Core Security Terms

What it is

This page defines nine terms that security operations teams use every day.

They fall into three groups. Some describe how a team learns about attackers, some describe how it studies and detects attacks, and some describe how it builds and responds more safely.

You need to recognise each term from a short description, so focus on what each one does and how it differs from its neighbours.

How it works

Each term names one activity in the cycle of learning, looking, analysing and responding.

Threat intelligence and threat actors

Threat intelligence (TI) is information about threats that helps defenders make decisions. It includes indicators such as bad IP addresses, file hashes and domains. It also includes the methods attackers use and who is behind them.

A threat actor is the person or group behind an attack. Examples include criminal gangs after money, nation state groups after secrets, hacktivists with a cause, and insiders with access.

Threat hunting

Threat hunting is a proactive search for attackers who have not triggered an alert. The hunter starts from an idea, such as an attacker technique or a piece of intelligence, and looks through the data for signs of it.

Normal monitoring waits for an alert. Hunting assumes that something may already be inside and goes looking.

Malware analysis and reverse engineering

Malware analysis studies a suspicious file to learn what it does. There are two approaches:

• Static analysis examines the file without running it, for example by reading strings and checking its hash.
• Dynamic analysis runs the file in a safe, isolated environment and watches its behaviour.

Reverse engineering goes deeper. The analyst works back from the compiled program toward its logic, often with a disassembler or debugger. It is used to understand how a piece of malware works or to find flaws in software.

Run book automation (RBA)

A run book is a written set of steps for handling a situation, such as a phishing report. Run book automation turns those steps into automated actions.

It cuts response time and gives a consistent result every time. SOAR platforms are a modern form of this idea.

Sliding window anomaly detection

Anomaly detection looks for activity that differs from normal. A sliding window measures activity over a recent span of time, such as the last hour, and the window moves forward as time passes.

The tool compares the current window to a baseline. If logins per hour suddenly jump far above the usual level, the window raises an alert. Because the window slides, old activity drops out and recent activity is always counted.

Threat modeling

Threat modeling is a structured way of finding what could go wrong with a system, before it is attacked. The team identifies assets, entry points and possible attackers, then decides which threats matter most and what controls to add.

It is best done early in design, when changes are cheap.

DevSecOps

DevSecOps builds security into the software delivery process instead of adding it at the end. Security checks run automatically as code is written, built, tested and deployed. Developers, operations and security staff share responsibility.