Glossary

Awareness Metrics

Measurements of how well staff understand and follow security policies, such as training completion, phishing-test results, or policy acknowledgment rates. They show whether a policy is actually changing behavior, not just existing on paper.

Awareness Program Applied

An applied awareness program turns security guidance into practical habits through role-aware training, reminders, reporting paths, and reinforcement.

Azure AD Privileged Hardening

Securing the high-privilege roles and identities in Microsoft Entra ID (Azure AD), such as Global Administrators, by limiting their number, enforcing strong and phishing-resistant MFA, and using just-in-time elevation through Privileged Identity Management.

Azure Assessment Scope

Defining what is included when assessing the security of an Azure environment, the subscriptions, resource groups, identities, and services to examine, so the assessment is focused and its coverage is clear.

Azure Incident Investigation

Investigating a security incident in Microsoft Azure using its logs and signals, such as Entra ID sign-in logs, activity logs, and Microsoft Defender alerts, to determine what an attacker did and how far they reached.

Azure Landing Zone

Microsoft's prescriptive blueprint for a secure, scalable Azure foundation, defining management group hierarchy, subscriptions, policies, identity, networking, and logging so workloads land in a governed environment by default.

Azure Network Architecture

The design of networking in Azure, virtual networks, subnets, network security groups, peering, gateways, and firewalls, arranged to segment workloads, control traffic, and limit exposure within a secure cloud foundation.

Azure Resource Assessment

Examining the security configuration of individual Azure resources, such as virtual machines, databases, storage, and networking, to find misconfigurations like excessive exposure, missing encryption, or weak access settings.

Azure Storage Assessment

Evaluating the security of Azure storage accounts and blobs, checking for public exposure, weak access controls, missing encryption, and overly permissive shared keys or SAS tokens that could leak data.

Azure VM Forensics

Collecting and analyzing forensic evidence from an Azure virtual machine during an incident, such as disk snapshots and memory, in a way that preserves integrity so the VM's activity can be examined without altering evidence.

BC/DR Applied

Putting business continuity and disaster recovery into practice within a real security program: producing the plans, recovery objectives, and tested procedures rather than treating BC/DR as a theoretical document.

BC/DR Metrics

The measurements used to judge business continuity and disaster recovery readiness, most centrally recovery time objective (RTO) and recovery point objective (RPO), plus test results and plan coverage. They show whether recovery capability matches what the business needs.

BC/DR Plan Structure

The standard components a business continuity and disaster recovery plan should contain, such as scope, roles, recovery procedures, communication steps, and recovery objectives, organized so people can actually follow it under pressure.

BC/DR Policy

The governing document that mandates business continuity and disaster recovery: who is responsible, what must be planned and tested, and the standards the program must meet. It gives BC/DR organizational authority and consistency.

BC/DR Program Design

Architecting an end-to-end business continuity and disaster recovery program: the governance, business impact analysis, recovery strategies, plans, and testing that together let an organization withstand and recover from disruptions.

BC/DR Program Operations

The ongoing work of keeping a business continuity and disaster recovery program effective: maintaining plans, running tests, updating after changes, tracking metrics, and ensuring people stay trained and ready.

BC/DR Testing

Exercising business continuity and disaster recovery plans to confirm they actually work, ranging from tabletop walkthroughs to full failover drills. Testing reveals gaps before a real disruption does.

BEC Communication Specifics

The particular communication considerations when responding to business email compromise, such as notifying affected parties, warning recipients of fraudulent messages, and coordinating with finance and partners, while being careful what is said over potentially compromised channels.

BEC Response

The response to business email compromise, where an attacker controls or spoofs a trusted email account to commit fraud. It combines account-compromise containment with stopping fraudulent transactions and notifying affected parties.

BGP

The routing protocol used to exchange reachability information between internet networks.

BIA Governance

The oversight that keeps a business impact analysis accurate and authoritative: who owns it, how its findings are validated and approved, and how often it is refreshed, so recovery priorities reflect the real business.

BIA Output

The deliverables of a business impact analysis: prioritized critical processes, their dependencies, maximum tolerable downtime, and the recovery objectives (RTO and RPO) that drive recovery planning.

BYOK and HYOK

Two cloud encryption key models. Bring Your Own Key (BYOK) lets a customer supply keys that the cloud provider then manages, while Hold Your Own Key (HYOK) keeps keys entirely under the customer's control, never handing them to the provider.

Backup Architecture

The design of how data is backed up, where copies are stored, how often, and how they are protected and isolated, so the organization can recover after data loss, corruption, or a ransomware attack.

Backup Tampering

An attacker technique of deleting, encrypting, or corrupting backups so the victim cannot recover without paying. Modern ransomware deliberately targets backups first to remove the defender's safety net.

Backup Testing

Regularly verifying that backups can actually be restored, by performing test restores rather than assuming backups work. Untested backups frequently fail when needed most, so testing is what makes recovery real.

Banner Disclosure

When a service openly advertises its software name and version in a connection banner or response header, handing attackers easy reconnaissance about what to exploit. Suppressing or minimizing banners is a basic hardening step.

Baseline Analysis

Establishing what normal activity looks like in an environment so that deviations stand out as worth investigating. In detection and SIEM work, the baseline is the reference against which anomalies are measured.

Baseline Behavior

The normal pattern of activity for a host or process, such as which programs usually run, their typical parent processes, and expected network connections. Knowing it lets defenders recognize when something on a system is abnormal.

Bash History

A file that records the shell commands a Linux or Unix user has run. For defenders it is a useful source of evidence about what an attacker or user did on a host, though a savvy attacker may try to clear or disable it.

Bastion Hosts

A hardened, tightly controlled gateway server that administrators connect through to reach systems in a private network, so those systems are never directly exposed. It concentrates and monitors administrative access at one defensible point.