Glossary

Remediation Ownership

Assigning clear ownership for remediating each vulnerability or finding to a specific team or person, so issues don't languish without anyone responsible to fix them, foundational to effective vulnerability management.

Remediation Planning

Planning how to address audit findings, scoping the fix, assigning ownership, setting timelines, and aligning resources, so remediation is intentional and trackable rather than ad hoc.

Remediation Root Cause

Remediation root cause identifies the underlying process, ownership, access, workflow, capacity, incentive, technology, or governance condition that enabled a finding.

Remediation Tracking

Tracking audit findings through to completion, status, timelines, owner action, evidence of fix, so issues are visibly resolved and recurring problems are surfaced rather than quietly persisting.

Remediation Verification

Confirming that a vulnerability or finding has actually been fixed, by retesting or re-scanning, so issues aren't closed in trackers while still exploitable in reality.

Remote Access Malware Analysis

Remote access malware analysis examines configuration, command dispatch, transport framing, persistence, plugins, privileges, and supported actions that enable remote control of a system.

Remote Service Detection Design

Remote service detection design models expected and concerning use of RDP, SMB, WinRM, SSH, cloud sessions, management agents, and other remote administration channels.

Remote Services

Internet-reachable services that enable remote access (SSH, RDP, VPN, remote-management interfaces). Attackers target them heavily for initial access and lateral movement, so they require special hardening.

Removable Media

USB drives, external disks, and similar portable devices, a notable attack vector for delivering malware, exfiltrating data, or bypassing network controls, requiring deliberate policy and technical controls.

Reopening and Recurrence

Reopening and recurrence govern findings that return, fail verification, outlive an exception, lose mitigation, or reappear through redeployment or drift.

Report Finding Prioritization

Ranking assessment findings by risk and impact so the most important issues stand out in the report, helping the client know where to focus remediation effort first.

Report Writing Practice

Repeated creation and review of concise, reproducible, audience-appropriate security findings, limitations, evidence, risk rationale, and actions.

Reporting Channel

An approved, accessible path for raising security events, concerns, near misses, or vulnerabilities to an accountable team with acknowledgement and escalation behavior.

Reporting Channels

The defined ways employees can report security concerns, suspicious emails, near misses, or incidents, hotlines, mailboxes, ticketing, that make reporting easy, trusted, and timely.

Request

An HTTP message sent by a client to a server asking for a resource or to perform an action. Defenders read requests to understand what users and attackers are doing on web applications.

Requirements Definition Process

The disciplined process of defining what an intelligence program must answer, eliciting needs from stakeholders, translating them into clear intelligence requirements, and prioritizing across consumers.

Requirements Validation

Checking that intelligence requirements are clear, prioritized, and actually being answered, so the program can correct drift and demonstrate it is delivering value against the questions consumers care about.

Residual Risk

The risk that remains after controls are applied.

Residual Risk Communication

Residual risk communication explains the remaining scenario, affected objective, control performance, uncertainty, trend, treatment status, owner, and decision required after current safeguards.

Residual Risk Decision

A residual risk decision records the threat, controls, remaining consequence and uncertainty, alternatives, rationale, accountable authority, conditions, review date, and reopening triggers.

Residual Threat Hunt

A residual threat hunt uses incident-derived hypotheses to search documented populations, sources, identities, access paths, and time ranges for alternate persistence, scope, or recurrence.

Resolver

A DNS component that takes a domain query and finds the answer, recursively asking authoritative servers if needed. Resolvers are a foundational piece of DNS and a key place to monitor for malicious activity.

Resource Discovery and Classification

Resource discovery and classification maintain the owners, interfaces, dependencies, identities, flows, sensitivity, protocols, availability, and enforcement paths of protected systems and data.

Resource-Based Policies

Cloud access policies attached directly to a resource (like a bucket or queue) that say who may access it, complementing identity-based policies that say what an identity may do.

Resource-Centric Security

Resource-centric security organizes policy around protected data, applications, services, workloads, devices, infrastructure, APIs, and their operations instead of declaring a network zone trusted.

Responder Fatigue Management

Responder fatigue management uses staffing, rest, rotation, overlap, and escalation practices to reduce judgment and documentation failures during long incidents.

Response

An HTTP message returned by a server to a client, carrying a status, headers, and content. Defenders read responses to understand application behavior and to spot leakage or anomalies in server replies.

Response Automation

Automating cloud-workload response actions, isolating an instance, revoking credentials, blocking IPs, so detection-to-action time shrinks dramatically, especially valuable in dynamic cloud environments.

Response Decision Record

A response decision record preserves facts known at the time, hypotheses, alternatives, authority, owner, action, expected result, risk, evidence, observed outcome, and next review.

Response Tempo

The pace at which an organization handles an ongoing incident, decisions, communications, technical actions, that must be set and sustained deliberately rather than left to circumstance.

Restricted Groups (GPO)

Restricted Groups is a Group Policy mechanism that enforces membership relationships for selected local or domain groups.