Glossary

A Record

An A record is a DNS record that maps a domain name to an IPv4 address.

AAAA Record

An AAAA record is a DNS record that maps a domain name to an IPv6 address.

ABAC

Attribute-based access control uses attributes such as user role, device state, location, data sensitivity, or request context to decide whether access should be allowed.

AES

The Advanced Encryption Standard, the most widely used symmetric encryption algorithm, meaning the same key encrypts and decrypts data. It protects data at rest and in transit and is considered secure when used correctly with key sizes of 128, 192, or 256 bits.

ARP

The Address Resolution Protocol, which maps a local IP address to the hardware (MAC) address needed to deliver a frame on a local network. Because it trusts unsolicited replies, it can be abused for spoofing, which is why defenders monitor it.

Acceptable Use Policy

An acceptable use policy explains how people may use company systems, networks, devices, accounts, and data.

Access Reviews

Access reviews are periodic checks of who has access to systems, applications, or data.

Access Token

An access token is a short-lived credential that proves an application or user has been authorized to access a resource.

Account

An account is a digital identity or container used to access systems, cloud resources, applications, or services.

Account Enumeration

A weakness where an application reveals whether a given username, email, or account exists, often through different error messages or response timing on login, registration, or password-reset pages. Attackers use it to build lists of valid accounts to target.

Accountability

The ability to connect actions to a specific identity or responsible party.

Active Directory

A directory service commonly used to manage Windows identities, devices, and policy.

Administrative Controls

Security measures based on policies, procedures, and people rather than technology, such as security awareness training, access review processes, hiring background checks, and acceptable-use policies. They direct how people should behave to keep systems safe.

Administrator

A highly privileged user who can change important system or application settings.

Alert Fatigue

Reduced attention caused by too many low-value or repetitive alerts.

Alert Volume

The total number of alerts a monitoring system generates over time. When volume outpaces the team's capacity, important alerts get buried and analysts experience fatigue, so managing volume is central to effective detection.

Allowlist Validation

An input-handling defense that checks user input against a list of explicitly permitted values or patterns and rejects everything else, rather than trying to block known-bad input. It is the safer default for validating untrusted data.

Anomaly Detection

Finding activity that differs from an expected pattern or baseline.

Application Allowlisting

An endpoint control that allows only explicitly approved programs to run and blocks everything else, sharply reducing what malware can execute even if it lands on a machine.

Application Hardening

Configuring an application and its supporting services to reduce their attack surface: disabling unused features, removing default accounts and sample content, suppressing version banners, and applying secure settings and patches.

Application Logs

Records produced by applications themselves about their own activity, such as logins, transactions, errors, and administrative actions. They give defenders visibility into behavior that network or OS logs cannot show.

Argon2

A modern password-hashing algorithm designed to be slow and memory-intensive, making large-scale password cracking expensive even on specialized hardware. It is a current recommended choice for storing user passwords securely.

Assets

Assets are systems, data, accounts, applications, devices, or services that an organization needs to protect.

Asymmetric Encryption

Encryption that uses a public key and a private key instead of one shared key.

Atomic Red Team

An open library of small, focused tests that each reproduce a single attacker technique mapped to MITRE ATT&CK, letting defenders safely check whether their detections catch that specific behavior.

Attack Patterns

Recurring sequences of attacker behavior that show up across many intrusions, such as phishing for initial access followed by persistence and data theft. Recognizing them helps defenders anticipate an attacker's next move.

Attack Surface

Attack surface is the set of places where an attacker could try to enter, influence, or abuse a system.

Attack Surface Reduction

Shrinking the number of ways an attacker could get in by removing or disabling unnecessary services, features, accounts, and exposure, so there is simply less to attack and defend.

Attribute-Based Access Control

An access model that uses attributes such as role, location, device, or sensitivity to make decisions.

Attribution

The effort to determine who is behind an attack, such as a specific group or nation-state, based on tools, infrastructure, and behavior. It is useful for context but notoriously uncertain and easy to spoof.

Audit Trails

Records that capture who performed which actions and when, providing the accountability that lets defenders trace events back to a responsible identity. They are foundational to investigation and to proving what happened.