Glossary

Intelligence in Hunting

Using threat intelligence to drive threat hunting, letting knowledge of adversaries and their techniques generate hunt hypotheses and focus hunts on the threats most likely to target the organization.

Intelligence in IR

Applying threat intelligence during incident response, using knowledge of adversaries and their TTPs to understand an incident, anticipate the attacker's next moves, and respond more effectively.

Intelligence in Triage

Using threat intelligence during alert triage, enriching alerts with intelligence about indicators, actors, and techniques so analysts can judge severity and prioritize faster and more accurately.

Intelligence-Driven Hunting

A hunting approach that starts from threat intelligence, using knowledge of a specific adversary, campaign, or technique to drive a focused hunt for that threat in the environment, contrasted with data-driven hunting.

Intermediate CA

A certificate authority that sits between the trusted root CA and end-entity certificates in a chain of trust. Roots sign intermediates, which sign certificates, so the root's key can stay offline and protected.

Internal Audit

An independent, in-house function that examines an organization's controls, risks, and processes and reports assurance to leadership and the board, helping verify that governance and controls actually work, framed here as a GRC partner.

Internal Audit Career

A career in internal audit, progressing from staff auditor through senior, manager, and audit leadership (such as chief audit executive), building independent assurance skills across an organization's risks and controls.

Internal Audit Function

The organizational unit that performs internal audit, its people, structure, mandate, and processes, providing independent assurance over controls, risk, and governance to management and the board.

Internal Intelligence

Threat intelligence derived from an organization's own data, its incidents, alerts, logs, and observed attacks, which is highly relevant because it reflects the threats actually targeting that specific environment.

Internal Intelligence Production

The process of generating threat intelligence from an organization's own operations, systematically capturing indicators, TTPs, and lessons from incidents and telemetry and turning them into reusable, shareable intelligence.

Internal Stakeholder Communication

Communicating with internal parties during an incident, IT, affected business units, leadership, legal, and staff, keeping the right people informed and coordinated so the organization responds as one.

Internet Exposure

The degree to which an organization's systems and services are reachable from the public internet, a primary attack surface, since anything exposed can be discovered and attacked, so minimizing exposure is core to hardening.

Investigation

A structured review of evidence to determine what happened and what to do next.

Investigation Expansion

Broadening an investigation as new leads emerge, following indicators and behaviors to additional systems, accounts, and activity, so the full scope of an incident is uncovered rather than just the initial alert.

Investigation Notes

The contemporaneous record an analyst keeps during an investigation, what was checked, found, and concluded, so the work is documented, defensible, shareable in handoffs, and useful for review and lessons learned.

Investigation Scope

The defined boundaries of an investigation, which systems, accounts, time range, and questions it covers, kept deliberate so the analyst neither misses relevant activity nor wanders into unbounded, unfocused effort.

Isolation

Separating processes, users, or systems so they cannot interfere with or access one another, an operating-system and security principle that limits how far a compromise can spread and what a process can reach.

Istio

A popular service mesh for Kubernetes that manages and secures communication between microservices, providing mutual TLS, fine-grained authorization, and traffic control without changing application code.

JWT

JSON Web Token: a compact, self-contained token format that carries claims (such as identity and permissions) in a signed, and optionally encrypted, structure, widely used for authentication and authorization in web and API systems.

Joiner-Mover-Leaver

The model describing the three key transitions in the identity lifecycle, joining (onboarding and provisioning access), moving (role changes and access adjustment), and leaving (deprovisioning), that access management must handle reliably.

Journalctl

The command-line tool for querying the systemd journal on Linux, the centralized log of system and service events. Defenders use it to investigate activity, service behavior, and signs of compromise on Linux hosts.

Jump Servers

Hardened intermediary hosts that administrators must connect through to reach sensitive systems, concentrating and controlling administrative access so it can be monitored, restricted, and kept off the general network.

Just Culture

An organizational culture that responds to mistakes by learning rather than blaming, distinguishing honest error from recklessness, so people report incidents and problems openly instead of hiding them out of fear.

Just-In-Time Access

Temporary access granted only when needed and removed afterward.

Just-in-Time Learning

Delivering security education at the moment it is relevant, such as a brief prompt when a risky action occurs, rather than only in scheduled training, so guidance lands when it is most likely to change behavior.

Just-in-Time Privileged Access

Granting privileged access only for the moment it is needed and automatically revoking it afterward, rather than leaving standing admin rights, so the window an attacker could abuse privileged accounts is minimized.

KPIs

Key performance indicators: metrics that measure how well a security program or function is performing against its objectives, used to track effectiveness, demonstrate value, and guide improvement.

KRIs

Key risk indicators: metrics that signal changes in risk exposure, giving early warning when a specific risk is increasing so the organization can act before it materializes. The abbreviation of key risk indicators.

Kerberoasting

An Active Directory attack where an attacker requests service tickets for accounts and cracks them offline to recover the service accounts' passwords, exploiting weak passwords on service accounts to gain access.

Kerberoasting Detection

Detecting kerberoasting by watching for its telltale signs in Active Directory, such as unusual volumes of service-ticket requests or requests using weak encryption, so the stealthy credential attack can be caught.

Kerberos

A network authentication protocol that uses tickets issued by a trusted authority to let users and services prove their identity without sending passwords over the network. It is central to Active Directory authentication.