Glossary

Global Privacy Regulatory Landscape

The worldwide patchwork of privacy laws beyond the GDPR, such as US state laws, and regimes in other regions, that organizations operating across borders must track and reconcile, since requirements differ by jurisdiction.

Golden Image

A pre-configured, hardened base image, of a VM or container, that is built once to a secure standard and reused as the trusted starting point for new workloads, so every instance inherits a known-good, consistent configuration.

Government Intelligence

Threat intelligence produced or shared by government bodies, such as national cybersecurity agencies, providing advisories, indicators, and threat assessments that a SOC can use, often authoritative but sometimes broad or delayed.

Group Policy Hardening

Using Active Directory Group Policy to enforce secure configuration across many Windows systems at once, applying hardened settings, restrictions, and security baselines centrally rather than configuring each machine individually.

Groups

Collections of users (or other identities) managed together in identity systems, so access can be granted to a group once rather than to each member individually, simplifying access management and enabling role-based access.

GuardDuty Defender SCC

The native threat-detection services of the major clouds, AWS GuardDuty, Microsoft Defender for Cloud, and Google Security Command Center, which analyze cloud telemetry to detect threats and misconfigurations across an environment.

Guideline

A non-mandatory document offering recommended practices or advice on how to meet a policy or standard, providing helpful 'how-to' direction without the binding force of a policy or the strict requirements of a standard.

HIPAA

The US Health Insurance Portability and Accountability Act, which sets requirements for protecting the privacy and security of health information, obligating healthcare organizations and their partners to safeguard patient data.

HIPAA Cloud

Meeting HIPAA requirements when health information is processed or stored in the cloud, ensuring PHI is safeguarded through the shared-responsibility model, business-associate agreements, and appropriate cloud controls.

HIPAA Cloud Architecture

Designing a cloud architecture that meets HIPAA's safeguards for protected health information, with the segmentation, encryption, access control, and logging needed to handle PHI compliantly built into the design.

HIPAA Security Rule

The part of HIPAA that sets required safeguards, administrative, physical, and technical, for protecting electronic protected health information, mapped to controls when implementing HIPAA in a framework context.

HITRUST CSF

A comprehensive, certifiable security framework widely used in healthcare that harmonizes many standards and regulations (including HIPAA) into one set of prescriptive, assessable controls, so one certification can demonstrate broad compliance.

HITRUST Cycles

The assessment and certification timelines of the HITRUST framework, including the periodic interim and recertification activities organizations must complete to obtain and maintain HITRUST certification over time.

HKCU

HKEY_CURRENT_USER: the Windows registry hive holding settings for the currently logged-in user. Defenders examine it for per-user persistence and configuration that attackers modify, such as user-level autorun entries.

HKLM

HKEY_LOCAL_MACHINE: the Windows registry hive holding system-wide settings affecting all users. Because changes here are machine-wide and often require privilege, attacker modifications signal significant, system-level persistence or configuration tampering.

HMAC

Hash-based Message Authentication Code: a construction that combines a secret key with a hash function to produce a code verifying both a message's integrity and its authenticity, that it was not altered and came from someone holding the key.

HSTS

HTTP Strict Transport Security: a web security header that tells browsers to only connect to a site over HTTPS, preventing downgrade to insecure HTTP and protecting against certain interception and stripping attacks.

HTTP

HTTP is the protocol browsers and applications use to request and transfer web content.

HTTP Method

The verb in an HTTP request, such as GET, POST, PUT, or DELETE, that indicates the action the client wants to perform. Methods carry security meaning, since some change data and access control must account for which are allowed.

HTTPS

HTTPS is HTTP protected with TLS so web traffic is encrypted and the server can prove its identity.

Hacktivists

Attackers motivated by a political, social, or ideological cause rather than profit, who use hacking, defacement, leaks, or disruption to make a statement, draw attention, or punish a target they oppose.

Handling Disagreement

Navigating disputes that arise when writing and approving policies, where stakeholders object to requirements or push competing interests, resolving them constructively so the final policy is sound, supported, and actually followed.

Handoff

The transfer of an alert, investigation, or incident from one analyst or shift to another, passing along context and status so work continues smoothly without losing information or momentum.

Hands-On Practice

Learning security skills by doing, through labs, ranges, CTFs, and real tools, rather than only studying theory, building the practical ability and muscle memory an analyst needs to perform effectively.

Hardcoded Keys

Cryptographic keys or secrets embedded directly in source code or configuration, a serious mistake because anyone who can read the code or binary can extract them, defeating the encryption they were meant to provide.

Hardening Guides

Authoritative documents that specify secure configuration settings for a system, application, or device, such as CIS Benchmarks and DISA STIGs, giving step-by-step baselines to lock systems down from their insecure defaults.

Hash Functions

Algorithms that take input of any size and produce a fixed-size, unique-looking output (a hash), designed so the same input always yields the same hash and it is infeasible to reverse or to find two inputs with the same hash.

Hash Value

The fixed-size output produced by running data through a hash function, a digest that uniquely represents the input. Comparing hash values is how integrity is verified and how files are identified as indicators.

Hashing

The process of running data through a hash function to produce a fixed-size digest, used to verify integrity, identify data, and (with proper protections) store passwords. It is a foundational security primitive.

Heat Map

A visual that uses color to show detection coverage or risk across a grid, commonly an ATT&CK matrix shaded by how well each technique is detected, so gaps and strengths are obvious at a glance.

Historical Replay

Testing a new or changed detection against stored historical telemetry to see what it would have caught or missed, validating it without waiting for live activity and revealing its false-positive behavior on real past data.