Defence & operations
Definiciones en lenguaje claro del tema defence & operations.
Anomaly detection
Anomaly detection identifies unusual patterns and behaviour on systems and networks: instead of describing what is bad, it describes what is normal and alerts on what departs from it.
Antispyware
Antispyware is software built specifically to detect, prevent and remove spyware: programs that install without consent and quietly collect information, monitor behaviour or send data to somebody else.
Antivirus
Antivirus software detects, blocks and removes malicious software on a device, deciding whether a file is dangerous and stopping it before it runs.
Antivirus signature
An antivirus signature is the pattern an antivirus uses to recognise a malicious file somebody has already analysed: a byte sequence, a hash, or a rule about how the file is built. It recognises the known extremely well and, by definition, does not recognise what nobody has seen yet.
Asset inventory
An asset inventory is an authoritative and current list of the systems, services, accounts and data an organisation owns. In security it is the control everything else depends on, because scope, patching, monitoring and incident response all resolve against it: you cannot defend what is not on the list.
Attack surface
In security, the attack surface of an organisation is the complete set of points where someone outside it can interact with something inside it: domains, exposed services, APIs, client applications, third-party integrations and people. It is not a list of vulnerabilities. It is the list of places a vulnerability would count, and it changes daily.
Attack surface management (ASM)
In security operations, attack surface management (ASM) is the continuous discovery and assessment of external-facing assets and their exposures, from an attacker’s outside-in perspective. Its output is an inventory that is found rather than declared: the hosts, names, certificates and services that answer from the internet, whether or not anyone remembers creating them.
Availability
Availability is one of the three pillars of information security, alongside confidentiality and integrity: the system and the data are there when the people entitled to use them need them. It is the pillar that gets the least attention at design time and the first one the business notices when it fails.
B2B (business to business)
B2B describes commercial relationships and transactions between companies. In security terms it is where one organisation’s controls stop being sufficient, because the data and the access are now shared with somebody else’s estate.
Backup
In resilience and incident recovery, a backup is a separate copy of data and configuration held so that a known-good state can be restored after loss, corruption or ransomware. What makes a copy useful is not that it exists but that it is isolated from the thing that broke and that somebody has restored from it.
Backup site
A backup site is the secondary facility an organisation can move its critical systems and data to when the primary one is unavailable, whether because of a disaster, a hardware failure or an attack.
Business impact analysis (BIA)
A business impact analysis (BIA) answers one question with a great many consequences: how much it hurts, and from what hour, when each business process stops working. Out of it come the order in which things have to be recovered and the deadlines that order has to meet.
CERT (Computer Emergency Response Team)
A CERT, or Computer Emergency Response Team, is a specialist unit whose job is to respond to and manage information security incidents, and to coordinate that response with others.
Chain of custody
In cybersecurity, chain of custody is the documented, controlled process that keeps digital evidence intact and provable from the moment it is collected until it is presented in a legal setting.
CIS benchmarks
CIS Benchmarks are consensus configuration baselines, published by the Center for Internet Security, for hardening operating systems, cloud services, containers and applications. Each benchmark is a numbered list of settings with a rationale, an audit procedure and a remediation step, grouped into profiles by how much operational disruption they cause.
CISA KEV
The CISA KEV catalogue is a public list, maintained by the United States Cybersecurity and Infrastructure Security Agency, of vulnerabilities with reliable evidence of exploitation in the wild. In vulnerability management it is used as a factual signal that something is being exploited now, rather than as a prediction that it might be.
CMDB
A configuration management database, or CMDB, is the record of an organisation’s configuration items and, more importantly, the relationships between them. In security work it is what turns a list of hosts into a map: which service depends on which database, which application a certificate belongs to, and who owns the result.
CVE
In vulnerability management, a CVE is a public identifier assigned to a specific vulnerability in a product, so that everybody discussing it is discussing the same thing. It is a name, not a measurement: the identifier says a flaw was catalogued, and says nothing at all about how much it matters to you.
CVSS
In vulnerability management, CVSS is the Common Vulnerability Scoring System, an open framework for describing the characteristics and severity of a vulnerability as a number. It is a starting point for prioritisation and not a measure of your risk, because the score is a property of the flaw and risk is a property of your environment.
Defence in depth
Defence in depth is the practice of layering independent controls so that the failure of any single layer does not lead to compromise. In security architecture the operative word is independent: two controls that share an assumption, a credential or a management plane are one control drawn twice.
Detection engineering
In defensive operations, detection engineering is the discipline of building, testing and maintaining the logic that turns telemetry into alerts, treated as software rather than as configuration. Rules have requirements, versions, tests and owners, and a rule nobody has tested against real activity is an untested assumption.
Digital forensics
In incident work, digital forensics is the collection, preservation and analysis of evidence from affected systems in order to reconstruct what happened, in what order, and by whom. Its discipline is not the analysis but the preservation: evidence that cannot be shown to be unaltered answers questions in a technical meeting and nowhere else.
EDR
EDR, or endpoint detection and response, is an agent installed on servers and workstations that records what processes do, flags behaviour that matches known attacker techniques, and gives a responder the ability to investigate and isolate the machine. It records first and blocks second, which is what separates it from antivirus.
EPSS
In vulnerability prioritisation, EPSS is the Exploit Prediction Scoring System: a model published by FIRST that estimates the probability a given vulnerability will be exploited in the wild in the near term. It answers how likely, where severity scoring answers how bad, and the two questions have different answers.
Exposure management
In security operations, exposure management is the practice of continuously assessing which assets are reachable, which weaknesses are exploitable, and which actually matter, then driving those down. The market usually calls it CTEM, continuous threat exposure management, and its purpose is to turn a list of findings into an order of work.
False negative
A false negative is a real threat that a detection system fails to flag. It is the more expensive of the two errors, because nobody is looking at the thing that did not fire.
False positive
A false positive is an alert pointing at a threat that is not there: the tool has flagged normal activity as malicious. On its own it costs a few minutes. At volume it costs far more, because the team stops opening alerts and the one that mattered goes by without anybody looking at it.
Hardening
In systems security, hardening is the work of reducing what a system exposes and what it will do by default: removing components that are not needed, closing permissive defaults, and applying a configuration baseline. It changes what an attacker can reach and reuse after they arrive, which is why it survives an unpatched day.
Heuristic analysis
Heuristic analysis identifies threats by what a program does rather than by matching it to a known signature, which is what makes it able to catch something nobody has seen before, and what makes it produce false positives.
High availability
High availability is the ability of a system, network or service to stay operational and reachable without significant interruption, including when a component fails or something goes wrong.
Honeypot
A honeypot is a system that exists only to be attacked. It looks vulnerable and valuable, it is watched closely, and because nothing legitimate has any reason to touch it, every interaction with it is a signal.
Immutable backup
An immutable backup is a copy that cannot be modified or deleted until a retention period expires, enforced by the storage layer rather than by policy. In ransomware recovery it is the property that matters, because attackers routinely delete or encrypt backups before triggering the payload.
Incident response (IR)
In security operations, incident response is the full cycle of preparing for, detecting, containing, eradicating and recovering from a security incident, and of learning from it afterwards. Preparation is the phase that decides how the others go: almost every decision that determines the cost of an incident is made before it starts.
Indicator of compromise (IoC)
In detection and threat intelligence, an indicator of compromise is an observable artefact, such as a file hash, an address, a domain or a registry key, that is associated with malicious activity. Indicators are the cheapest form of intelligence to consume and the easiest for an adversary to change, which is exactly the trade-off.
Information asset
An information asset is any data, resource or component in a digital environment that has real value to an organisation, financial, strategic, operational or reputational. It is the unit everything else in security is measured against.
MDR
In security operations, MDR is managed detection and response: a service in which a provider supplies the analysts, the process and usually the tooling to monitor a client’s estate and act on what they find. It is bought instead of building a round-the-clock team, and what distinguishes it from older monitoring is the mandate to respond.
MITRE ATT&CK
MITRE ATT&CK is a public, curated knowledge base of what attackers actually do once they are inside, organised as tactics, which are the goals, and techniques, which are the ways of reaching them. It is a shared vocabulary for describing intrusions, not a maturity model and not a checklist to be completed.
Patch management
In security operations, patch management is the process of getting vendor fixes into production reliably and quickly, across every system that runs somebody else’s code. The gap between disclosure and deployment is where attackers live, and the length of that gap is a property of the process, not of the vulnerability.
Playbook
A playbook is a documented and repeatable procedure for handling one specific incident type, written so that responders do not have to improvise under pressure. In security operations it fixes the decisions, the thresholds and the authority to act in advance, when there is time to think about them properly.
SBOM
In software supply chain security, an SBOM is a software bill of materials: a formal, machine-readable inventory of the components in a piece of software, including transitive dependencies, with versions and relationships. It answers one question fast, namely whether you contain a given component, and it answers no other question at all.
Security hole
A security hole is a weakness in a system, network, application or any other digital component that an attacker can use to do something they should not be able to do.
Security incident detection
Security incident detection is the capability of noticing, quickly and accurately, that something happening on your networks, systems or applications is a security incident rather than ordinary activity.
Shadow IT
In security operations, shadow IT is the set of systems and services the business uses without the knowledge of security or IT: unmanaged and unmonitored. It is not usually rebellion. It is a team that needed something on Tuesday and found a way to have it working by Wednesday.
SIEM
A SIEM, or security information and event management platform, is where an organisation collects logs from its systems so they can be searched, correlated and retained. It is the place a security team asks what happened across the whole estate, and it detects only what somebody wrote a rule for.
SOAR
In security operations, SOAR is security orchestration, automation and response: tooling that connects the systems a security team uses and executes agreed sequences against them automatically. It is not a detection technology. It acts on decisions that have already been made, which is why it amplifies whatever the process already is.
SOC
In security operations, a SOC is a security operations centre: the team and tooling that monitor for and respond to threats, often around the clock. It is defined by an operating model rather than by a room, and its quality is measured by what it detects and how fast it acts, not by how many alerts it processes.
Software composition analysis (SCA)
In application security, software composition analysis is the identification of the third-party and open source components an application depends on, and of the known vulnerabilities and licence obligations attached to them. Most of the code in a modern application was written by somebody else, and this is the tooling that reads it.