eCDFP key terms

A security strategy that uses multiple overlapping layers of controls so that if one fails, others continue to protect assets. Layers may include physical, network, endpoint, application, and data safeguards.

The principle of granting users, processes, and systems only the minimum access rights necessary to perform their functions, thereby reducing the attack surface and limiting damage from compromised accounts.

A model describing the three core goals of information security: confidentiality (preventing unauthorized disclosure), integrity (preventing unauthorized modification), and availability (ensuring timely access to data and services).

The process of identifying assets, threats, and vulnerabilities, then estimating the likelihood and impact of potential adverse events to prioritize security controls and resource allocation.

A structured method for identifying potential threats, attack vectors, and mitigations early in system design, often using frameworks like STRIDE or attack trees to anticipate adversary behavior.

The sum of all points where an unauthorized user could try to enter or extract data from an environment, including exposed services, APIs, user interfaces, and physical entry points.

The practice of dividing a network into smaller, isolated segments to limit lateral movement and contain breaches. Segmentation can be implemented with VLANs, firewalls, or software-defined networking policies.

Packet Capture: a file containing raw network traffic recorded at a capture point. Analysts use PCAPs with tools like Wireshark or tcpdump to reconstruct sessions and inspect payloads.

A technique that examines the content and headers of network packets beyond basic filtering, often used by firewalls and intrusion detection systems to detect malware, policy violations, or anomalies.

The study of summarized network connection metadata (e.g., source/destination IP, ports, bytes, timestamps) rather than full packet payloads, useful for identifying traffic patterns and anomalies at scale.

A Cisco-developed protocol for exporting flow records from routers and switches. NetFlow data includes IP addresses, ports, protocol, and byte counts, enabling traffic profiling and anomaly detection.

IP Flow Information Export: an IETF standard derived from NetFlow v9 for exporting flow information from network devices. It is extensible and widely supported for flow-based monitoring.

A system that monitors network or host activity for malicious behavior or policy violations and generates alerts. IDS can be signature-based, anomaly-based, or hybrid.

A security control that inspects traffic and can actively block or drop malicious activity in addition to alerting, often deployed inline at network choke points.

Techniques adversaries use to move from one compromised host to other systems within a network, often via remote services, credential theft, or trust relationships, to escalate privileges and access data.

A category of security tools that continuously monitor endpoint activity, record telemetry, and provide detection, investigation, and response capabilities for threats on hosts.

Monitoring and analysis of activity on a single host, such as file integrity, process execution, and system calls, to detect malicious behavior or policy violations.

A control that tracks changes to critical files and directories by comparing cryptographic hashes or attributes against a known baseline, alerting on unauthorized modifications.

A documented, approved state of a system's configuration, file hashes, or network behavior used as a reference to detect deviations that may indicate compromise or misconfiguration.

The act of gaining higher-level permissions than initially granted, either vertically (e.g., user to administrator) or horizontally (accessing another user's resources), often a key step in an attack chain.

An attack technique that uses legitimate, pre-installed system tools (e.g., PowerShell, WMI, bash) to perform malicious actions, making detection harder because the tools themselves are trusted.

A Windows system service and device driver that logs detailed system activity-such as process creation, network connections, and file changes-to the Windows event log for security monitoring.

A built-in Windows logging facility that records system, application, and security events. Security-relevant events include logon attempts (4624/4625), process creation (4688), and service installation (7045).

A standard protocol and message format for sending event logs from network devices and Unix-like systems to a central collector, facilitating centralized monitoring and correlation.

The process of collecting logs from multiple sources into a central repository to enable searching, correlation, and long-term retention for security analysis and compliance.

Security Information and Event Management: a platform that aggregates, normalizes, correlates, and analyzes log data from diverse sources, providing alerting and dashboards for security operations.

A logic expression in a SIEM or detection platform that matches patterns across multiple events or sources (e.g., multiple failed logons followed by a success) to generate high-fidelity alerts.

An alert that incorrectly indicates malicious activity when the underlying behavior is benign. High false positive rates can cause alert fatigue and desensitize analysts.

The process of adjusting detection rules, thresholds, and filters to reduce false positives and false negatives while maintaining sensitivity to true threats, often based on environmental baselines.

The automated collection and transmission of data from endpoints, network devices, and applications for monitoring and analysis. Telemetry feeds detection engines and threat hunting activities.

A documented set of procedures and roles for detecting, containing, eradicating, and recovering from security incidents, including communication and escalation paths.

A structured framework for handling incidents, typically including preparation, identification, containment, eradication, recovery, and lessons learned phases, often based on NIST SP 800-61.

The phase of incident response focused on limiting the spread and impact of an incident, for example by isolating hosts, blocking network traffic, or disabling compromised accounts.

The incident response phase that removes the root cause of an incident, such as deleting malware, closing vulnerabilities, and resetting compromised credentials, before recovery begins.

The phase of incident response that restores affected systems and data to normal operation, verifying integrity and monitoring for signs of re-infection or residual compromise.

A post-incident review that documents what happened, what worked, and what needs improvement, leading to updates in procedures, controls, and training to strengthen future response.

A proactive, hypothesis-driven process of searching for undetected adversaries or malicious activity within an environment, using telemetry, analytics, and threat intelligence rather than waiting for alerts.

A forensic artifact or observable (e.g., file hash, IP address, domain, registry key) that suggests a system or network may have been breached, often used to scope and detect incidents.

A behavioral or contextual sign that an attack is in progress or imminent, focusing on adversary tactics and intent rather than static artifacts, making it more resilient to attacker changes.

The infrastructure and communication channels adversaries use to remotely control compromised systems, often employing covert channels such as DNS tunneling or encrypted web traffic.

Regular, periodic network communication from an infected host to an attacker-controlled server, used to check for instructions. Its predictable timing can be detected through traffic analysis.