Glossary

Analytical Tradecraft

The professional standards intelligence analysts use to produce sound, trustworthy assessments: distinguishing fact from inference, expressing confidence honestly, considering alternatives, and sourcing claims clearly.

Annual Review Cycle

A scheduled, recurring review of security policies, typically yearly, to confirm each one is still accurate, relevant, and aligned with current risks and regulations, updating or retiring those that are out of date.

Anomaly Detection

Finding activity that differs from an expected pattern or baseline.

App Registration Security

Securing application registrations in Microsoft Entra ID (Azure AD), the entries that let apps authenticate and request permissions. Over-permissioned or stale registrations and their secrets are a common cloud-identity attack path.

Application Allowlisting

An endpoint control that allows only explicitly approved programs to run and blocks everything else, sharply reducing what malware can execute even if it lands on a machine.

Application Hardening

Configuring an application and its supporting services to reduce their attack surface: disabling unused features, removing default accounts and sample content, suppressing version banners, and applying secure settings and patches.

Application Logs

Records produced by applications themselves about their own activity, such as logins, transactions, errors, and administrative actions. They give defenders visibility into behavior that network or OS logs cannot show.

Approval Process

The defined steps and sign-offs a security policy must pass before it becomes official, identifying who reviews, who approves, and how disagreements are resolved, so policies carry genuine authority.

Architecture Decision Records

Short documents that capture a significant design decision, the options considered, the choice made, and the reasoning behind it. In cloud security architecture they preserve why controls were designed a certain way.

Architecture Finding Communication

Conveying the results of a security architecture review so stakeholders understand each design weakness, why it matters, and what to change, adjusting depth and framing for technical teams versus leadership.

Architecture Findings

The weaknesses identified during a security architecture review, such as missing trust boundaries, weak authentication between components, or single points of failure, that stem from how a system is designed rather than from a single bug.

Architecture Review Framework

A structured approach for assessing the security of a system's design, defining how reviews are scoped, what areas to examine, how findings are documented and prioritized, and how remediation is verified, so reviews are thorough and repeatable.

Architecture Review Methodology

The defined process for reviewing a system's security architecture from start to finish: setting scope, gathering design information, applying threat modeling, identifying findings, and communicating recommendations.

Argon2

A modern password-hashing algorithm designed to be slow and memory-intensive, making large-scale password cracking expensive even on specialized hardware. It is a current recommended choice for storing user passwords securely.

Assembly for Analysts

A working familiarity with assembly language so a malware analyst can read disassembled code and understand what a sample does at the instruction level when higher-level clues are missing or obfuscated.

Assessment Challenges

The recurring difficulties that arise during security assessments, such as incomplete information, limited access, time pressure, scope disputes, and resistance from the team being assessed, that an assessor must navigate to produce useful results.

Assessment Kickoff

The opening of a security assessment where the assessor and client agree on scope, goals, timing, points of contact, and rules of engagement, setting expectations so the rest of the work runs smoothly.

Assessment Methodology

A structured, repeatable way for a security analyst to assess a system: planning the work, examining it systematically, validating findings with evidence, and communicating results, so assessments are consistent rather than ad-hoc.

Assessment Planning

The preparation that precedes a security assessment: clarifying objectives and scope, identifying targets and constraints, scheduling, and gathering the access and information needed so the assessment runs efficiently.

Assessment Report Quality

The qualities that make a security assessment report useful: clear findings tied to real risk, actionable recommendations, appropriate prioritization, accurate evidence, and writing pitched to the intended audience.

Assessment Types

The different forms a security or control assessment can take, such as control assessments, vulnerability assessments, maturity assessments, and audits, each with its own purpose, rigor, and intended audience.

Assessment vs Audit

The distinction between an assessment, which evaluates and advises on security to drive improvement, and an audit, which independently verifies against defined criteria to provide formal assurance. They differ in independence, rigor, and purpose.

Asset Inventory for VM

A complete, current list of the systems and software in scope for vulnerability management. Without knowing what exists, scanning misses assets and vulnerabilities go unmanaged, so the inventory is the foundation of the whole program.

Asset-Based Identification

A risk identification approach that starts from the organization's important assets, such as systems, data, and services, and asks what threatens each one. It anchors risk discovery in what actually matters to protect.

Assets

Assets are systems, data, accounts, applications, devices, or services that an organization needs to protect.

Asymmetric Encryption

Encryption that uses a public key and a private key instead of one shared key.

Atomic Red Team

An open library of small, focused tests that each reproduce a single attacker technique mapped to MITRE ATT&CK, letting defenders safely check whether their detections catch that specific behavior.

Atomic Tests

Small, single-technique tests that reproduce one specific attacker behavior so a detection engineer can confirm whether a rule detects it and what telemetry it produces.

Attack Patterns

Recurring sequences of attacker behavior that show up across many intrusions, such as phishing for initial access followed by persistence and data theft. Recognizing them helps defenders anticipate an attacker's next move.

Attack Surface

Attack surface is the set of places where an attacker could try to enter, influence, or abuse a system.

Attack Surface Reduction

Shrinking the number of ways an attacker could get in by removing or disabling unnecessary services, features, accounts, and exposure, so there is simply less to attack and defend.