOC, like a particular alert type or routine task. Runbooks make operations consistent and accelerate analyst onboarding.

Runner Isolation

Runner isolation separates workflow execution by trust level and prevents one job from persisting into, observing, or influencing a more privileged job.

Runtime Security

Protecting workloads while they run, watching live process, file, and network behavior on hosts or containers to detect and block malicious activity that bypassed earlier defenses.

Runtime Security Monitoring

Continuously monitoring running workloads for malicious behavior in DevSecOps practice, integrating runtime telemetry with build-time security so the secure SDLC covers what happens after deployment.

S3 Exposure Response

The incident-response approach for exposed S3 buckets (or equivalent object storage): contain the exposure, assess what was accessible, notify as required, and prevent recurrence.