Glossary

HITRUST Cycles

The assessment and certification timelines of the HITRUST framework, including the periodic interim and recertification activities organizations must complete to obtain and maintain HITRUST certification over time.

HKCU

HKEY_CURRENT_USER: the Windows registry hive holding settings for the currently logged-in user. Defenders examine it for per-user persistence and configuration that attackers modify, such as user-level autorun entries.

HKLM

HKEY_LOCAL_MACHINE: the Windows registry hive holding system-wide settings affecting all users. Because changes here are machine-wide and often require privilege, attacker modifications signal significant, system-level persistence or configuration tampering.

HMAC

Hash-based Message Authentication Code: a construction that combines a secret key with a hash function to produce a code verifying both a message's integrity and its authenticity, that it was not altered and came from someone holding the key.

HR-Driven Identity Lifecycle

An HR-driven identity lifecycle converts approved worker-status events into governed joiner, mover, leave, termination, and rehire actions across identity and application systems.

HSTS

HTTP Strict Transport Security: a web security header that tells browsers to only connect to a site over HTTPS, preventing downgrade to insecure HTTP and protecting against certain interception and stripping attacks.

HTTP

HTTP is the protocol browsers and applications use to request and transfer web content.

HTTP Method

The verb in an HTTP request, such as GET, POST, PUT, or DELETE, that indicates the action the client wants to perform. Methods carry security meaning, since some change data and access control must account for which are allowed.

Hacktivist

An actor or group using intrusion, disruption, disclosure, or influence activity to advance an ideological or political cause, with capability and intent varying widely.

Hacktivists

Attackers motivated by a political, social, or ideological cause rather than profit, who use hacking, defacement, leaks, or disruption to make a statement, draw attention, or punish a target they oppose.

Handling Disagreement

Navigating disputes that arise when writing and approving policies, where stakeholders object to requirements or push competing interests, resolving them constructively so the final policy is sound, supported, and actually followed.

Handoff

The transfer of an alert, investigation, or incident from one analyst or shift to another, passing along context and status so work continues smoothly without losing information or momentum.

Hands-On Practice

Learning security skills by doing, through labs, ranges, CTFs, and real tools, rather than only studying theory, building the practical ability and muscle memory an analyst needs to perform effectively.

Hardcoded Key

A cryptographic key embedded in source, an image, a binary, or static configuration, making separation, revocation, rotation, and exposure control difficult.

Hardcoded Keys

Cryptographic keys or secrets embedded directly in source code or configuration, a serious mistake because anyone who can read the code or binary can extract them, defeating the encryption they were meant to provide.

Hardening Guide

A maintained set of risk-based configuration and operational recommendations for reducing unnecessary exposure in a specific technology or service.

Hardening Guides

Authoritative documents that specify secure configuration settings for a system, application, or device, such as CIS Benchmarks and DISA STIGs, giving step-by-step baselines to lock systems down from their insecure defaults.

Hash Function

An algorithm that maps arbitrary-length input to a fixed-length digest and, for cryptographic use, is designed to resist preimage, second-preimage, and collision attacks.

Hash Functions

Algorithms that take input of any size and produce a fixed-size, unique-looking output (a hash), designed so the same input always yields the same hash and it is infeasible to reverse or to find two inputs with the same hash.

Hash Value

The fixed-size output produced by running data through a hash function, a digest that uniquely represents the input. Comparing hash values is how integrity is verified and how files are identified as indicators.

Hashing

The process of running data through a hash function to produce a fixed-size digest, used to verify integrity, identify data, and (with proper protections) store passwords. It is a foundational security primitive.

Heat Map

A visual that uses color to show detection coverage or risk across a grid, commonly an ATT&CK matrix shaded by how well each technique is detected, so gaps and strengths are obvious at a glance.

High-Risk Processing Screening

High-risk processing screening checks a proposal for indicators such as scoring, automated decisions, monitoring, sensitive data, large scale, matching, vulnerability, or innovative technology.

Historical Replay

Testing a new or changed detection against stored historical telemetry to see what it would have caught or missed, validating it without waiting for live activity and revealing its false-positive behavior on real past data.

Homemade Cryptography

Inventing your own cryptographic algorithm or protocol instead of using established, vetted ones, a serious anti-pattern, since custom crypto almost always contains subtle, exploitable flaws that peer-reviewed standards have eliminated.

Honeytoken Accounts

Honeytoken accounts are controlled decoy identities that have no legitimate use or real privilege and produce a high-signal alert when someone authenticates with or materially changes them.

Horizontal Privilege Escalation

A web access-control attack where a user accesses another user's data or actions at the same privilege level, such as viewing someone else's account, by exploiting missing checks that they are the rightful owner.

Host

In a URL, the part identifying the server to connect to, typically a domain name or IP address. It tells the browser where to send the request and is key context when judging whether a request goes where expected.

Host Firewall

A firewall running on an individual device or server.

Hot Lead vs Cold Lead

A triage distinction between evidence requiring time-sensitive action and a lower-urgency clue that can be investigated without the same immediate consequence.

Hot Leads

Promising investigative leads that strongly suggest malicious activity and warrant immediate follow-up, as opposed to cold leads, used by analysts to prioritize where to dig during triage and investigation.