Glossary

Data Subject Request Identity Verification

Data subject request identity verification confirms that a requester is entitled to access, correct, port, restrict, object to, or delete relevant personal data without collecting excessive new evidence.

Data Subject Rights Portfolio

The full set of rights that privacy laws grant individuals over their personal data, such as access, correction, deletion, portability, and objection, that an organization must be able to recognize and fulfill.

Data at Rest

Data stored on disk, in databases, backups, or other storage systems.

Data in Transit

Data moving across a network, between systems, services, or users, where it is exposed to interception and tampering. Protecting it, primarily with encryption like TLS, is one of the core states of data protection.

Data in Use

Data actively being processed in memory or by an application, where it is typically decrypted and therefore exposed. It is the hardest of the three data states to protect, addressed by emerging techniques like confidential computing.

Data-Centric Access Policy

Data-centric access policy evaluates data identity, classification, owner, subject or workload, purpose, operation, environment, jurisdiction, session, and obligations.

Data-Driven Hunting

A threat-hunting approach that starts from the data itself, applying analytical techniques like frequency analysis, stack counting, and long-tail analysis to large datasets to surface anomalies worth investigating, rather than starting from a known threat.

Day-to-Day GRC Work

The recurring practical tasks of a governance, risk, and compliance analyst, maintaining controls and evidence, running risk assessments, mapping and testing controls, tracking findings, and communicating status, that keep a GRC program operating.

Decision Authority

Decision authority identifies the person or role permitted to approve a defined incident action within stated limits.

Decision Context

Decision context is the accurate subject, access-path, resource, entitlement, purpose, history, ownership, usage, conflict, risk, expiry, and removal-impact information available to a reviewer.

Declarative Infrastructure

Defining infrastructure by describing the desired end state in code, and letting tooling make reality match, rather than scripting step-by-step changes. It is foundational to cloud-native systems and enables consistent, auditable, self-correcting configuration.

Default Configuration

The vendor- or platform-supplied settings present before an organization applies its own risk-based hardening, integration, monitoring, and operational requirements.

Default Configurations

The out-of-the-box settings software and systems ship with, which prioritize ease of setup over security and often leave unnecessary features, default accounts, and permissive options enabled. Replacing them is a first step in hardening.

Default Deny

A security principle of blocking everything by default and explicitly allowing only what is needed, applied to firewalls, access control, and network policy. It fails safe, since anything not expressly permitted is denied.

Default Gateway

The network device, usually a router, that a host sends traffic to when the destination is outside its own local network. It is the exit point from a subnet to the wider network and internet.

Defender

Anyone whose role is to protect systems, networks, and data from attack, spanning SOC analysts, incident responders, detection engineers, and security architects. The defender's perspective frames how security work is approached.

Defense Cost Asymmetry

The imbalance between attacker and defender effort: a defender must secure every possible way in, while an attacker needs to find just one. Hardening aims to flip this, raising the attacker's cost relative to the defender's.

Defense Evasion

The attacker tactic of avoiding detection and defeating security controls, such as disabling logging, obfuscating code, using legitimate tools, or hiding in normal activity, so the intrusion can continue unnoticed.

Defense Evasion Hunts

Threat hunts that specifically look for signs attackers are hiding or defeating defenses, such as logging gaps, disabled security tools, obfuscation, or masquerading, since evasion itself leaves detectable traces.

Defense Evolution

The way cloud-native security defenses have developed to keep pace with the architecture's changes, shifting from perimeter and host controls toward identity, policy-as-code, admission control, and runtime observability suited to containers and orchestration.

Defense Impairment

An ATT&CK Enterprise tactic describing the adversary goal of degrading security mechanisms, telemetry pipelines, or defensive tools so prevention, visibility, or response becomes less reliable.

Defense in Depth

Defense in depth uses multiple layers of controls so one failure does not leave an asset fully exposed.

Defensive Engineering

Defensive engineering builds and operates reliable telemetry, detection, case, identity, endpoint, network, evidence, response, automation, and health-monitoring capabilities.

Dependency Exception Management

Dependency exception management records and governs a vulnerability or component condition that cannot be remediated immediately.

Deployment Authorization

Controlling what is allowed to be deployed into a cloud-native environment, ensuring only approved, signed, and policy-compliant workloads run, typically enforced at deploy time through admission control and signature verification.

Deployment Verification Policy

A deployment verification policy defines the registry, digest, provenance identity, source, workflow, attestations, vulnerability status, configuration, and exception conditions required at admission.

Deprovisioning

Removing a user's or entity's access when it is no longer needed, such as when an employee leaves or changes roles, by disabling accounts and revoking permissions. Prompt deprovisioning prevents orphaned access from becoming a security gap.

Design Risk Documentation

Design risk documentation explains an unsafe assumption or missing control, the affected components and data, credible threat path, existing safeguards, business impact, evidence, uncertainty, and feasible treatment options.

Detect Respond Recover

Detect, Respond, and Recover are the connected CSF 2.0 functions that identify and analyze possible incidents, coordinate and mitigate response, and restore trusted operations.

Detection Automation

Automating cloud detection and the response to it, so that suspicious activity is identified and acted on, alerting, enriching, or even containing, without waiting for manual intervention, reducing the time attackers have to operate.

Detection Backlog

The prioritized list of detections a detection-engineering team intends to build or improve, fed by coverage gaps, threat intelligence, hunt findings, and SOC feedback. It turns scattered detection needs into managed, prioritized work.