Network Security Analyst key terms

The three core goals of information security: confidentiality keeps data from unauthorized readers, integrity keeps it unaltered and trustworthy, and availability keeps it reachable when legitimate users need it.

Layering independent controls across network, host, application, and identity so that one failed safeguard does not expose the whole environment. Each layer assumes the one before it may be bypassed.

Dividing a network into zones separated by firewalls or routing policy so traffic between zones is explicitly permitted. Limits lateral movement after compromise and reduces the blast radius of a single exposed host.

A buffer zone holding internet-facing services, isolated from the internal network by firewalls on both sides. Compromise of a public web server in the DMZ should not grant direct access to internal systems.

A packet filter that tracks connection state, allowing return traffic for sessions it observed being initiated. Decisions depend on the flow table rather than inspecting each packet in isolation.

An ordered list of permit and deny rules applied to interfaces or resources. Rules are evaluated top-down and the first match wins, so placement order determines the effective policy.

The default behavior of blocking traffic not explicitly permitted by a policy. Security designs should rely on this default so newly added services are not unintentionally exposed.

Granting users, services, and processes only the access needed for their function, for only as long as needed. Reduces the damage an attacker can do with a stolen account or compromised application.

A model that treats no network location as inherently trusted and verifies identity and device posture for every request. Access is granted per session rather than by being inside a perimeter.

Rewriting source or destination addresses as packets cross a boundary, commonly to let private hosts share public addresses. It complicates logging because external observers see only the translated address.

An intermediary that terminates client connections and opens new ones on their behalf. Enables content inspection, caching, and logging of the actual destination requested.

Decrypting TLS traffic at a controlled middlebox, inspecting the plaintext, then re-encrypting toward the destination. Requires distributing a trusted certificate to clients and raises privacy and legal considerations.

Protecting stored data with cryptography so stolen disks or backups are unreadable without keys. Complements, but does not replace, access control on the running system.

The lifecycle practices for generating, distributing, rotating, storing, and destroying cryptographic keys. Weak key handling defeats strong algorithms, so it is often the practical weak point.

A framework of certificate authorities, registration processes, and revocation mechanisms that binds public keys to identities. Relies on trust anchors distributed with clients and on timely revocation checking.

Identifying assets, threats, and vulnerabilities, then estimating likelihood and impact to prioritize treatment. Produces a documented basis for accepting, mitigating, transferring, or avoiding each risk.

Automated probing of hosts and services to identify known weaknesses and missing patches. Produces findings that require validation, since false positives and false negatives are common.

Code or a technique that takes advantage of a specific vulnerability to achieve unintended behavior, such as code execution. Its existence changes a theoretical weakness into an actively dangerous one.

Observable evidence suggesting a system has been breached, such as unusual outbound connections, unexpected scheduled tasks, or known malicious file hashes. Useful for detection but can be changed by attackers.

Tactics, techniques, and procedures: the behavioral patterns of an adversary, describing how they operate rather than what artifacts they leave. Harder for attackers to change than hashes or domains.

A public knowledge base cataloging adversary tactics and techniques observed in real intrusions. Analysts map detections and incidents to it to find coverage gaps and communicate behavior consistently.

Indicators of compromise are artifacts showing a breach already happened; indicators of attack are behaviors suggesting an intrusion is underway. IOAs support earlier detection but need tuning to limit false positives.

A passive sensor that inspects traffic or host activity and raises alerts on suspicious patterns without blocking. Detection quality depends on signature currency and on where the sensor is placed.

An inline device that can drop or reset traffic it judges malicious, in addition to alerting. Because it sits in the path, a bad rule or overload can disrupt legitimate business traffic.

An alert raised for activity that is actually benign. High rates exhaust analysts and encourage ignoring alerts, so tuning and documented triage criteria matter as much as detection coverage.

Malicious activity that goes undetected because no rule or analytic matched it. Measuring these requires threat hunting, red-team exercises, or post-incident review rather than alert statistics.

A platform that centralizes logs, normalizes fields, correlates events, and triggers alerts. Its value depends on reliable log ingestion and on rules that reflect the environment, not just vendor defaults.

Mapping vendor-specific log fields into a common schema so events from different sources can be compared and correlated. Inconsistent parsing silently breaks detection rules and dashboards.

Keeping clocks across devices aligned, typically with NTP, so events can be ordered correctly. Skewed timestamps corrupt correlation and undermine any timeline built during an investigation.

Summary records of network conversations, capturing addresses, ports, byte counts, and timings without payload. Efficient for spotting beaconing and data-volume anomalies across large networks.

Recording raw packet data for later analysis, usually with a rolling buffer to limit storage. Full payloads answer questions flow records cannot, but raise privacy and retention concerns.

Regular, automated callbacks from compromised hosts to attacker infrastructure. Detected by finding periodic connections with consistent intervals or uniform payload sizes that stand out from normal traffic.

The channel attackers use to task compromised systems and receive results. Often disguised as normal web or DNS traffic, so detection focuses on anomalies rather than known bad addresses alone.

Proactively searching for undetected adversary activity using hypotheses derived from TTPs and environment knowledge. Success is measured by findings and improved detections, not by alert counts.

Designing, testing, and maintaining detection logic with version control, documented intent, and measured false-positive rates. Treats detections as a product that needs validation against real telemetry.

Reviewing alerts to decide severity, validity, and next action, usually against documented criteria. Consistent triage prevents both alert fatigue and missed escalations.

A documented, repeatable procedure for handling a specific incident type, listing steps, owners, and decision points. Reduces variation under pressure and makes response measurable and improvable.

The phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment choices balance stopping spread against preserving evidence.

A documented, unbroken record of who handled evidence, when, and how, from collection through storage and analysis. Gaps can render evidence unusable in legal or disciplinary proceedings.

Capturing volatile data such as memory and connections before shutdown, and hashing images to prove integrity. Order of volatility dictates what to collect first.

Limiting an incident's spread, for example by isolating a host or blocking a domain. Aggressive containment stops damage fast but may tip off attackers or destroy useful forensic data.

Removing the root cause of an incident, such as malware, malicious accounts, or the vulnerability that allowed entry. Skipping it lets the attacker return through the same path.

Restoring affected systems to normal operation with verified clean state and heightened monitoring. Validation matters because premature restoration can reintroduce the compromise.

A structured post-incident review producing concrete changes to controls, detections, and procedures, with owners and dates. Without tracked follow-up it becomes a document nobody acts on.

The defined sequence of people to notify as an incident's severity or scope grows, with contact details and authority limits. Ambiguity here causes delays at the worst moment.

A standardized score combining impact and urgency to drive response timelines and notification duties. Should reflect business context, not just the technical noise of the alert.

Determining the underlying condition that allowed an incident, rather than the immediate trigger. Often reveals process or configuration gaps that recur across multiple incidents.

Quantified measures such as mean time to detect, mean time to respond, and alert closure rates. Useful only when definitions are stable and the numbers drive decisions rather than decoration.

Communicating security status and incidents to technical and executive audiences with appropriate detail and framing. Executives need risk and business impact; engineers need evidence and specifics.

Step-by-step operational instructions for routine tasks such as log source onboarding or sensor failover. Differs from a playbook in covering maintenance rather than incident decisions.

Maintained records of architecture, configurations, contacts, and procedures that let others understand and operate the environment. Stale documentation is a common cause of slow incident response.

Artifacts such as logs, tickets, and approvals that demonstrate a control operated as required. Collecting them continuously is cheaper than reconstructing them during an audit.

A target for a measurable operational outcome, such as closing high-severity alerts within a set time. Provides an objective basis for staffing and process discussions.