Cybersecurity glossary.
Concise definitions of security operations, incident response, risk, evidence and web-security terms used throughout Cybatar.
Attack Surface
An attack surface is the set of systems, interfaces, identities, services and other reachable conditions that could provide a path for unauthorised access or harmful activity.
Full definition →DefinitionChain of Custody
Chain of custody is the documented history of how an evidence item was collected, transferred, accessed, stored and handled.
Full definition →DefinitionCompliance Evidence
Compliance evidence is information or an artefact used to support an assessment of whether a control or requirement is implemented and operating as intended.
Full definition →DefinitionCyber Risk
Cyber risk is the potential for cybersecurity threats or failures to create adverse consequences for an organisation, considering likelihood, impact and business context.
Full definition →CTICyber Threat Intelligence
Cyber threat intelligence is analysed information about threats, adversaries, indicators and behaviours that helps organisations make security decisions.
Full definition →DefinitionDigital Forensics
Digital forensics is the disciplined preservation, examination, analysis and documentation of digital evidence so findings can be traced to their source and handling history.
Full definition →DefinitionExposure Management
Exposure management is the continuous process of identifying, contextualising, prioritising and reducing security weaknesses and attack paths that could materially affect an organisation.
Full definition →IRIncident Response
Incident response is the organised process of preparing for, detecting, analysing, containing, recovering from and learning from cybersecurity incidents.
Full definition →IOCIndicator of Compromise
An indicator of compromise is an observable artefact or value that may be associated with malicious activity, such as an IP address, domain, URL, file hash or other technical indicator.
Full definition →DefinitionRisk Treatment
Risk treatment is the selected response to a risk, such as mitigating, transferring, avoiding or accepting it, together with the actions and monitoring required to carry out that decision.
Full definition →DefinitionSecurity Event
A security event is an observable occurrence in a system, application, network or security control that may be relevant to monitoring, detection, investigation or assurance.
Full definition →DefinitionSecurity Evidence
Security evidence is information or an artefact retained to support a security finding, incident conclusion, control assessment, investigation or governance decision.
Full definition →SIEMSecurity Information and Event Management
SIEM is a capability for centralising security-relevant events and logs, supporting search and analysis, correlating activity and generating detections or alerts.
Full definition →DefinitionSecurity Operations
The coordinated discipline of monitoring security-relevant activity, analysing and prioritising signals, responding to incidents, preserving evidence and improving defensive posture over time.
Full definition →SOCSecurity Operations Centre
A security operations centre is the organisational function, team or service responsible for continuously monitoring, detecting, investigating and responding to cybersecurity activity.
Full definition →DefinitionVulnerability
A vulnerability is a weakness in design, implementation, configuration or operation that could be exploited to compromise a security objective.
Full definition →WAFWeb Application Firewall
A web application firewall evaluates web requests against rules or policies and can monitor, allow or block traffic based on configured conditions.
Full definition →AppSecWeb Application Security
Web application security is the practice of reducing risk in web applications through secure design, testing, access control, monitoring and protective runtime controls.
Full definition →