Glossary

Endpoint Hardening

Reducing the attack surface of endpoints, laptops, desktops, and servers, by removing unnecessary software and services, applying secure configurations, enforcing patching, and deploying controls like EDR and disk encryption.

Endpoint Isolation

A containment action that cuts a compromised host off from the network while keeping it accessible to responders, stopping the attacker from spreading or communicating out while preserving the system for investigation.

Endpoint Telemetry

The activity data collected from endpoints, process creation, file and registry changes, network connections, logons, that feeds detection and investigation. It is one of the richest and most important telemetry sources for defenders.

Engineering Security Champions

Developers within engineering teams who take on a security advocacy role, spreading secure practices, providing a local security point of contact, and bridging their team with the security function in a DevSecOps model.

Engineering vs Operations

The distinction between building cloud security capabilities (engineering, automation, guardrails, tooling) and running them day to day (operations, monitoring, response), two complementary modes within the cloud security engineer role.

Enrichment

Adding context to raw events and alerts, such as resolving an IP to a host and owner, tagging asset criticality, or attaching threat intelligence, so analysts can interpret and prioritize them faster and more accurately.

Enterprise Risk Management

A coordinated, organization-wide approach to identifying, assessing, and managing all major risks, financial, operational, strategic, cyber, in one framework, so leadership sees and governs the full risk picture rather than isolated silos.

Entra ID Assessment

Assessing the security of Microsoft Entra ID (the cloud identity service formerly Azure AD), reviewing privileged roles, conditional access, app registrations, MFA coverage, and risky configurations, since it is the front door to Microsoft cloud resources.

Ephemeral Evidence

Evidence in cloud environments that is short-lived and may disappear quickly, such as data on an auto-scaling instance that is terminated, requiring responders to capture it fast before it is gone.

Ephemeral Ports

The short-lived, high-numbered ports an operating system temporarily assigns to the client side of a network connection, used for the duration of that connection and then released. They help defenders interpret which side initiated traffic.

Eradication

Removing the cause of an incident, such as malware, persistence, or unsafe access.

Eradication Verification

Confirming that an attacker and all their footholds, malware, accounts, persistence, have actually been removed from the environment before declaring an incident resolved, rather than assuming eradication succeeded.

Escalation

Handing an alert or incident to a higher tier, specialist, or team when it exceeds an analyst's scope or authority, such as raising a confirmed intrusion to incident response or a senior analyst. It ensures threats reach the right responders.

Escalation Criteria

The defined conditions that determine when an alert or incident should be escalated, such as confirmed compromise, high severity, sensitive assets, or exceeding an analyst's authority, so escalation is consistent rather than guesswork.

Espionage

Attacks motivated by stealing secrets, intellectual property, state, or trade secrets, intelligence, or sensitive data, typically by well-resourced, patient actors like nation-states who prioritize stealth and long-term access over disruption.

Event IDs

Numeric codes that identify specific event types in Windows logs (such as 4624 for a logon), letting defenders search for, filter, and build detections around particular activities recorded by the operating system.

Event Source Security

Securing the event sources and triggers that invoke serverless functions, queues, storage events, API calls, so that functions cannot be invoked maliciously or with attacker-controlled, untrusted input.

Event-Triggered Review

Reviewing and updating a policy in response to a triggering event, a breach, regulatory change, audit finding, or major business shift, rather than waiting for the scheduled review cycle, so policies stay current with reality.

Events

Individual records of something that happened on a system or network, a logon, a connection, a file change, that are logged and analyzed. Events are the raw units of telemetry that detection and investigation are built on.

Evidence Collection

Gathering and preserving the data that supports an investigation, logs, artifacts, screenshots, and records, in a sound, documented way so it accurately reflects what happened and can support decisions or later review.

Evidence Management

The GRC practice of organizing, storing, and maintaining compliance evidence, control proof, logs, records, so it is current, traceable, and readily available for audits, rather than scrambled together at the last minute.

Evidence Practices

The end-to-end practices for handling compliance evidence in a security program, how it is collected, organized, validated, and presented, applied as part of building and running a coherent program in the capstone context.

Evidence Repository

A central, organized store where compliance evidence is kept, control proof, logs, policies, and records, so it is preserved, version-tracked, and easy to retrieve for audits and ongoing compliance.

Evidence Retention

Keeping compliance evidence for the required length of time, set by frameworks, regulations, or audit needs, so it remains available to demonstrate that controls operated over the relevant period, then disposing of it appropriately.

Evidence Strategy

In threat hunting, the plan for what data and evidence a hunt will examine to test its hypothesis, which sources, fields, and time ranges, so the hunt actually has the visibility to confirm or refute what it is looking for.

Evidence Types

The different forms compliance evidence can take, such as configuration exports, logs, screenshots, policies, tickets, and attestations, each suited to proving different kinds of controls. Knowing the types helps gather the right proof per control.

Evidence-Based Assessment

A security analyst practice of grounding every finding in concrete, verifiable evidence rather than assumption, so assessment conclusions are accurate, defensible, and credible to the people who must act on them.

Exception Abuse Patterns

The recurring ways policy exceptions get misused, such as permanent 'temporary' exceptions, stacking exceptions to bypass a control entirely, or using them to avoid rather than manage risk, that undermine policy if left unchecked.

Exception Escalation

Routing a policy exception request to the appropriate level of authority for review and approval based on its risk, so higher-risk exceptions get senior scrutiny rather than being rubber-stamped at a low level.

Exception Process Design

Designing how policy exceptions are requested, reviewed, approved, tracked, and expired, so deviations from policy are managed as deliberate, time-bound, accountable risk decisions rather than uncontrolled loopholes.

Excessive Permissions

A cloud misconfiguration where an identity or resource is granted far more access than it needs, violating least privilege and giving an attacker who compromises it broad reach. It is one of the most common and dangerous cloud weaknesses.