Terminology Index

Glossary

2953 terms

Behavioral Operationalization

Turning an abstract description of attacker behavior into something a threat hunter can actually search for, by defining the data sources, queries, and observable traces that the behavior would produce.

Behavioral Pivoting

During an investigation, expanding from one observed behavior to find related malicious activity, asking what else an attacker exhibiting this behavior would likely do, and searching for it. It widens an investigation beyond a single alert.

Behavioral Science

The study of why people act as they do, applied to security to design awareness and culture programs that actually change behavior rather than just delivering information. It explains why people click, comply, or take shortcuts.

Benign True Positive

An alert that correctly fired on the activity it was designed to detect, but where that activity turns out to be legitimate, such as an admin tool used by an authorized administrator. The detection worked; the behavior was simply expected.

Biometric Authentication

Authentication that uses a physical trait such as a fingerprint or face scan.

Birthright Access

Birthright access is a narrow baseline automatically assigned from approved population or attribute rules without an individual request.

Blame Culture

An environment where mistakes lead to punishment and finger-pointing, which makes people hide errors and avoid reporting incidents. It is corrosive to security because it suppresses the very information defenders need.

Blameless Postmortem

A review after an incident that focuses on understanding what happened and why, in terms of systems and processes, rather than assigning fault to individuals. It produces honest analysis and concrete improvements.

Blameless Review

A blameless review examines the conditions, information, incentives, safeguards, and authority that shaped incident actions so people can report what actually happened.

Blast Radius

The amount of damage or access possible if one control or component fails.

Block Cipher

A keyed symmetric primitive that transforms fixed-size data blocks and must be used in a suitable, correctly implemented mode or construction for real messages.

Block Cipher Mode

The method that determines how a block cipher like AES is applied to data longer than a single block, such as CBC, CTR, or GCM. The mode chosen critically affects security, and a poor choice can break confidentiality even with a strong cipher.

Block Ciphers

Symmetric encryption algorithms that encrypt data in fixed-size blocks, such as AES with its 128-bit blocks. They are a fundamental building block of modern encryption when combined with a mode of operation.

Blue Team

The defenders in cybersecurity, the people and functions responsible for protecting systems, detecting attacks, and responding to incidents. It contrasts with the red team, which simulates attackers to test defenses.

The blue team spans security operations, detection engineering, incident response, threat hunting, and forensics, working continuously to prevent, detect, and recover from attacks. The term frames defensive work as a coordinated discipline and is most meaningful in contrast with offensive red-team activity.

Introduced in: Blue Team Operations

Examples

A SOC analyst triaging alerts as part of blue-team operations.
Detection engineers building rules to catch attacker techniques.
Incident responders containing and recovering from a breach.

Security Operations Centerrelates_to Detection engineeringrelates_to Incident Responserelates_to Threat Huntingrelates_to Threat Intelligencerelates_to Coverage Metricsrelates_to Defenderrelates_to Forensic Analystsrelates_to Hybrid SOCrelates_to Incident Responserelates_to Incident Responderrelates_to Detection Engineerrelates_to

Blue Team Mission

The blue team mission is to reduce the likelihood and consequence of harmful activity through observable systems, timely decisions, authorized response, trusted recovery, and validated improvement.

Board Cyber Oversight

Board cyber oversight provides the governing body decision-relevant information about material risks, strategy, resources, incidents, dependencies, assurance, management action, and uncertainty.

Board Oversight

The board of directors' role in overseeing an organization's cybersecurity, setting risk appetite, holding leadership accountable, and ensuring security is governed as a business risk. It places ultimate accountability for cyber risk at the top.

Board Risk Reporting

Communicating the organization's key risks to the board of directors in a clear, decision-focused way, so the board can exercise oversight, set risk appetite, and hold leadership accountable without drowning in technical detail.

Boot Persistence

Attacker techniques that ensure malicious code runs automatically when a system starts up, surviving reboots. By hooking into boot or startup processes, an attacker keeps a foothold even after the machine restarts.

Bot Protection in CIAM

Defenses in customer identity systems against automated abuse such as credential stuffing, fake account creation, and scraping. Because CIAM faces the open internet, distinguishing real users from bots is a core security need.

Bot and Automation Abuse

Bot and automation abuse is scripted misuse of registration, authentication, scraping, messaging, checkout, promotions, inventory, reviews, or APIs beyond authorized behavior.

Breach Documentation Register

A breach documentation register records the facts, effects, assessment, decisions, communications, and remedial action for every personal data breach, including unnotified ones.

Breach Notification Legal Assessment

A breach notification legal assessment determines which entity, jurisdiction, data, people, threshold, trigger, deadline, content, and delivery rules apply to an incident.

Break Glass Account

An emergency account kept for rare situations when normal access methods are unavailable.

Break-Glass Accounts

Break-glass accounts are emergency administrator identities kept independent from normal authentication dependencies so authorized responders can recover access during an outage or lockout.

Break-Glass and Availability

Break-glass and availability controls provide narrow, independently protected, tested access when normal identity, policy, network, or enforcement services are unavailable or unsafe.

Broken Access Control

A web vulnerability where the application fails to properly enforce what an authenticated user is allowed to do, letting them reach data or functions that should be off-limits. It is one of the most common and impactful web weaknesses.

Browser Security Testing

Browser security testing evaluates origins, cookies, cross-site requests, framing, CORS, messaging, storage, service workers, navigation, downloads, and security headers in supported browsers.

Browser Warning

A browser-generated notice that a connection, certificate, download, permission, content, or site behavior violates an expected trust or safety condition and requires investigation.

Browser Warnings

The security alerts a web browser shows when something is wrong with a site's connection or certificate, such as an invalid or expired certificate, or a downgrade from HTTPS. They are a frontline signal that a connection may be unsafe.

Building Framework Mapping

When building a compliance program, mapping the organization's controls to one or more frameworks (like SOC 2, ISO 27001, or NIST) so a single control can satisfy multiple requirements and gaps become visible.

Building GRC Capability

Developing the skills, processes, and maturity that let a person or organization perform governance, risk, and compliance work effectively, from foundational analyst abilities up to a functioning GRC program.