Terminology Index

Glossary

2953 terms

Persistence Removal

Eliminating attacker persistence during incident response, finding and removing every mechanism the attacker installed to maintain access, so eradication is complete and the attacker cannot simply return.

Personal Data

Information relating to an identified or identifiable individual, the core category that privacy laws like GDPR protect. Knowing what counts as personal data is foundational to privacy and data-protection obligations.

Personal Data Context

Personal data context records whose data is involved, its source, purpose, systems, location, access, sharing, retention, sensitivity, and applicable legal or contractual setting.

Phased Recovery

Restoring systems and operations in planned stages during incident recovery rather than all at once, so the most critical functions return first, restoration can be verified clean, and risk of reinfection is controlled.

Phased Remediation Prioritization

Phased remediation prioritization sequences immediate containment, enabling dependencies, and target-state design changes according to demonstrated risk and delivery constraints.

Phishing

A social engineering attack that tricks people into revealing information or taking unsafe actions.

Phishing Detection

Detecting phishing attempts through signals in email and user behavior, suspicious senders, links, content, and reported messages, often mapped to ATT&CK, so phishing is caught before or after a user interacts.

Phishing Metrics

Clearly scoped measures of simulated or real phishing exposure, interaction, reporting, delivery, containment, and false reporting, with valid denominators and known limitations.

Phishing Simulation

Sending controlled, fake phishing emails to staff to measure susceptibility and reinforce training, a security-awareness tool used carefully to build resilience without blaming or demoralizing employees.

Phishing-Resistant Authentication

Phishing-resistant authentication prevents disclosure or use of authentication output at an impostor verifier through protocol and authenticator design, commonly using verifier-bound cryptographic credentials.

Phishing-Resistant MFA

Forms of multi-factor authentication that cannot be defeated by phishing or relay attacks, notably FIDO2/WebAuthn and passkeys, because the credential is cryptographically bound to the legitimate site.

Physical Control

A control that protects facilities, equipment, media, or people through barriers, locks, guards, sensors, environmental systems, or controlled physical access.

Physical Controls

Security measures that protect physical assets and access, locks, badges, cameras, guards, secure facilities, recognized as one of the foundational control categories alongside technical and administrative controls.

Pipeline Failure Detection

Monitoring for collection gaps, parser errors, rejected events, failed authentication, queue growth, and unexpected volume or field changes.

Pipeline Guardrails

Automated security checks and policy enforcement built into a CI/CD pipeline that block insecure code, configurations, or dependencies from progressing, so security is enforced as code moves toward deployment.

Pipeline Security

Securing the CI/CD pipeline itself, its code, build steps, dependencies, secrets, and infrastructure, so attackers cannot compromise the path that builds and deploys software, a key cloud-native supply-chain concern.

Pipeline Security Architecture

The structured design of security throughout a CI/CD pipeline, the stages, controls, and gates from code commit to deployment, so security is built into the delivery path rather than bolted on, central to DevSecOps.

Pipeline Threat Modeling

Pipeline threat modeling identifies how source events, workflows, dependencies, runners, caches, artifacts, identities, approvals, registries, and deployment targets could be abused.

Pivoting

In SOC investigation, moving from one piece of evidence to related ones, following an indicator, account, host, or behavior to uncover connected activity and expand understanding of an incident.

Plaintext

Data in its readable, unencrypted form, the input to encryption and the output of decryption. Protecting plaintext (and minimizing its exposure) is fundamental, since it is the form attackers want to obtain.

Plaintext is information in its original, readable state, before encryption or after decryption, as opposed to ciphertext. It is the form data is useful in and the form attackers seek, so security aims to minimize where and how long sensitive data exists as plaintext: encrypting at rest and in transit, decrypting only when needed, and protecting plaintext in memory and logs. Understanding the plaintext/ciphertext distinction is foundational to reasoning about encryption and data protection.

Introduced in: Security Foundations

Examples

Encrypting plaintext into ciphertext to protect it at rest.
Minimizing how long sensitive data exists as plaintext in memory.
Recognizing plaintext as the readable form attackers want.

Ciphertextrelates_to Encryptionrelates_to Confidentialityrelates_to Keyrelates_to Private Keyrelates_to Public Keyrelates_to Rainbow Tablesrelates_to Revocationrelates_to

Playbook Development

Building and refining the procedural guides analysts follow for handling specific alert types or incidents, a capstone SOC skill that turns repeated experience into consistent, repeatable, teachable response.

Playbook Improvement Validation

Playbook improvement validation tests revised instructions, authority, access, automation, contacts, evidence, containment, communication, and recovery through exercises or authorized technical simulation.

Pod Security Admission Strategy

A Pod Security Admission strategy selects policy level, mode, version pinning, rollout, compatibility testing, monitoring, and exemptions according to workload and cluster risk.

Pod Security Standards

Kubernetes' standard security policies for pods, organized into baseline, restricted, and privileged levels, that constrain what pods can do, blocking dangerous capabilities like host access or privileged execution.

Pod Security Standards Production

Operating Pod Security Standards in real production clusters, choosing the right level per workload, rolling out without breaking existing apps, handling exceptions, and monitoring effectiveness over time.

Policies

In identity and access management, the rules that determine who can do what under which conditions, encoded in directories, IAM systems, or policy engines, enforced consistently across the organization.

Policy

A formal organizational document expressing the requirements, expectations, and responsibilities around a topic such as acceptable use or access control. Policies are the top of the governance hierarchy that controls and procedures implement.

Policy Anatomy

The standard structural elements of a well-written policy, purpose, scope, statements, roles, exceptions, references, that make policies clear, complete, and consistent so readers can find what they need.

Policy Authority

Policy authority is the delegated management or governing power that establishes mandatory expectations, responsibilities, scope, compliance, enforcement, and exception routes.

Policy Communication

Making policies known and understood across the organization, through accessible language, awareness campaigns, training, and easy-to-find publication, so people can actually follow what policies require.

Policy Drafting

The discipline of writing policies, choosing the right scope, anatomy, language, and statements, so they are clear, enforceable, complete, and aligned with organizational and regulatory needs.

Policy Drafting Process

The controlled creation of policy language through research, requirement analysis, stakeholder review, accessibility checks, conflict resolution, and version control.