DSTC key terms

A person or group that carries out or sponsors attacks, ranging from opportunistic criminals to state-backed teams. Their motivation, skill, and resources shape the techniques they use.

The total set of points where an attacker could try to enter or influence a system, including exposed services, user accounts, and third-party connections. Reducing it lowers the number of ways in.

Information about current and emerging adversaries, their tools, and their methods, collected and analyzed to guide defensive decisions. It converts raw observations into context a team can act on.

An observable artifact such as a malicious file hash, domain, or IP address that suggests a system has been breached. These are reactive clues and can become stale quickly.

Evidence of adversary behavior in progress, such as unusual command execution or lateral movement, rather than a static artifact. It focuses on what the attacker is doing so defenders can respond sooner.

A social engineering attack that tricks a person into revealing credentials, running malware, or transferring funds, usually through a deceptive message. Variants target specific individuals or use other channels.

Manipulating people through trust, urgency, or authority to get them to break normal security procedures. Technical controls alone rarely stop it, so awareness and verification habits matter.

Malware that encrypts or steals data and demands payment for restoration or non-disclosure. Reliable offline backups and rapid containment limit its impact.

Software written to harm, spy on, or gain unauthorized control of a system, including viruses, worms, trojans, and spyware. Detection relies on signatures, behavior analysis, and user reporting.

A software flaw that is unknown to the vendor or has no available fix at the time of exploitation. Defenders must rely on behavior-based detection and compensating controls rather than patching.

Layering independent security controls so that failure or bypass of one layer does not expose the whole environment. Examples include network filtering, endpoint protection, and access controls working together.

Dividing a network into zones with controlled traffic between them so a compromise stays contained. It limits lateral movement and can enforce different policy per zone.

A device or software that permits or blocks network traffic according to rules about addresses, ports, and protocols. It is a primary boundary control between trust zones.

A sensor that monitors network or host activity for suspicious patterns and raises alerts without blocking traffic. An intrusion prevention system adds the ability to drop malicious traffic.

An encrypted tunnel that carries traffic between a remote device and a trusted network over an untrusted medium. It protects confidentiality in transit but does not make the endpoint itself trustworthy.

A design principle that grants no implicit trust based on network location and instead verifies every request using identity, device health, and context. Access is continuously evaluated and kept minimal.

A cryptographic protocol that encrypts and authenticates data exchanged between clients and servers. Proper certificate validation and current versions are essential to prevent interception.

A tool installed on hosts that records process, file, and network activity and enables investigation and containment from a central console. It detects behavior that signatures alone would miss.

Reducing a host's exposure by removing unnecessary software and services, restricting permissions, and applying secure configuration baselines. It shrinks the ways an attacker can abuse the device.

The process of identifying, testing, and deploying software updates that fix defects and close vulnerabilities. Timely patching removes a large share of exploitable weaknesses.

A control that permits only explicitly approved programs to run and blocks everything else. It is effective against unknown malware but requires ongoing maintenance of the approved list.

Giving users, services, and processes only the access needed to perform their defined tasks. It limits the damage any single compromised account or program can cause.

Requiring two or more independent proofs of identity, such as a password plus a hardware token, before granting access. It blocks most credential theft and replay attacks.

Assigning permissions to job roles rather than to individuals, so users inherit rights through their role membership. This simplifies administration and keeps access consistent.

Tools and processes that control, vault, and log the use of high-powered accounts such as administrators and service accounts. It reduces the risk and blast radius of credential misuse.

An arrangement where separate systems trust a common identity provider to authenticate users, so one set of credentials works across organizations. Trust is established through signed assertions and metadata.

A mechanism letting a user authenticate once and reach multiple applications without signing in again. It improves usability but makes the primary credential a high-value target.

A documented set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from a security incident. It is tested through exercises so the team acts consistently under pressure.

The response phase that stops an incident from spreading, for example by isolating hosts or disabling accounts. It balances limiting damage against preserving evidence.

A documented record of who handled evidence, when, and how, from collection through storage and analysis. It preserves the evidence's credibility for legal or disciplinary proceedings.

The disciplined collection and analysis of digital evidence to reconstruct what happened during an incident. It requires preserving data integrity and following accepted procedures.

A structured post-incident meeting that examines what worked, what failed, and which controls or procedures should change. Its output feeds improvements back into prevention and response.

A platform that centralizes logs from many sources, correlates events, and generates alerts for analysts. It is the backbone of a monitoring and detection program.

A team and facility responsible for continuously monitoring, triaging, and responding to security events. It coordinates detection tools, analysts, and escalation paths.

Collecting, storing, and retaining event records from systems and applications so activity can be reviewed later. Adequate retention and time synchronization make investigations possible.

A repeating cycle of discovering assets, scanning for weaknesses, prioritizing findings by risk, and tracking remediation. Prioritization matters because not every finding can be fixed at once.

The process of identifying threats and weaknesses, then estimating the likelihood and impact of harm to decide how to treat each risk. Results guide where controls and spending are directed.

Choosing how to handle an identified risk: mitigate it with controls, transfer it such as through insurance, accept it, or avoid the activity. Each choice should be documented and owned.

A management-approved statement of rules and expectations for protecting information and systems. It provides the authority behind standards, procedures, and enforcement.

An independent examination of controls and records to determine whether an organization meets a standard, regulation, or internal policy. Findings typically require documented corrective action.

Labeling information by sensitivity and business value so handling rules can be applied consistently. It drives decisions about storage, sharing, encryption, and retention.