Cybersecurity Glossary

Microsoft's directory service for centrally managing users, computers and permissions in Windows networks. As the identity hub of most corporate networks, it is a primary target in internal penetration tests and real attacks.

An approach that continuously and automatically runs real attack techniques in a controlled way to measure whether security controls block or detect them.

An unbroken record showing who held a piece of digital evidence, when and for what purpose, from the moment it was obtained. It helps demonstrate that the evidence has not been altered.

An advanced acquisition method in which the memory chip is removed from a mobile device or memory card and its data is read directly. It is usually considered when the device is damaged or inaccessible by other means, and it can involve irreversible steps.

A security programme approach that continuously discovers the attack surface, prioritises exposures by business impact and validates them. It typically runs in five stages: scoping, discovery, prioritisation, validation and mobilisation.

An international programme that assigns unique identifiers (e.g. CVE-2024-12345) to publicly disclosed vulnerabilities. It allows different products and sources to refer to the same vulnerability consistently.

An open standard maintained by FIRST that rates the technical severity of a vulnerability from 0 to 10. The current version is 4.0, while version 3.1 remains widely used.

An attack that aims to make a system, network or application unavailable by flooding it with traffic or requests from many sources.

Technologies and policies that detect and block unauthorised transfer of sensitive data outside the organisation through channels such as email, USB, web or cloud.

An approach that continuously discovers and monitors an organisation's internet-facing assets, such as domains, subdomains, IP addresses and exposed services, from an attacker's perspective. It helps uncover forgotten or unmanaged systems.

A security solution that monitors process, file and network activity on computers and servers to detect suspicious behaviour and enables responses such as isolating the device.

Code, a command or a technique that takes advantage of a vulnerability to perform unauthorised actions on a system. In penetration tests, exploits are used in a controlled way to demonstrate real impact.

The space between the end of a file and the end of the last cluster allocated to it. Because it can hold remnants of previously deleted data, it is examined in forensic investigations.

A bit-for-bit copy of a storage device, including deleted and unallocated space. Examination is carried out on this copy instead of the original evidence, and its accuracy is proven with a hash value.

A fixed-length value calculated from the content of data; even the smallest change produces a different value. In digital forensics, algorithms such as SHA-256 are used to show that a copy is identical to the original evidence.

Technical artefacts that indicate a system has been compromised, such as malicious file hashes, suspicious IP addresses or domain names. They are used in detection and threat hunting.

An attack technique in which Kerberos service tickets for Active Directory service accounts are requested and then subjected to offline password cracking. Service accounts with weak passwords are especially exposed.

Law No. 6698, which sets the rules for processing personal data in Turkey. It requires data controllers to take appropriate technical and administrative measures to keep personal data secure.

The process by which an attacker moves from the first compromised system to other systems on the same network to reach more valuable targets. Network segmentation and privilege restrictions make it harder.

A managed security service in which a provider's analysts monitor, detect and respond to threats, including actions such as isolating endpoints.

Information that describes a file beyond its content, such as creation and modification dates, author, device model or location. In forensic examinations it is used to assess a document's origin and timeline.

A method that verifies a user's identity with at least one additional factor beyond the password, such as a phone prompt, hardware key or biometrics. It makes account takeover harder even if the password is stolen.

An open knowledge base maintained by MITRE that classifies adversary tactics and techniques observed in real-world attacks. It is used to measure detection coverage and map test scenarios to real threats.

A non-profit international community dedicated to improving software security. It publishes widely used resources such as the OWASP Top 10, the Web Security Testing Guide (WSTG) and MASTG.

A security approach that stores the credentials of high-privilege accounts, such as administrator and service accounts, in a secure vault, controls access to them and records sessions.

The code that runs on the target system after an exploit succeeds and carries out the attacker's actual objective, for example a shell that provides remote access.

The security standard published by the PCI Security Standards Council for organisations that process, store or transmit cardholder data. The current version is v4.0.1, and it includes requirements for regular internal and external penetration testing.

A controlled, authorised test of a system, application or network using real attacker techniques. Its goal is to find vulnerabilities before they are exploited and report their impact with evidence.

A social engineering attack that uses fake emails, messages or web pages to trick users into revealing data such as passwords or card details, or into running malware.

The process by which an attacker who has gained low-privilege access obtains higher privileges, such as administrator rights, by exploiting misconfigurations or vulnerabilities.

A collaborative model in which the attacking (red) team and the defending (blue) team work together, executing attack techniques step by step and improving detection and response in real time.

Malware that encrypts or steals data to block access and demands a ransom in exchange for restoring it or not publishing it.

A comprehensive attack simulation that mimics a real adversary to reach a defined objective, usually without the defending team's prior knowledge. It measures the organisation's detection and response capability.

A solution that collects and correlates logs from different systems in one platform and generates security alerts based on defined rules.

The team and processes that continuously monitor an organisation's systems, analyse security alerts and coordinate incident response.

The behaviour patterns that describe how an attacker or threat group achieves its goals. Because they are harder to change than IOCs, they are central to detection strategies.

A security layer that inspects HTTP traffic to a web application and filters attacks such as SQL injection, XSS and malicious bot traffic.

Hardware or software that allows read operations but blocks write operations when connected to a storage device. It is used during forensic imaging to prevent the original evidence from being altered.

An approach that correlates data from multiple layers, such as endpoint, network, email and cloud, to detect and respond to threats from a single platform.

A security vulnerability that the vendor is not yet aware of or has not yet patched. Because no patch exists, defence relies on interim mitigations and behaviour-based detection.