Terminology Index

Glossary

2953 terms

Monte Carlo Risk Analysis

Using Monte Carlo simulation to combine probability distributions of risk inputs (frequencies, impacts) into a distribution of probable losses, giving a richer view of risk than single-point estimates.

Monte Carlo Simulation

A computational technique that runs many randomized trials from input probability distributions to estimate the distribution of an outcome. In FAIR, it combines factor estimates into a quantified loss distribution.

Motivation

The objective or incentive influencing an actor's behavior, such as financial gain, espionage, disruption, ideology, coercion, competition, or personal grievance.

Mover Process

A mover process adjusts identity attributes and access when a person's role, department, location, contract, or responsibilities change.

Multi-Account Architecture

Multi-account architecture separates cloud workloads and control functions into accounts, subscriptions, or projects with intentional policy, access, billing, and isolation boundaries.

Multi-Account Cloud Correlation

Multi-account cloud correlation joins related identities, sessions, actions, resources, and network observations across accounts, subscriptions, projects, regions, or tenants.

Multi-Account Strategy

Deliberately structuring cloud usage across many accounts (or subscriptions) to isolate workloads, environments, and blast radius, so a compromise or mistake in one account is contained from the others.

Multi-Cloud

Using services from more than one cloud provider.

Multi-Cloud Coverage

Ensuring cloud workload protection extends consistently across all clouds the organization uses, AWS, Azure, GCP, and others, so visibility and controls are not strong in one and weak in another.

Multi-Cloud Shared Responsibility Assessment

Multi-cloud shared responsibility assessment assigns each security, privacy, availability, logging, and recovery duty to the provider, customer platform team, workload team, SaaS vendor, or other party.

Multi-Cloud vs Single-Cloud

The architectural choice between using one cloud provider or several. Multi-cloud avoids lock-in and adds resilience but increases complexity; single-cloud is simpler but ties the organization to one provider.

Multi-Factor Authentication

Authentication that requires more than one type of proof before access is granted.

Multi-Framework Approach

Operating a compliance program under several frameworks at once, treating them coherently rather than separately by leveraging overlap and shared evidence, so the organization satisfies many obligations without duplicated effort.

Multi-Framework Architecture

An organizing model for operating multiple security frameworks, with a unified control set, evidence repository, and mapping layer underneath, so frameworks are layered on a common foundation rather than implemented separately.

Multi-Framework Audit Strategy

Planning audits across the several frameworks an organization is subject to, so audit cycles, evidence, and assessor engagement are coordinated rather than run as separate, redundant efforts that strain the business.

Multi-Framework Control Mapping

Mapping the organization's controls to several frameworks at once so each control's evidence can be claimed against every framework it satisfies, the practical core of running multi-framework compliance.

Multi-Framework Efficiency

The gains in cost, effort, and consistency that come from running multiple frameworks as a coherent program with shared controls and evidence, rather than handling each separately, the payoff of a mature multi-framework approach.

Multi-Framework Reality

The unavoidable fact that most organizations must comply with several security frameworks at once, regulatory, contractual, and customer-driven, shaping how programs must be designed rather than choosing a single framework.

Multi-Jurisdiction Compliance

Meeting compliance obligations across multiple countries or regions at once, since cloud and global operations subject organizations to different, sometimes conflicting, regulations whose requirements must all be satisfied.

Multi-Source Correlation

A SIEM technique that combines events from multiple log sources to reveal what no single source shows alone, an attack whose footprint spans endpoints, identity, and network, connecting them into one picture.

Multi-Team Coordination

Coordinating multiple teams during an incident, IR, SOC, IT, legal, communications, business units, so they act in concert under unified leadership rather than working at cross purposes.

Multi-Tenant Data Isolation

Multi-tenant data isolation prevents one tenant's subjects, workloads, or administrators from accessing or influencing another tenant's resources without explicit platform authorization.

Multi-Year Cycles

Audit and compliance activities that operate on multi-year rather than annual cycles, such as a three-year ISO 27001 recertification cycle, requiring plans and effort that span years rather than fitting one calendar.

Mutating Webhooks

Kubernetes admission controllers that can modify incoming requests before they take effect, automatically adjusting workloads, for instance injecting sidecars or enforcing required settings, as part of cluster security and policy.

Mutual TLS (mTLS)

Mutual TLS authenticates both peers during a TLS connection while protecting data in transit against observation and undetected modification.

NAT

Network Address Translation lets multiple private devices share one or more public IP addresses by rewriting address information as traffic crosses a boundary.

NDA-Gated Disclosure

NDA-gated disclosure requires an applicable confidentiality agreement before selected restricted assurance material is released to an authorized recipient.

NIST CSF

The NIST Cybersecurity Framework is a flexible set of outcomes and guidance for managing cybersecurity risk.

NIST CSF Structure

The high-level structure of the NIST Cybersecurity Framework, organized around core functions (Govern, Identify, Protect, Detect, Respond, Recover), categories, and subcategories, with profiles and tiers for risk-based management.

The NIST Cybersecurity Framework is structured around core functions that organize outcomes (Govern, Identify, Protect, Detect, Respond, Recover), each broken into categories and subcategories of specific outcomes. Implementation profiles tailor the framework to an organization's risks and goals, and tiers describe how rigorous risk-management practice is. Understanding the structure is foundational to using the CSF as a flexible, risk-based scaffold rather than a checklist.

Introduced in: Security Frameworks and Control Mapping

Examples

Organizing security activities under the CSF's six core functions.
Using CSF subcategories to specify outcomes the organization will achieve.
Tailoring a CSF profile to the organization's risk priorities.

CSF Profilesrelates_to CSF Tiersrelates_to CSF vs 800-53 Use Casesrelates_to Framework Ecosystemrelates_to Framework Purposerelates_to Certifiable vs Referencerelates_to CSF Profilesrelates_to CSF Tiersrelates_to CSF vs 800-53 Use Casesrelates_to Prescriptive vs Outcome-Basedrelates_to

NIST Cybersecurity Framework

A framework for organizing cybersecurity outcomes across identify, protect, detect, respond, and recover functions.

NIST RMF

The NIST Risk Management Framework: a structured process (categorize, select, implement, assess, authorize, monitor) for managing security and privacy risk for systems, widely used in US federal government and influential more broadly.

NIST SP 800-207

NIST Special Publication 800-207, the influential definition of zero-trust architecture from NIST, laying out core principles, components, and deployment models that have become the reference for understanding zero trust.