Terminology Index

Glossary

2953 terms

NIST SP 800-53

NIST Special Publication 800-53: a comprehensive catalog of security and privacy controls used by US federal systems and as a reference across the broader framework ecosystem. It is the canonical detailed control catalog.

NIST SP 800-53 Structure

The organization of NIST 800-53, control families, individual controls, control enhancements, and prepared baselines, that lets practitioners navigate the large catalog and pick the controls relevant to their system.

Nation-State Actor

A government-directed, sponsored, or state-aligned threat actor pursuing strategic, military, intelligence, influence, economic, or disruptive objectives; attribution requires qualified evidence.

Nation-State Actors

Threat actors backed by national governments, well-resourced, persistent, often highly skilled, who pursue strategic objectives like espionage, sabotage, or geopolitical influence and pose the most capable adversary class.

Near-Miss Reporting

Encouraging staff to report close calls, like a phishing email almost clicked, a process nearly bypassed, so the organization learns from situations that did not become incidents but could have, strengthening culture and defenses.

Necessity and Proportionality

Necessity and proportionality test whether processing can achieve a legitimate specific purpose and whether a less intrusive effective design is available.

Negative Evidence and Sensor Health

Negative evidence and sensor health evaluate whether a missing event is meaningful by first proving the event should have been generated, collected, delivered, parsed, retained, and queried correctly.

Negligent Insider

An authorized person whose careless or unreasonable action creates security harm without an established malicious objective, assessed through fair and contextual process.

Negligent Insiders

Insiders who cause harm through carelessness or mistakes rather than malice, such as misconfiguring a system, falling for phishing, or mishandling data, a major source of incidents despite no malicious intent.

Network

The interconnected systems and the paths between them over which data flows. Understanding what a network is, its devices, protocols, and connections, is foundational to defending it, monitoring it, and reasoning about attacks.

Network ACLs

Stateless rules that allow or deny traffic at the subnet level in cloud networks, providing a coarse layer of network access control complementary to stateful security groups around individual resources.

Network Address Translation

Translation of network addresses and often ports between traffic domains, requiring state or rules and complicating attribution when mappings are not retained.

Network Alert

An alert derived from traffic, flow, DNS, routing, protocol, exposure, or network-control telemetry and bounded by the sensor's visibility and attribution limits.

Network Alerts

SOC alerts generated from network-level signals, IDS/IPS hits, suspicious connections, DNS anomalies, that analysts triage to find network-based attacks like command-and-control, scanning, and exfiltration.

Network Anomaly Detection

Detecting unusual network behavior, traffic that deviates from baselines, rare destinations, atypical volumes or patterns, on the premise that abnormality often indicates malicious activity. A core network-detection technique.

Network Asset Inventory

A reconciled record of network-connected devices, interfaces, addresses, owners, purpose, location, exposure, lifecycle, and evidence confidence.

Network Beacon Analysis

Network beacon analysis evaluates repeated communication using ordered interarrival intervals, variance, jitter, duration, byte patterns, destination novelty, and entity-specific baselines.

Network Behavior Analysis

In malware analysis, examining the network activity a sample produces, DNS lookups, connections, command-and-control traffic, downloads, to understand its capabilities and extract network indicators.

Network Containment Verification

Network containment verification confirms approved firewall, DNS, proxy, email, segmentation, or access changes reached intended enforcement points and behave as designed.

Network Evidence

Evidence collected from network sources, logs, captures, flow data, IDS alerts, that defenders use to investigate incidents and prove what happened on the wire. It is a core form of incident evidence.

Network Firewall

A policy-enforcement control that permits, rejects, or records network flows using attributes such as addresses, ports, protocol, state, identity, or application context.

Network Firewalls

Devices or services that filter network traffic between zones, allowing or denying flows by rules to enforce segmentation and perimeter control. Among the oldest and most foundational network-security controls.

Network Layer Model

A network layer model organizes communication functions into layers so defenders can reason about encapsulation, protocols, trust boundaries, failure points, and observable evidence.

Network Policies (K8s)

Kubernetes resources that restrict which pods can communicate with which, enforcing network segmentation inside a cluster so a compromised pod cannot freely reach others. A core part of cluster workload protection.

Network Policies Production

Operating Kubernetes network policies in real production at scale, designing them sustainably, rolling them out without breaking apps, monitoring effectiveness, and maintaining them as workloads change.

Network Reconnaissance

Attacker activity that probes a network to map its devices, services, and weaknesses, scans, sweeps, and queries, that often precedes intrusion. Recognizing it is foundational to detecting attacks early.

Reconnaissance is how attackers learn about a target's network: scanning for live hosts and open ports, querying DNS, probing services for versions, mapping the layout. Defenders see it as a precursor to attack and look for the telltale signs (broad scans, port sweeps, unusual DNS or LDAP queries). Catching reconnaissance early gives time to react before more damaging stages, making understanding and detecting it a basic part of network defense.

Introduced in: Networking Foundations

Examples

Spotting a host running a port scan against the network.
Detecting broad DNS or LDAP queries used to map the environment.
Recognizing reconnaissance as a precursor to attack stages.

Reconnaissancerelates_to Cyber Kill Chainrelates_to Network Anomaly Detectionrelates_to Discoveryrelates_to ICMPrelates_to Resolverrelates_to Port Scanningrelates_to Network Alertsrelates_to

Network Segmentation

Separating a network into smaller zones to reduce exposure and limit movement.

Network Telemetry

The data network devices and tools produce, flow records, packet captures, DNS, proxy, firewall, and IDS logs, that defenders collect for detection, hunting, and investigation. The lifeblood of network monitoring.

Network Telemetry Limitation

A documented visibility or attribution constraint caused by factors such as encryption, address sharing, sampling, routing, or missing content.

Network Threat Model

A model of how an attacker might attack the network, what enters and leaves, where boundaries are, what is trusted, used to anticipate threats and design controls so the network defends what matters.

Network Visibility

How much of what happens on the network defenders can actually see and analyze, determined by the telemetry collected, monitoring tools, and instrumentation. Without visibility, network defense and investigation are blind.

NetworkService

A built-in Windows service account with limited local privileges but ability to authenticate to the network as the computer itself. Defenders recognize it as a normal context, and abnormal behavior from it as suspicious.