Terminology Index

Glossary

2953 terms

NIST SP 800-53

NIST Special Publication 800-53: a comprehensive catalog of security and privacy controls used by US federal systems and as a reference across the broader framework ecosystem. It is the canonical detailed control catalog.

NIST SP 800-53 Structure

The organization of NIST 800-53, control families, individual controls, control enhancements, and prepared baselines, that lets practitioners navigate the large catalog and pick the controls relevant to their system.

Nation-State Actor

A government-directed, sponsored, or state-aligned threat actor pursuing strategic, military, intelligence, influence, economic, or disruptive objectives; attribution requires qualified evidence.

Nation-State Actors

Threat actors backed by national governments, well-resourced, persistent, often highly skilled, who pursue strategic objectives like espionage, sabotage, or geopolitical influence and pose the most capable adversary class.

Near-Miss Reporting

Encouraging staff to report close calls, like a phishing email almost clicked, a process nearly bypassed, so the organization learns from situations that did not become incidents but could have, strengthening culture and defenses.

Necessity and Proportionality

Necessity and proportionality test whether processing can achieve a legitimate specific purpose and whether a less intrusive effective design is available.

Negative Evidence and Sensor Health

Negative evidence and sensor health evaluate whether a missing event is meaningful by first proving the event should have been generated, collected, delivered, parsed, retained, and queried correctly.

Negligent Insider

An authorized person whose careless or unreasonable action creates security harm without an established malicious objective, assessed through fair and contextual process.

Negligent Insiders

Insiders who cause harm through carelessness or mistakes rather than malice, such as misconfiguring a system, falling for phishing, or mishandling data, a major source of incidents despite no malicious intent.

Network

The interconnected systems and the paths between them over which data flows. Understanding what a network is, its devices, protocols, and connections, is foundational to defending it, monitoring it, and reasoning about attacks.

Network ACLs

Stateless rules that allow or deny traffic at the subnet level in cloud networks, providing a coarse layer of network access control complementary to stateful security groups around individual resources.

Network Address Translation

Translation of network addresses and often ports between traffic domains, requiring state or rules and complicating attribution when mappings are not retained.

Network Alert

An alert derived from traffic, flow, DNS, routing, protocol, exposure, or network-control telemetry and bounded by the sensor's visibility and attribution limits.

Network Alerts

SOC alerts generated from network-level signals, IDS/IPS hits, suspicious connections, DNS anomalies, that analysts triage to find network-based attacks like command-and-control, scanning, and exfiltration.

Network Anomaly Detection

Detecting unusual network behavior, traffic that deviates from baselines, rare destinations, atypical volumes or patterns, on the premise that abnormality often indicates malicious activity. A core network-detection technique.

Network anomaly detection finds traffic that does not match learned normal behavior: a host suddenly contacting many new destinations, beaconing patterns, atypical traffic volumes or protocols, or unusual data transfers. Built on baselines and statistical or behavioral models against network telemetry, it catches attacks that don't match known indicators by their behavior. As a detection-engineering category, it complements signature-based methods and is central to spotting novel command-and-control, exfiltration, and lateral movement.

Introduced in: Detection Engineering

Examples

Flagging a host suddenly contacting many new external destinations.
Detecting unusual outbound data volume as possible exfiltration.
Spotting a beaconing pattern that deviates from normal.

Anomaly Detectionrelates_to Flow Datarelates_to Beaconsrelates_to Network Telemetryrelates_to Network Alertsrelates_to Baseline Analysisprerequisite_of Network Reconnaissancerelates_to Network Telemetryrelates_to

Network Asset Inventory

A reconciled record of network-connected devices, interfaces, addresses, owners, purpose, location, exposure, lifecycle, and evidence confidence.

Network Beacon Analysis

Network beacon analysis evaluates repeated communication using ordered interarrival intervals, variance, jitter, duration, byte patterns, destination novelty, and entity-specific baselines.

Network Behavior Analysis

In malware analysis, examining the network activity a sample produces, DNS lookups, connections, command-and-control traffic, downloads, to understand its capabilities and extract network indicators.

Network Containment Verification

Network containment verification confirms approved firewall, DNS, proxy, email, segmentation, or access changes reached intended enforcement points and behave as designed.

Network Evidence

Evidence collected from network sources, logs, captures, flow data, IDS alerts, that defenders use to investigate incidents and prove what happened on the wire. It is a core form of incident evidence.

Network Firewall

A policy-enforcement control that permits, rejects, or records network flows using attributes such as addresses, ports, protocol, state, identity, or application context.

Network Firewalls

Devices or services that filter network traffic between zones, allowing or denying flows by rules to enforce segmentation and perimeter control. Among the oldest and most foundational network-security controls.

Network Layer Model

A network layer model organizes communication functions into layers so defenders can reason about encapsulation, protocols, trust boundaries, failure points, and observable evidence.

Network Policies (K8s)

Kubernetes resources that restrict which pods can communicate with which, enforcing network segmentation inside a cluster so a compromised pod cannot freely reach others. A core part of cluster workload protection.

Network Policies Production

Operating Kubernetes network policies in real production at scale, designing them sustainably, rolling them out without breaking apps, monitoring effectiveness, and maintaining them as workloads change.

Network Reconnaissance

Attacker activity that probes a network to map its devices, services, and weaknesses, scans, sweeps, and queries, that often precedes intrusion. Recognizing it is foundational to detecting attacks early.

Network Segmentation

Separating a network into smaller zones to reduce exposure and limit movement.

Network Telemetry

The data network devices and tools produce, flow records, packet captures, DNS, proxy, firewall, and IDS logs, that defenders collect for detection, hunting, and investigation. The lifeblood of network monitoring.

Network Telemetry Limitation

A documented visibility or attribution constraint caused by factors such as encryption, address sharing, sampling, routing, or missing content.

Network Threat Model

A model of how an attacker might attack the network, what enters and leaves, where boundaries are, what is trusted, used to anticipate threats and design controls so the network defends what matters.

Network Visibility

How much of what happens on the network defenders can actually see and analyze, determined by the telemetry collected, monitoring tools, and instrumentation. Without visibility, network defense and investigation are blind.

NetworkService

A built-in Windows service account with limited local privileges but ability to authenticate to the network as the computer itself. Defenders recognize it as a normal context, and abnormal behavior from it as suspicious.