Terminology Index

Glossary

2953 terms

BCDR Program Design

BCDR program design defines how an organization governs business continuity and disaster recovery through scoped services, impact analysis, recovery strategies, plans, exercises, dependencies, ownership, and improvement cycles.

BCDR Program Operations

The ongoing ownership, maintenance, exercising, evidence review, issue tracking, training, and governance that keep continuity and recovery capabilities usable.

BCDR Testing

Authorized exercises and technical tests that collect evidence about continuity decisions, restoration capability, dependencies, timing, communications, and unresolved gaps under stated conditions.

BCDR Testing Prioritization

Selection of continuity and recovery tests according to business consequence, uncertainty, change, dependency concentration, prior failures, obligations, and test safety.

BEC Communication Specifics

The particular communication considerations when responding to business email compromise, such as notifying affected parties, warning recipients of fraudulent messages, and coordinating with finance and partners, while being careful what is said over potentially compromised channels.

BEC Response

The response to business email compromise, where an attacker controls or spoofs a trusted email account to commit fraud. It combines account-compromise containment with stopping fraudulent transactions and notifying affected parties.

BGP

The routing protocol used to exchange reachability information between internet networks.

BIA Governance

The oversight that keeps a business impact analysis accurate and authoritative: who owns it, how its findings are validated and approved, and how often it is refreshed, so recovery priorities reflect the real business.

BIA Output

The deliverables of a business impact analysis: prioritized critical processes, their dependencies, maximum tolerable downtime, and the recovery objectives (RTO and RPO) that drive recovery planning.

BYOK and HYOK

Two cloud encryption key models. Bring Your Own Key (BYOK) lets a customer supply keys that the cloud provider then manages, while Hold Your Own Key (HYOK) keeps keys entirely under the customer's control, never handing them to the provider.

Backup Architecture

The design of how data is backed up, where copies are stored, how often, and how they are protected and isolated, so the organization can recover after data loss, corruption, or a ransomware attack.

Backup Frequency and RPO

The relationship between how often recoverable copies are captured and the approved maximum data-loss objective, accounting for failed jobs, lag, consistency, corruption, and detection delay.

Backup Restore Test

A controlled restoration of selected data or systems that verifies copy usability, required keys and dependencies, procedure accuracy, integrity, timing, and expected function.

Backup Tampering

An attacker technique of deleting, encrypting, or corrupting backups so the victim cannot recover without paying. Modern ransomware deliberately targets backups first to remove the defender's safety net.

Backup Testing

Regularly verifying that backups can actually be restored, by performing test restores rather than assuming backups work. Untested backups frequently fail when needed most, so testing is what makes recovery real.

Backup and Snapshot Security Assessment

Backup and snapshot security assessment evaluates automated and manual copies, images, exports, vaults, retention, immutability, sharing, replication, keys, permissions, deletion, and restore evidence.

Banner Disclosure

When a service openly advertises its software name and version in a connection banner or response header, handing attackers easy reconnaissance about what to exploit. Suppressing or minimizing banners is a basic hardening step.

Baseline Analysis

Establishing what normal activity looks like in an environment so that deviations stand out as worth investigating. In detection and SIEM work, the baseline is the reference against which anomalies are measured.

Baseline Behavior

The normal pattern of activity for a host or process, such as which programs usually run, their typical parent processes, and expected network connections. Knowing it lets defenders recognize when something on a system is abnormal.

On an endpoint, attacks often reveal themselves as deviations: an unexpected child process, a binary running from an odd path, or a service account behaving unusually. Establishing baseline behavior gives defenders the reference they need to spot these anomalies during investigation and hunting.

Introduced in: Operating Systems for Defenders

Examples

Knowing a web server normally never spawns a command shell, so one is suspicious.
Recognizing an executable running from a temp folder as off-baseline.
Spotting a service account suddenly performing interactive logons.

Baseline Analysisrelates_to Parent Processrelates_to Processrelates_to Indicator Pivotrelates_to Executable Pathrelates_to Baseline Analysisrelates_to Container Detection Patternsrelates_to LocalServicerelates_to NetworkServicerelates_to

Baseline and Peer-Group Analysis

Baseline and peer-group analysis compares current behavior with an appropriate history or a genuinely comparable population to identify meaningful deviation.

Bash History

A file that records the shell commands a Linux or Unix user has run. For defenders it is a useful source of evidence about what an attacker or user did on a host, though a savvy attacker may try to clear or disable it.

Bastion Host

A hardened, monitored system placed at a controlled access boundary to mediate administrative or other restricted connections to protected resources.

Bastion Hosts

A hardened, tightly controlled gateway server that administrators connect through to reach systems in a private network, so those systems are never directly exposed. It concentrates and monitors administrative access at one defensible point.

Beaconing

Repeated communications from a compromised or managed endpoint to an external or internal controller at intervals or patterns that may indicate command-and-control but require context.

Beaconing Interval Analysis

Beaconing interval analysis measures the timing between repeated connections to identify unusually regular communication patterns.

Beacons

The periodic check-ins a compromised host makes to an attacker's command-and-control server to receive instructions. Their regular, often-disguised pattern is a key signal defenders hunt for to find hidden footholds.

Behavior Chain Detection

Behavior chain detection correlates ordered events or state changes that together support a security hypothesis more strongly than a single string, process, or indicator.

Behavior-Led Scope Expansion

Behavior-led scope expansion searches for related execution sequences, persistence, discovery, credential access, remote administration, and identity misuse even when concrete indicators differ.

Behavioral Analytic Chains

Behavioral analytic chains connect multiple events or state changes whose ordered relationship is more informative than any single indicator.

Behavioral Anomaly Detection

In identity governance, detecting access behavior that deviates from a user's or peer group's norm, such as accessing systems they never use or acting outside their role, to surface risky or compromised identities.

Behavioral Detection

Detecting threats by what an entity does, its behavior and sequences of actions, rather than by matching known-bad signatures. It catches novel and fileless attacks that signature-based detection misses.

Behavioral Indicators

Observable signs in how people act that reveal the strength of a security culture, such as whether staff report suspicious emails, follow secure practices, or raise near-misses. They show culture in behavior, not just stated attitudes.