Terminology Index

Glossary

2953 terms

Disaster Recovery

Plans and capabilities for restoring systems after a major disruption.

Discovery

The attacker tactic of exploring a compromised environment to learn about it, enumerating systems, accounts, networks, and defenses, to plan the next moves like lateral movement and privilege escalation.

Discovery and Traffic Mapping

Discovery and traffic mapping correlate inventory, architecture, configuration, network flows, application traces, identity events, target logs, and owner knowledge to understand current resource interactions.

Disk Encryption

Encrypting the contents of a storage device so the data is unreadable without the key, protecting data at rest if a device is lost, stolen, or improperly disposed of. Full-disk encryption is a baseline endpoint hardening control.

Disposition

The decision an analyst records to close out an alert or case, classifying it as a true positive, false positive, benign true positive, or escalation. It is the formal conclusion of triage and creates an accountable record.

Distributed Tracing for Security

Using distributed tracing, which follows a single request across the many services it touches, for security purposes, reconstructing how a request flowed through a microservices system to investigate anomalies and attacks.

Dockerfile Security

Writing container build files (Dockerfiles) securely, using minimal trusted base images, avoiding embedded secrets, running as non-root, and pinning versions, so the images they produce are secure from the start of the supply chain.

Document Lifecycle Governance

Document lifecycle governance controls drafting, review, approval, publication, acknowledgement, training, implementation, evidence, change review, supersession, archival, and withdrawal.

Domain

In a web address, the human-readable name that identifies a site (like example.com), which DNS resolves to a server. It is a core component of a URL and a key piece of context when assessing whether a link or request is trustworthy.

Domain Controller

A server that runs Active Directory and handles authentication and authorization for a Windows domain, validating logins and enforcing policy. Because it holds the keys to the domain, it is one of the most security-critical systems an organization runs.

A domain controller (DC) stores the directory database and authenticates users and computers in an Active Directory domain, issuing the Kerberos tickets that grant access. Compromising a DC effectively means compromising the entire domain, since it holds all credentials and controls policy, so DCs are hardened intensively, tightly access-controlled, and closely monitored. Attacks like DCSync target exactly this central role.

Introduced in: Identity and Access Management, Threat Landscape and Attacker Thinking

Examples

A domain controller authenticating a user's Windows login.
Issuing Kerberos tickets that grant access across the domain.
Treating DC compromise as equivalent to full domain compromise.

Active Directoryrelates_to Directory Servicesrelates_to DCSync Detectionrelates_to Kerberos Ticket Forgery Detectionrelates_to Hybrid Identityrelates_to Identificationrelates_to Directory Servicesrelates_to Kerberosrelates_to

Domain Name System

The distributed naming system that maps domain names and other typed records through resolvers and authoritative servers, with security depending on the queried data and transport.

Dormant Identity Reactivation

Dormant identity reactivation is the use or material change of an identity after an established period without expected activity.

Double Extortion

A ransomware tactic where attackers both encrypt a victim's data and steal a copy, then threaten to leak it publicly, so paying only for decryption is not enough to prevent exposure. It pressures victims even if they have backups.

Drift Detection

Identifying when a system's actual configuration has drifted away from its intended secure baseline, so the deviation can be investigated and corrected before it becomes a vulnerability or compliance gap.

Drift Management

In cloud-native and GitOps systems, the practice of keeping running infrastructure aligned with its declared desired state, detecting when reality diverges from the Git source of truth and reconciling it back automatically.

Dwell Time

The length of time an attacker remains undetected in an environment, from initial compromise to discovery. Shorter dwell time means less opportunity for damage, so reducing it is a key goal of detection and response.

Dynamic API Resolution

Dynamic API resolution locates functions during execution through mechanisms such as library loading, export lookup, API hashing, export-table walking, or manual mapping.

Dynamic Account Provisioning

Dynamic account provisioning creates an identity or credential for a specific approved task or session and removes or revokes it when the authorized window ends.

Dynamic Analysis Methodology

The approach to analyzing malware by running it in a controlled, isolated environment and observing its behavior, what files, processes, registry keys, and network connections it creates, to understand what it does without reading its code.

Dynamic Group Governance

Dynamic group governance controls how source attributes automatically add or remove identities from groups that may grant application, role, or data access.

Dynamic Policy Inputs

Dynamic policy inputs are current subject, identity, authenticator, asset, workload, resource, environment, threat, and activity facts evaluated during an access decision.

ECDH

Elliptic Curve Diffie-Hellman: the elliptic-curve version of the Diffie-Hellman key exchange, letting two parties establish a shared secret efficiently and securely with much smaller keys than traditional Diffie-Hellman.

ECDSA

Elliptic Curve Digital Signature Algorithm: a widely used algorithm for creating digital signatures using elliptic-curve cryptography, providing authenticity and integrity with smaller keys and faster operation than RSA signatures.

EDR

Endpoint Detection and Response: software on endpoints that continuously records activity, detects malicious behavior, and lets responders investigate and act, such as isolating a host, giving deep visibility and control over what happens on each device.

EPSS

The FIRST Exploit Prediction Scoring System estimate that a published CVE will be exploited in the wild in the next 30 days, interpreted with score date and local context.

EPSS Interpretation

EPSS interpretation uses FIRST's daily estimate of the probability that a published CVE will be exploited in the wild in the next 30 days, together with its relative percentile.

EdDSA

Edwards-curve Digital Signature Algorithm: a modern elliptic-curve signature scheme (notably Ed25519) designed for speed, strong security, and resistance to common implementation mistakes that have undermined older signature algorithms.

Egress

Network traffic leaving a network or host, outbound flows toward the internet or another network. Controlling and monitoring egress is key to stopping data exfiltration and command-and-control communication.

Egress Control

Restricting and inspecting outbound traffic from cloud workloads so they can only reach approved destinations, limiting an attacker's ability to exfiltrate data or reach command-and-control if a workload is compromised.

Egress Filtering

Controlling outbound network traffic to limit data loss and attacker movement.

Email Alert

An alert about message authentication, content, link, attachment, sender, mailbox, rule, forwarding, or user-report behavior in an email system.

Email Alerts

SOC alerts generated from email security signals, such as detected phishing, malicious attachments or links, or suspicious sender behavior, which analysts triage to catch one of the most common attack delivery channels.