Glossary

Management Network

A separate, isolated network used exclusively for administering devices and infrastructure, so management traffic and interfaces are not exposed to general networks and not reachable from compromised user systems.

Mapping Validation

Mapping validation confirms that a claimed relationship between a source requirement and an implemented control is accurate, current, scoped, and sufficiently supported.

Maturity Assessments

Evaluations that judge how mature a security function or process is, often against a defined maturity model, so an organization can see where it stands and plan improvements toward higher maturity.

Maximum Tolerable Period of Disruption

The longest disruption a business activity can tolerate before consequences become unacceptable, as determined by authorized business owners and relevant obligations.

Mean Time Metric Boundary

The defined clock start, stop, population, exclusions, time basis, and statistic used for a mean-time measure.

Mean Time to Contain (MTTC)

Mean time to contain averages elapsed time from a defined incident milestone to a defined containment state across a stated population.

Mean Time to Detect (MTTD)

The average time from when an attack or incident begins to when defenders detect it. Lower MTTD means earlier detection and less dwell time, so it is a key metric for monitoring program effectiveness.

Mean Time to Respond (MTTR)

The average time from detection of an incident to its response or resolution, depending on how it is defined. Lower MTTR means faster response, limiting damage, so it is a key SOC performance metric.

Meaningful Certification Practice

Running access certification campaigns that actually drive correct access decisions, rather than rubber-stamping exercises, by providing context, focusing on risk, and following through on revocations identified.

Mentorship

A more experienced person guiding a less experienced colleague's growth, in security a powerful accelerator that transfers tacit knowledge, judgment, and confidence that training alone cannot, helping analysts develop and stay in the field.

Mesh Observability

The visibility a service mesh provides into communication between microservices, metrics, tracing, and logs of every request, giving deep insight into who is calling whom and how, which security analysts and operators use for detection and investigation.

Mesh Operational Security

Securing how a service mesh is operated and maintained, the mesh's own control plane, configuration changes, certificate rotation, and upgrades, so the mesh itself does not become a weak spot in the cloud-native environment.

Mesh Trade-offs

The downsides and costs of adopting a service mesh, operational complexity, performance overhead, learning curve, and an added attack surface, weighed against its benefits so the choice fits the environment.

Message Authentication Code

A short code attached to a message that lets a receiver verify both its integrity and that it came from someone holding a shared secret key, providing message authenticity without the asymmetry of digital signatures.

Metrics Reporting

Reporting policy and program metrics to leadership and stakeholders, awareness scores, exception trends, compliance rates, so they can see whether policies are working and decide on changes, framed within policy writing in practice.

Metrics and Reporting

The measures and reports that show how well cloud workload protection is performing, vulnerability and configuration findings, coverage, remediation pace, so leadership can see effectiveness and direct improvement.

Microsegmentation

Fine-grained network segmentation that limits communication between workloads or systems.

Microsegmentation Policy

Microsegmentation policy limits communication among resources or workloads to approved paths using network, host, workload, application, or service controls.

Microsegmentation Principles

The principles behind microsegmentation in zero trust, granular, identity-aware segmentation between workloads so each can only reach what it needs, with default-deny and continuous policy enforcement.

Microservices

An architectural style where an application is built as many small, independent services that communicate over the network, common in cloud-native systems and carrying distinctive security characteristics for defenders to address.

Microservices Resilience

Designing microservices so the system stays available and degrades gracefully despite failures, partial outages, slow dependencies, or misbehavior, through patterns like timeouts, retries, circuit breakers, and isolation.

Microservices Security Architecture

The overall design of how microservices are secured, identity for each service, mutual authentication, authorization between services, secrets management, observability, and segmentation, treated holistically as a system.

Microservices Threat Modeling

Applying threat modeling specifically to microservices systems, examining service-to-service trust, data flows, identity, and the many interfaces, to surface threats the architecture's distinct shape creates.

Microsoft Defender for Identity (MDI)

Microsoft Defender for Identity is a cloud-based identity threat detection service that uses sensors and identity telemetry to identify suspicious activity in on-premises and hybrid identity environments.

Microsoft Entra Incident Investigation

Microsoft Entra incident investigation traces users, applications, service principals, managed identities, workload federation, devices, authentication methods, tokens, consent, and directory changes during an incident.

Microsoft Entra PIM

Microsoft Entra Privileged Identity Management manages eligible, active, permanent, and time-bound role or group assignments for supported Microsoft Entra and Azure resources.

Mimikatz

A widely used post-exploitation tool that extracts credentials from Windows memory and authentication artifacts, infamous for retrieving plaintext passwords, hashes, and Kerberos tickets that attackers use to escalate and move laterally.

Misconfigurations

Mistakes in how systems or services are configured, in the cloud, things like public storage, open ports, missing encryption, or overly permissive IAM, that create exploitable weaknesses without any traditional vulnerability.

Mitigation Option Analysis

Mitigation option analysis compares avoiding, reducing, detecting and responding, transferring a defined duty, accepting residual risk, or ending an activity across security, privacy, usability, accessibility, reliability, cost, and failure modes.

Mitigation and Compensating Controls

Mitigation and compensating controls reduce exploitability or consequence when the vulnerable condition cannot yet be removed or a different treatment is chosen.

Mixed Content

A web security issue where an HTTPS page loads some resources (scripts, images) over insecure HTTP, undermining the page's protections by letting attackers tamper with or read the insecure parts.