Terminology Index

Glossary

2953 terms

LINDDUN Methodology

A privacy-focused threat-modeling methodology that helps identify privacy threats in a system, structured around categories like linkability, identifiability, and non-compliance, complementing security-focused models like STRIDE.

LOLBin Detection

Detecting the malicious use of legitimate built-in binaries (living-off-the-land binaries) by spotting abnormal usage patterns, since the tools themselves are trusted and present by default, only their misuse is malicious.

LOLBin Hunting Methodology

A structured approach to hunting for living-off-the-land binary abuse, systematically examining how trusted binaries are used across the environment to find malicious misuse hiding among legitimate activity.

LOLBins

Living-off-the-land binaries: legitimate, pre-installed system tools that attackers abuse to carry out malicious actions while blending in, since using trusted built-in binaries evades many defenses.

LSASS

The Windows process (Local Security Authority Subsystem Service) that handles authentication and holds credentials in memory, making it a prime target for attackers who dump its memory to steal credentials.

LSASS Memory Dumping Detection

Detecting attempts to dump the memory of the Windows LSASS process, a strong sign of credential theft, by monitoring for suspicious processes accessing LSASS or known dumping techniques.

Lateral Movement

Movement from one system or account to others inside an environment.

Lateral Movement Correlation

Lateral movement correlation links source activity, destination authentication, remote-channel use, process or service creation, and follow-on behavior to identify movement between systems.

Lateral Movement Hunts

Threat hunts focused on finding attacker movement between systems inside a network, searching for signs of remote access, credential reuse, and pivoting that indicate an intruder spreading from an initial foothold.

After gaining a foothold, attackers move laterally to reach their objectives, and lateral movement hunts proactively search for that activity: unusual remote logons, use of administrative tools across hosts, credential reuse, and pivoting patterns. Forming a hypothesis about how an adversary would move in the environment, hunters examine authentication and host telemetry for these signs, aiming to catch an intrusion mid-spread that point detections missed. It is a high-value tactic-focused hunt.

Introduced in: Threat Hunting Fundamentals

Examples

Hunting for unusual remote logons between internal hosts.
Searching for admin tools being used across many systems.
Looking for credential reuse indicating pivoting from a foothold.

Lateral Movementrelates_to Initial Access Huntsrelates_to Footholdrelates_to Credential Access Huntsrelates_to Hunt Hypothesisprerequisite_of Pass-the-Hash Detectionrelates_to Persistence Huntsrelates_to Privilege Escalation Huntsrelates_to

Lateral Movement Indicators

Lateral movement indicators are identity and access signals suggesting an actor is using one foothold to reach additional systems or accounts.

Law Enforcement Coordination

Law enforcement coordination manages authorized contact, evidence sharing, requests, and operational deconfliction with the appropriate agency and jurisdiction.

Law Enforcement Decision Authority

Law enforcement decision authority identifies who may engage an agency and under what legal, safety, insurance, evidence, business, and jurisdictional considerations.

Layered Defense

Use of complementary preventive, detective, responsive, and recovery measures across separate failure modes so one control's failure does not determine the outcome.

Leadership Modeling

When leaders visibly practice the security behaviors they expect of others, setting the tone that security matters. It is one of the strongest influences on an organization's security culture.

Leading and Lagging Indicators

Two kinds of security-culture metrics: leading indicators predict future outcomes (like training engagement or reporting rates), while lagging indicators measure past results (like incidents that occurred), used together to gauge and steer culture.

Learning Sharing

Spreading the lessons from incidents and operations across the team and organization, so insights from one responder's experience or one incident improve everyone's practice rather than staying siloed.

Least Privilege

The principle of giving users and systems only the access they need to do their job.

Least-Privilege Role Activation

Least-privilege role activation grants the narrowest administrative role and scope for a limited period after the required approval, justification, and authentication controls are satisfied.

Leaver Process

A leaver process revokes access, sessions, authenticators, and ownership when an employment, contract, partnership, or workload relationship ends.

Legacy Resource Integration

Legacy resource integration adds gateways, proxies, jump hosts, virtual desktops, local controls, or segmented enclaves when a system cannot consume modern identity or policy.

Legal Communication

Communicating with and through legal counsel during an incident, ensuring legally sensitive matters, disclosure, evidence, liability, are handled with legal guidance and sometimes under privilege, so the response is legally sound.

Legal and HR Coordination

Working with legal and human-resources teams when writing policies, so policies are enforceable, compliant with law and employment rules, and aligned with how the organization handles people-related matters.

Legal and Privacy Handoff

A legal and privacy handoff provides authorized specialists with jurisdictions, contracts, data categories, systems, access and acquisition evidence, timeline, safeguards, containment, recipients, and uncertainty.

Legal and Regulatory Handoff

A legal and regulatory handoff provides authorized privacy or legal personnel with a time-bounded summary, evidence index, confidence states, potentially involved systems and data, mitigations, limitations, and preservation status.

Lessons Learned

A review after an incident that identifies improvements to people, process, and technology.

Lessons from Practice

Insights drawn from real-world security operations experience, what actually works, common pitfalls, and hard-won judgment, that complement theory by grounding blue-team skills in how things play out in practice.

Lessons-Learned Ownership

Lessons-learned ownership converts incident findings into prioritized actions with an accountable owner, rationale, acceptance criteria, resources, dependencies, target, status, and risk escalation.

Let's Encrypt

A free, automated certificate authority that issues TLS certificates at no cost, making HTTPS easy and ubiquitous. Its automation (via the ACME protocol) lets sites obtain and renew certificates without manual effort.

Lightweight Threat Modeling

A streamlined, practical approach to threat modeling that fits into fast development, using quick, focused techniques to identify key threats without the overhead of heavyweight formal methods, so modeling actually gets done.

Likelihood

How probable it is that a threat will affect a system or asset.

Likelihood Estimation

Judging how probable it is that a risk will occur, a core part of risk assessment that, paired with impact, determines a risk's level so it can be prioritized and treated appropriately.

Likelihood Uncertainty

Likelihood uncertainty records the evidence, assumptions, time horizon, estimate meaning, range, visibility, and limitations behind a likelihood judgment.