SNAP key terms

A layered security strategy that stacks independent controls across network, host, application, and data tiers so a single failed control does not expose the whole environment. Each layer assumes the others may be breached.

Dividing a network into isolated zones with enforced traffic boundaries so compromise in one zone cannot spread freely. Segmentation is typically implemented with VLANs, firewalls, or software-defined policies.

An ordered set of permit and deny rules applied to network traffic based on attributes such as source address, destination address, protocol, and port. Rules are evaluated top-down and the first match wins.

A firewall technique that tracks active connection state and allows return traffic for sessions initiated from inside, rather than evaluating every packet in isolation against static rules.

A firewall that combines stateful inspection with application identification, user awareness, intrusion prevention, and threat intelligence to make policy decisions beyond IP address and port.

An encrypted tunnel that carries traffic between remote users or sites over an untrusted network. VPNs provide confidentiality and often authenticate endpoints before granting internal access.

A suite of protocols that authenticates and encrypts IP packets at the network layer, commonly used for site-to-site tunnels. It relies on security associations negotiated by IKE.

A secret value configured on both ends of a connection to authenticate peers, often in VPN or wireless setups. Because every holder shares the same secret, compromise of one endpoint exposes the key.

A trusted entity that issues and signs digital certificates binding a public key to an identity. Clients rely on the CA's signature to verify that a presented certificate is genuine.

The policies, roles, and systems that issue, distribute, validate, and revoke digital certificates. PKI underpins authentication and encryption for TLS, VPNs, and endpoint certificates.

A signed list published by a certificate authority identifying certificates that were revoked before their expiration date. Clients check it, or use OCSP, to reject untrusted certificates.

An IEEE standard for port-based network access control that authenticates a device or user before allowing traffic on a switch port or wireless association. It uses a supplicant, authenticator, and authentication server.

A protocol that centralizes authentication, authorization, and accounting for network access. In 802.1X deployments the switch or wireless controller forwards credentials to the RADIUS server, which returns accept or reject.

A system that evaluates endpoint identity, credentials, and health posture before granting network access, then places devices into appropriate VLANs or quarantine based on policy.

A posture assessment that inspects an endpoint for required security conditions, such as current antivirus definitions, patched operating system, and enabled encryption, before allowing network access.

A restricted network segment where noncompliant or unknown devices are placed for remediation. Hosts there typically reach only update servers and remediation portals, not production resources.

A security solution that continuously records endpoint process, file, and network telemetry, applies behavioral analytics to detect threats, and provides response actions such as isolation or process termination.

A containment action that cuts a compromised host off from most network communication while preserving the management channel to the security console, allowing investigation without spreading the threat.

Identifying malicious activity by analyzing patterns of action, such as unusual process parentage or rapid file encryption, rather than matching known file signatures. It catches new variants that evade static detection.

Identifying threats by matching file or traffic characteristics against a database of known malicious patterns. It is fast and precise for known threats but blind to novel or heavily modified malware.

Observable artifacts suggesting a system has been breached, such as malicious file hashes, command-and-control domains, registry keys, or unexpected outbound connections. They support detection and threat hunting.

Evidence of active adversary behavior or intent, such as credential dumping or lateral movement, rather than static artifacts. IOAs focus on what an attacker is doing and often survive changes in tooling.

Malware that encrypts or exfiltrates victim data and demands payment for restoration or to prevent release. Modern variants often steal data first to enable double extortion.

Techniques an attacker uses to move from an initially compromised host to other systems, such as remote service abuse or stolen credentials. Detecting it requires monitoring authentication and remote execution activity.

A social engineering attack that impersonates a trusted party through email, messaging, or a fake site to trick recipients into revealing credentials or running malicious content.

A targeted phishing attempt crafted for a specific person or group using researched details to appear credible. It often precedes credential theft or malware delivery in targeted intrusions.

Manipulating people into breaking normal security procedures through deception, urgency, or authority. Technical controls alone cannot fully prevent it, so awareness training and verification processes matter.

The unauthorized transfer of data from an organization's network to an attacker-controlled destination. It may occur over encrypted channels or be disguised as normal traffic.

Granting users and processes only the access needed to perform their tasks, and no more. This limits the blast radius of compromised accounts and accidental misuse.

An authorization model that assigns permissions to roles rather than individuals, with users granted roles. It simplifies administration and supports consistent enforcement of least privilege.

Splitting critical tasks among multiple people so no single individual can complete a sensitive action alone. It reduces fraud risk and insider misuse in areas such as change management and access approval.

Technology that inspects content in motion, at rest, or in use and blocks or logs transfers matching sensitive-data policies, such as personal identifiers or card numbers leaving the network.

Categorizing information by sensitivity, such as public, internal, confidential, and restricted, so handling, storage, and protection requirements can be applied consistently.

Protecting stored data by encrypting it on disk or in a database so it remains unreadable without the key. It mitigates exposure from lost devices, stolen drives, or leaked backups.

Encrypting an entire storage volume, including the operating system and temporary files, so data is protected whenever the device is powered off or the volume is removed.

The lifecycle practices for generating, storing, rotating, escrowing, and destroying cryptographic keys. Weak key handling undermines even strong encryption algorithms.

A platform that collects logs and events from many sources, correlates and alerts on them, and supports investigation. It provides centralized visibility across network and endpoint devices.

Logic in a monitoring platform that links multiple events across sources and time to raise a higher-confidence alert, such as several failed logons followed by a success from one host.

An alert raised for activity that is actually benign. Excessive false positives cause alert fatigue and can lead analysts to miss genuine incidents.

The policy and configuration defining how long log data is kept and how it is protected from tampering. Retention periods are often driven by compliance requirements and investigation needs.

The phase of incident response that stops the spread of an active threat, for example by isolating hosts, disabling accounts, or blocking malicious destinations, before eradication and recovery.

A documented set of roles, procedures, and communication paths for detecting, containing, eradicating, and recovering from security incidents. It is exercised through periodic tabletop or simulation drills.

A documented record of who handled evidence, when, and how, from collection through storage and analysis. It preserves evidentiary integrity for legal or disciplinary proceedings.

A structured process that identifies assets and threats, estimates likelihood and impact, and prioritizes risk treatment. Results guide control selection and spending decisions.

The risk that remains after existing or planned controls are applied. Management formally accepts residual risk when it falls within the organization's defined tolerance.

Choosing how to address an identified risk: mitigate it with controls, transfer it such as through insurance, avoid the activity, or accept it with documented approval.

Recurring education that teaches employees to recognize phishing, handle data correctly, and report suspicious activity. Effectiveness is best measured through simulated attacks and reporting rates.

Curated information about adversaries, their tools, and their infrastructure that informs detection and prioritization. It ranges from tactical indicators to strategic reporting on actor behavior.

Adjusting detection rules, thresholds, and exclusions so alerts reflect real risk while suppressing known benign activity. Ongoing tuning keeps monitoring effective as the environment changes.