Terminology Index

Glossary

1801 terms

Showing 1-32 of 1801 terms

72-Hour Notification

A 72-hour notification is a regulatory deadline that requires an organization to report certain security or privacy incidents within 72 hours of becoming aware of them.

A Record

An A record is a DNS record that maps a domain name to an IPv4 address.

AAAA Record

An AAAA record is a DNS record that maps a domain name to an IPv6 address.

ABAC

Attribute-based access control uses attributes such as user role, device state, location, data sensitivity, or request context to decide whether access should be allowed.

AD Attack Surfaces

The parts of an Active Directory environment that an attacker can target or abuse, including privileged accounts, service accounts and their tickets, group memberships, domain controllers, trusts, and misconfigured permissions.

AD Compromise Response

The specialized response to an incident where an attacker has gained control of Active Directory itself, which often means assuming every credential and trust is suspect and may require rebuilding or restoring the directory from a clean state.

AD Privileged Account Hardening

Securing the high-power accounts in Active Directory, such as Domain Admins and service accounts, by limiting their number and rights, restricting where they can log in, enforcing strong authentication, and monitoring their use closely.

AES

The Advanced Encryption Standard, the most widely used symmetric encryption algorithm, meaning the same key encrypts and decrypts data. It protects data at rest and in transit and is considered secure when used correctly with key sizes of 128, 192, or 256 bits.

AI and Compliance

The compliance questions raised when organizations use AI services in the cloud, including how training data is handled, where it is processed, whether use meets emerging AI regulations, and how to demonstrate accountability for automated decisions.

AI in Cloud Architecture

The design considerations for safely incorporating AI and machine-learning services into a cloud security architecture, covering where AI workloads sit in the network, how their data is protected, and how their access and logging fit existing controls.

API Gateway Security

Securing the API gateway, the entry point that sits in front of backend services and APIs, by enforcing authentication, authorization, rate limiting, and input checks centrally so individual services do not each have to.

API Server Security

Protecting the Kubernetes API server, the central control plane component that every cluster action passes through. Because it governs the whole cluster, hardening its authentication, authorization, and exposure is critical.

ARP

The Address Resolution Protocol, which maps a local IP address to the hardware (MAC) address needed to deliver a frame on a local network. Because it trusts unsolicited replies, it can be abused for spoofing, which is why defenders monitor it.

ATT&CK Coverage Mapping

Charting an organization's detections against the MITRE ATT&CK matrix to see which adversary techniques are covered, which are weakly covered, and which are blind spots, so detection effort can be focused.

ATT&CK Navigator

A free tool for working with the MITRE ATT&CK matrix visually, letting defenders annotate, color, and layer techniques to track detection coverage, map threat-actor behavior, or plan detection work.

AWS CloudTrail Investigation

Using AWS CloudTrail logs, which record API calls and account activity, to investigate a cloud incident: who did what, from where, and when. It is the primary evidence source for AWS control-plane actions.

AWS GuardDuty

An AWS threat-detection service that analyzes account, network, and DNS activity to flag suspicious behavior, such as compromised credentials, cryptomining, or reconnaissance, without needing agents on workloads.

AWS IAM Assessment Priority

Treating identity and access management as the first and highest-priority area when assessing AWS security, because IAM misconfigurations, like over-permissioned roles or exposed keys, are the most common path to full account compromise.

AWS Landing Zone Frameworks

Prescriptive blueprints, such as AWS Control Tower and the multi-account framework, for setting up a secure, scalable AWS foundation with baked-in account structure, guardrails, logging, and identity from the start.

AWS Network Architecture

The design of networking in AWS, VPCs, subnets, route tables, gateways, security groups, and connectivity, arranged to segment workloads, control traffic, and limit exposure as part of a secure cloud foundation.

Acceptable Use Policy

An acceptable use policy explains how people may use company systems, networks, devices, accounts, and data.

Access Certification

Access certification is a formal review where managers, system owners, or data owners confirm whether users should keep specific access.

Access Certification Campaign Design

Access certification campaign design is the process of deciding what access will be reviewed, who will approve it, how exceptions are handled, and how results will be tracked.

Access Review Implementation

Access review implementation is the practical work of running access reviews, collecting decisions, applying removals, and keeping evidence.

Access Reviews

Access reviews are periodic checks of who has access to systems, applications, or data.

Access Token

An access token is a short-lived credential that proves an application or user has been authorized to access a resource.

Account

An account is a digital identity or container used to access systems, cloud resources, applications, or services.

Account Compromise Response

The set of actions a team takes once it confirms an attacker controls a legitimate user or service account, including locking the account, revoking sessions, resetting credentials, and tracing what the attacker did while logged in.

Because the attacker is using valid credentials, response focuses on cutting off access without destroying evidence and on reviewing the account's activity (logins, mailbox rules, data access) to scope the damage. The same playbook applies whether the account belongs to a person, a service, or an automation, though cloud and email accounts often need extra steps like revoking OAuth tokens.

Introduced in: Incident Response Operations

Examples

Disabling a finance user's account after impossible-travel logins, then revoking all active sessions.
Resetting a service account password and rotating its API keys after it appears in suspicious authentication logs.
Reviewing a compromised mailbox for hidden forwarding rules added by the attacker.

soc intermediate account-compromise-response

No related terms linked yet.

Account Disabling

A containment action that turns off a user or service account so it can no longer authenticate, cutting off an attacker's access while preserving the account and its logs for investigation.

Account Enumeration

A weakness where an application reveals whether a given username, email, or account exists, often through different error messages or response timing on login, registration, or password-reset pages. Attackers use it to build lists of valid accounts to target.

Account Merging

In customer identity systems, the process of combining two or more identity records that belong to the same real person into a single account, for example when a user who signed up with a password later logs in with Google. Done carelessly, it can let one identity take over another.

Account/Subscription Strategy

An account and subscription strategy defines how cloud accounts or subscriptions are separated, governed, and assigned so ownership, billing, and security boundaries stay clear.