Terminology Index

Glossary

2953 terms

MAC Address

A link-layer interface identifier used within a local network segment, whose observed value may be changed, randomized, virtualized, or shared and does not identify a person.

MAC Addresses

Hardware addresses assigned to network interfaces that identify devices on a local network segment, used for delivery at the data-link layer. They are local in scope, unlike IP addresses, which route across networks.

MD5

An older cryptographic hash function (128-bit) once widely used but now broken for security: collisions can be created practically, so MD5 must not be used for integrity guarantees or signatures, though it still appears as a non-security checksum.

MDR

Managed Detection and Response: a service in which an external provider monitors a customer's environment, detects threats, and assists with response, often 24/7, giving organizations advanced security operations without building it all in-house.

MDR Service Boundary

An MDR service boundary states what a provider collects, monitors, investigates, retains, changes, escalates, and exports, along with hours, locations, outages, subcontractors, exit arrangements, and customer responsibilities.

MFA

Multi-factor authentication: requiring at least two distinct factors (knowledge, possession, inherence) to authenticate, so a stolen password alone is not enough. It is one of the highest-impact controls against credential attacks.

MFA Fatigue

An attack that bombards a user with MFA push prompts until they approve one out of annoyance, exploiting a human weakness rather than a technical flaw to bypass MFA on accounts protected by push notifications.

MFA Implementation

How an organization actually deploys MFA, choice of factors, coverage of users and apps, enrollment and recovery, fallback, and protection of the MFA system itself, so MFA delivers real security rather than gaps and friction.

MFA and Recovery Flow Testing

MFA and recovery flow testing verifies that required factors, one-time use, replacement, backup methods, reauthentication, notifications, and post-recovery protections are enforced by server state.

MITRE ATT&CK

A knowledge base that organizes observed attacker tactics and techniques.

MITRE ATT&CK Framework

A widely used knowledge base of adversary tactics, techniques, and procedures, organized into a matrix, that defenders use as a common language to describe attacks, plan detections, and assess coverage.

MSSP (Managed Security Service Provider)

A managed security service provider performs a defined set of monitoring, investigation, or response services for a customer under contract.

MSSPs

Managed Security Service Providers: vendors that deliver outsourced security operations, often log monitoring and alerting, used by organizations that want external operational capacity without building it in-house.

MSSPs provide outsourced security services, traditionally focused on log collection, monitoring, and alerting, often around the clock. They are an older model than MDR and typically place more responsibility on the customer for response. They suit organizations that need cost-effective monitoring without building an internal SOC, though clear scope, quality of detection, and the customer-MSSP handoff for response strongly affect the value delivered. They are a common piece of hybrid SOC arrangements.

Introduced in: Blue Team Operations

Examples

Outsourcing log monitoring and basic alerting to an MSSP.
Receiving alerts from an MSSP and handling response internally.
Using an MSSP for cost-effective coverage without a full SOC.

MDRrelates_to Hybrid SOCrelates_to Security Operations Centerrelates_to Follow-the-Sunrelates_to Handoffrelates_to MDRrelates_to SOC Operating Modelsrelates_to

MX Record

A DNS record that specifies the mail servers responsible for receiving email for a domain. Defenders use it to understand email routing, recognize legitimate mail infrastructure, and spot signs of email-related attacks.

Macro Restriction

Limiting or blocking macros in documents (such as Office files), a high-impact hardening measure, since malicious macros are a common way attackers gain initial execution from phishing attachments.

Major Incident Declaration

The formal step of declaring an incident 'major' based on its severity, scope, or impact, which activates senior leadership, additional resources, and the full crisis-response apparatus rather than handling it as a routine incident.

Major Incident Roles

The defined roles activated during a major incident, incident commander, technical lead, communications lead, legal liaison, scribe, and others, so authority and responsibilities are clear across the larger response.

Malware Analysis Decision Log

A malware analysis decision log records each question, tool and configuration, observation, hypothesis, confidence, action, and reason for continuing, changing, or stopping analysis.

Malware Analysis Lab Isolation

Malware analysis lab isolation separates hostile samples from personal and production systems, real identities, shared storage, removable devices, host integration, cloud metadata, and external networks.

Malware Analysis Objectives

Malware analysis objectives are bounded questions whose answers can change an incident-response, detection, or intelligence decision.

Malware Analysis Philosophy

The mindset and principles behind malware analysis, asking why and how a sample behaves, working safely and methodically, balancing depth with the actionable questions defenders need answered, that guide good analytic practice.

Malware Analysis Reporting

Malware analysis reporting connects exact sample evidence, environment, methods, observations, inferred capabilities, confidence, indicators, limitations, and recommendations to incident decisions.

Malware Analysis Safety

Malware analysis safety uses authorization, layered containment, synthetic data, controlled tools, stop conditions, and evidence procedures to avoid creating additional harm while examining hostile code.

Malware Capability Classification

Malware capability classification organizes evidence around behaviors such as execution, persistence, evasion, discovery, collection, command and control, exfiltration, and impact before assigning a family name.

Malware Findings to Detection

Malware findings to detection converts validated sample and incident evidence into scoped analytics across endpoint, identity, email, DNS, proxy, firewall, cloud, SIEM, and file scanning.

Malware Lab Setup

An isolated environment built for safely analyzing malware, with network segmentation, snapshots, and the tools needed for static and dynamic analysis, so samples can be examined without risking production or the analyst's host.

Malware Obfuscation

Techniques attackers use to make malware harder to analyze and detect, such as packing, encryption, code transformations, and anti-analysis tricks, that defenders must work through to understand a sample.

Managed Compute Response Boundary

A managed compute response boundary states which runtime evidence and containment actions a customer can access through the service and which remain provider-controlled.

Managed Data Service Boundary

A managed data service boundary defines provider operation and customer duties for identity, network, schema, data, encryption, keys, audit, backup, replication, deletion, and applications.

Managed Database Security Assessment

Managed database security assessment covers network paths, authentication, administrators, database roles, TLS, at-rest encryption, keys, parameters, replicas, audit, backups, exports, patching, availability, and deletion protection.

Managed Identity Migration

Managed identity migration replaces a workload-managed secret with a provider-managed identity that obtains short-lived tokens for narrowly authorized resources.

Management Action Plan

A management action plan records the agreed response, accountable owner, milestones, target date, resources, dependencies, intended risk reduction, completion evidence, and validation method.