Acronyms: every abbreviation the site defines

About 1 min read

Security writing runs on abbreviations, and a reader who meets one cold loses the sentence. This index lists every acronym the site spells out, with its expansion and a link to where it is defined. Where a glossary has an entry, the link goes there; otherwise it goes to the page that first spells it out, in reading order.

The index is built from the site’s own text, so it only lists what the site defines. If an acronym you met is missing here, the page that used it never expanded it, and that is worth a suggestion.

175 acronyms, from four glossaries and the chapter pages.

A

ABAC

Attribute-Based Access ControlC.L.E.A.R.: glossary entry

ACAS

Assured Compliance Assessment SolutionFirst defined on How ASSURED compares

ACH

Analysis of Competing HypothesesC.L.E.A.R.: glossary entry · first spelled out in Cognitive traps in triage

ADS

Alerting and Detection StrategyC.L.E.A.R.: glossary entry · first spelled out in How detections work

AI/ML

Artificial Intelligence / Machine LearningC.L.E.A.R.: glossary entry

AiTM

Adversary-in-the-MiddleC.L.E.A.R.: glossary entry · first spelled out in Escalation working example

AMSI

Antimalware Scan InterfaceFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

API

Application Programming InterfaceC.L.E.A.R.: glossary entry

APT

Advanced Persistent ThreatB.A.D.: glossary entry

ASN

Autonomous System NumberC.L.E.A.R.: glossary entry

B

BAA

business associate agreementFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

BEC

Business Email CompromiseC.L.E.A.R.: glossary entry

BGP

Border Gateway ProtocolC.L.E.A.R.: glossary entry

BITS

Background Intelligent Transfer ServiceFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

BOTS

Boss of the SOCC.A.T.: glossary entry

BPH

Bulletproof HostingB.A.D.: glossary entry

BYOD

Bring Your Own DeviceC.L.E.A.R.: glossary entry

BYOVD

Bring Your Own Vulnerable DriverB.A.D.: glossary entry

C

CAE

Continuous Access EvaluationC.L.E.A.R.: glossary entry

CASB

cloud access security brokerFirst defined on Subject working example

CCPA

California Consumer Privacy ActC.L.E.A.R.: glossary entry

CDE

Cardholder Data EnvironmentC.L.E.A.R.: glossary entry · first spelled out in Regulatory boundaries

CDN

content delivery networkFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

CDR

cloud detection and responseFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

CEF

Common Event FormatC.L.E.A.R.: glossary entry · first spelled out in Formats and normalization

CIRCIA

Cyber Incident Reporting for Critical Infrastructure ActC.L.E.A.R.: glossary entry · first spelled out in Internal and external escalation protocols

CIS

Center for Internet SecurityFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

CISA

Cybersecurity and Infrastructure Security AgencyFirst defined on Internal and external escalation protocols

CMDB

Configuration Management DatabaseC.L.E.A.R.: glossary entry

CNA

CVE Numbering AuthorityFirst defined on The priority matrix

CNAPP

cloud-native application protection platformFirst defined on Tool families

COM

Component Object ModelFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

ConfigMgr

Configuration ManagerFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

CQL

CrowdStrike Query LanguageC.A.T.: glossary entry

CRA

Cyber Resilience ActC.L.E.A.R.: glossary entry

CSF

Cybersecurity FrameworkFirst defined on Event triage vs. incident response

CSIRT

Computer Security Incident Response TeamC.L.E.A.R.: glossary entry · first spelled out in Internal and external escalation protocols

CSPM

Cloud Security Posture ManagementC.L.E.A.R.: glossary entry

CVE

Common Vulnerabilities and ExposuresC.L.E.A.R.: glossary entry

CVSS

Common Vulnerability Scoring SystemC.L.E.A.R.: glossary entry

D

DAIR

Dynamic Approach to Incident ResponseC.L.E.A.R.: glossary entry · first spelled out in Introduction to the ASSURED methodology

DAST

dynamic application security testingFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

DDR

Dead Drop ResolverB.A.D.: glossary entry

DGA

Domain Generation AlgorithmB.A.D.: glossary entry

DKIM

DomainKeys Identified MailC.L.E.A.R.: glossary entry

DLL

Dynamic Link LibraryC.L.E.A.R.: glossary entry

DLP

Data Loss PreventionC.L.E.A.R.: glossary entry · first spelled out in Hands-on exercises

DNS

Domain Name SystemC.L.E.A.R.: glossary entry

DORA

Digital Operational Resilience ActC.L.E.A.R.: glossary entry

DPA

data processing agreementFirst defined on Internal and external escalation protocols

DPI

Deep Packet InspectionC.L.E.A.R.: glossary entry

DPIA

data protection impact assessmentFirst defined on Insider analysis

DPO

Data Protection OfficerC.L.E.A.R.: glossary entry · first spelled out in Risk working example

E

ECH

Encrypted Client HelloFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

EDR

Endpoint Detection and ResponseC.L.E.A.R.: glossary entry · first spelled out in Hands-on exercises

EPSS

Exploit Prediction Scoring SystemC.L.E.A.R.: glossary entry

EQL

Event Query LanguageFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

ETW

Event Tracing for WindowsC.A.T.: glossary entry

F

FIM

File Integrity MonitoringC.L.E.A.R.: glossary entry · first spelled out in Telemetry sources

FIRST

Forum of Incident Response and Security TeamsFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

G

GDPR

General Data Protection RegulationC.L.E.A.R.: glossary entry

H

HIPAA

Health Insurance Portability and Accountability ActC.L.E.A.R.: glossary entry

HMI

human-machine interfaceFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

HTA

HTML ApplicationC.L.E.A.R.: glossary entry

HTTP

Hypertext Transfer ProtocolC.L.E.A.R.: glossary entry

I

IAB

Initial Access BrokerB.A.D.: glossary entry

IAM

identity and access managementFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

ICES

integrated cloud email securityFirst defined on Telemetry sources

ICS/OT

industrial control system and operational technologyFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

IDE

Integrated Development EnvironmentC.L.E.A.R.: glossary entry

IdP

Identity ProviderC.L.E.A.R.: glossary entry · first spelled out in Close or escalate: the criteria

IDS

Intrusion Detection SystemC.L.E.A.R.: glossary entry · first spelled out in The priority matrix

IGA

identity governanceFirst defined on The four dimensions of Subject analysis

IMDS

instance metadata serviceFirst defined on Cloud and identity logs

IoA

Indicator of AttackC.L.E.A.R.: glossary entry

IoC

Indicators of CompromiseC.L.E.A.R.: glossary entry · first spelled out in The one-page reference

IoT

Internet of ThingsC.L.E.A.R.: glossary entry

IP

Internet ProtocolFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

IPC

Inter-Process CommunicationC.L.E.A.R.: glossary entry

IPS

Intrusion Prevention SystemC.L.E.A.R.: glossary entry

IR

incident responseFirst defined on Introduction to the ASSURED methodology · first spelled out in Hands-on exercises

IRM

Insider Risk ManagementB.A.D.: glossary entry · first spelled out in Insider analysis

ISAC

Information Sharing and Analysis CenterC.L.E.A.R.: glossary entry · first spelled out in Documentation: Making the work durable

ISC

Internet Storm CenterFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

ITDR

Identity Threat Detection and ResponseC.L.E.A.R.: glossary entry · first spelled out in Behavioral analysis framework

K

KEV

Known Exploited VulnerabilitiesFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

L

LEQL

Log Entry Query LanguageFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

LLM

Large Language ModelC.L.E.A.R.: glossary entry

LOTL

Living Off the LandC.L.E.A.R.: glossary entry

LSASS

Local Security Authority Subsystem ServiceFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

M

MAC

Mandatory Access ControlC.L.E.A.R.: glossary entry

MAM

Mobile Application ManagementC.L.E.A.R.: glossary entry

MCP

Model Context ProtocolC.L.E.A.R.: glossary entry · first spelled out in Risk working example

MDM

mobile device managementFirst defined on Process relationships

MDR

Managed Detection and ResponseC.L.E.A.R.: glossary entry · first spelled out in Internal and external escalation protocols

MFA

Multi-Factor AuthenticationC.L.E.A.R.: glossary entry

MOTW

Mark of the WebC.L.E.A.R.: glossary entry

MSA

master service agreementFirst defined on Internal and external escalation protocols

MSDT

Microsoft Support Diagnostic ToolFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

MSP

managed service providerFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

MSSP

Managed Security Service ProviderC.L.E.A.R.: glossary entry · first spelled out in Internal and external escalation protocols

MTTA

Mean Time To AcknowledgeC.L.E.A.R.: glossary entry

MTTD

Mean Time To DetectC.L.E.A.R.: glossary entry

N

NAC

network access controlFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

NCISS

National Cyber Incident Scoring SystemFirst defined on The priority matrix

NDR

Network Detection and ResponseC.L.E.A.R.: glossary entry

NGFW

Next-generation firewallFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

NHI

Non-Human IdentityC.L.E.A.R.: glossary entry

NITTF

National Insider Threat Task ForceFirst defined on Insider analysis

NLA

Network Level AuthenticationFirst defined on Hands-on exercises

O

OCR

Office for Civil RightsC.L.E.A.R.: glossary entry

OFAC

Office of Foreign Assets ControlFirst defined on Internal and external escalation protocols

OISF

Open Information Security FoundationFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

OT/ICS

operational technology and industrial control systemsFirst defined on Infrastructure boundaries

OTRF

Open Threat Research ForgeFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

OUI

Organizationally Unique IdentifierC.L.E.A.R.: glossary entry

P

P2P

Peer-to-PeerFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

PAM

Privileged Access ManagementC.L.E.A.R.: glossary entry · first spelled out in Insider analysis

PAP

Permissible Actions ProtocolC.L.E.A.R.: glossary entry

PAT

Personal Access TokenC.L.E.A.R.: glossary entry

PFI

PCI Forensic InvestigatorFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

PHI

Protected Health InformationC.L.E.A.R.: glossary entry · first spelled out in Regulatory boundaries

PII

Personally Identifiable InformationC.L.E.A.R.: glossary entry

PIR

post-incident reviewFirst defined on Documentation: Making the work durable

PKI

public key infrastructureFirst defined on Insider analysis

PRT

Primary Refresh TokenC.L.E.A.R.: glossary entry

Q

QA

quality assuranceFirst defined on Adopting ASSURED in your SOC · first spelled out in Teaching ASSURED

R

RaaS

Ransomware-as-a-ServiceB.A.D.: glossary entry

RAG

Retrieval-Augmented GenerationC.L.E.A.R.: glossary entry

RAT

Remote Access TrojanB.A.D.: glossary entry

RBA

Risk-Based AlertingC.L.E.A.R.: glossary entry · first spelled out in The priority matrix

RBAC

Role-Based Access ControlC.L.E.A.R.: glossary entry

RCA

Root cause analysisFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

RCE

remote code executionFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

RDP

Remote Desktop ProtocolFirst defined on Hands-on exercises

RFC

Request for CommentsC.L.E.A.R.: glossary entry

RLO

Right-to-Left OverrideB.A.D.: glossary entry

RPA

robotic process automationFirst defined on Hands-on exercises

RPO

recovery point objectivesFirst defined on Impact and likelihood

RTO

Recovery time objectivesFirst defined on Impact and likelihood

S

SCADA

supervisory control and data acquisitionFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

SCC

Standard Contractual ClausesC.L.E.A.R.: glossary entry

SEC

Securities and Exchange CommissionFirst defined on Close or escalate: the criteria

SEG

Secure Email GatewaysC.L.E.A.R.: glossary entry · first spelled out in Telemetry sources

SHA

Secure Hash AlgorithmC.L.E.A.R.: glossary entry

SIEM

Security Information and Event ManagementC.L.E.A.R.: glossary entry · first spelled out in Tool families

SITM

Security Incident Timing MetricsC.L.E.A.R.: glossary entry · first spelled out in Measuring triage

SLA

service-level agreementFirst defined on Internal and external escalation protocols

SMB

Server Message BlockC.L.E.A.R.: glossary entry

SOAR

Security Orchestration, Automation, and ResponseC.L.E.A.R.: glossary entry

SOC

Security Operations CenterC.L.E.A.R.: glossary entry · first spelled out in Introduction to the ASSURED methodology

SOP

standard operating procedureFirst defined on Adopting ASSURED in your SOC

SPF

Sender Policy FrameworkC.L.E.A.R.: glossary entry

SQLi

SQL injectionFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

SSE

security service edgeFirst defined on Security Tool & Platform Reference (the C.A.T. Glossary)

SSH

Secure ShellC.L.E.A.R.: glossary entry

SSL

Secure Sockets LayerC.L.E.A.R.: glossary entry

SSO

Single Sign-OnC.L.E.A.R.: glossary entry

SSVC

Stakeholder-Specific Vulnerability CategorizationC.L.E.A.R.: glossary entry · first spelled out in The priority matrix

T

TGT

Ticket Granting TicketFirst defined on Cloud and identity logs

TIP

threat intelligence platformFirst defined on Tool families

TLP

Traffic Light ProtocolC.L.E.A.R.: glossary entry

TLS

Transport Layer SecurityC.L.E.A.R.: glossary entry

TTL

Time To LiveC.L.E.A.R.: glossary entry

TTP

Tactics, Techniques, and ProceduresC.L.E.A.R.: glossary entry · first spelled out in How detections work

U

UEBA

User and Entity Behavior AnalyticsC.L.E.A.R.: glossary entry · first spelled out in Insider analysis

UEM

Unified Endpoint ManagementC.L.E.A.R.: glossary entry

URL

Uniform Resource LocatorC.L.E.A.R.: glossary entry

USN

Update Sequence NumberFirst defined on Threat Behavior & Adversary Reference (the B.A.D. Glossary)

V

VDI

Virtual Desktop InfrastructureC.L.E.A.R.: glossary entry

VDP

Vulnerability Disclosure ProgramC.L.E.A.R.: glossary entry

VPN

Virtual Private NetworkC.L.E.A.R.: glossary entry

W

WCAG

Web Content Accessibility GuidelinesFirst defined on Accessibility

WORM

Write Once, Read ManyFirst defined on C.L.E.A.R. Glossary: core analyst vocabulary

Z

ZDR

Zero Data RetentionC.L.E.A.R.: glossary entry

The four glossaries define the terms in full: ASSURED terms for the method’s own vocabulary, C.L.E.A.R. for the analyst lexicon, B.A.D. for threats and adversaries, and C.A.T. for tools and platforms.