Glossary

151 terms from Incident Response and Resilience, in plain words, each with the chapter that teaches it.

Search the glossary

#

3-2-1 rule: A backup rule: keep three copies of your data, on two kinds of media, with one copy off site. Because modern ransomware goes after backups, many plans now also require at least one copy that can't be changed or deleted.

A

active-active: An arrangement where all members work and share the load all the time, like web1 and web2 behind HAProxy. If one fails, the other has to carry everything, so each one needs enough capacity for the whole load.
active-passive: An arrangement where one machine does the work while a standby waits to take over, like load balancers lb1 and lb2. It is simple, but the standby's capacity sits idle.
air-gapped: Not connected to any network. An example is a backup disk or tape that is unplugged after the backup and put on a shelf, where ransomware can't reach it.
alert: An event that a tool has flagged as worth a look, such as the SIEM flagging a login to Sam's account from another country at 3 a.m. An alert only becomes an incident once analysis confirms it.
analysis: The incident response phase where you decide whether an alert is really an incident, how bad it is (its severity) and what it touches.
append-only: A mode in which clients can add new backups but can't delete or change old ones. Kettle & Crane's rest-server runs in this mode, so even an attacker with the restic password can't remove the snapshots.
automatic transfer switch: A device that moves the building's power supply onto the generator automatically when mains power fails.
autoscaling: Adding servers automatically when load rises and removing them when it falls, for example starting another web server when CPU stays above 70% for five minutes. It is mainly a cloud feature, and it also replaces servers that fail health checks.
availability: The share of time a service works, often given in 'nines'. For example, 99.9% allows about 8.8 hours of downtime a year. From an outage log it is calculated as MTBF ÷ (MTBF + MTTR).
AVML: A Linux tool for taking a full memory dump, run from the response kit's USB drive.

B

beacon: Malware's regular check-in connection to its controller. You can spot it as many connections with very even gaps, like Jo's laptop calling 203.0.113.77 about every 302 seconds.
bit-level copy: A copy of every bit of a drive, including empty space and the leftovers of deleted files. In the lab, the deleted 'new account' text was found only in the bit-level copy, not by a file copy.
blameless: A way of running reviews that fixes systems instead of punishing people. People who expect blame hide their mistakes, and the facts get lost.
breach notification law: A law that says who must be told about a data leak, and by when. As of October 2026, Oregon gives 45 days and Washington gives 30 days to tell the people affected.
brownout: A drop or sag in power that lasts seconds to minutes. A UPS covers it, and line-interactive and online units also correct sags.
business impact analysis: The management process that sets each system's RTO and RPO. It is covered in Governance, Risk and Compliance in 50 Pages.

C

capacity planning: Making sure you will have enough people, technology and infrastructure before you run out, based on measured growth. For example, Alex calculates that the file server will be 80% full in 10 months.
case: One folder that holds everything about one incident: the timeline and the collected evidence. newcase.sh creates one, such as cases/IR-2026-11-01-phish-sam.
chain of custody: A written record of everyone who held a piece of evidence, when, what they did with it and where it went next. A gap in it lets a lawyer argue that the evidence could have been changed.
Clonezilla: A free tool that makes and restores system images on any operating system.
cluster: A group of servers that work together and appear as one system, with software that moves work between them. Examples are a database cluster and Windows Server failover clustering.
cold site: A recovery site with space, power, cooling and network connections but no equipment. It is cheap, but bringing in hardware and restoring everything takes days to weeks.
containment: The phase that stops an incident from spreading, by blocking, quarantining or unplugging a machine. It comes before eradication so that cleaned machines aren't reinfected.
CPU registers and cache: The fastest, smallest storage inside the processor. They change billions of times a second, top the order of volatility, and can't be captured with ordinary tools.
CSIRT: Computer security incident response team: the group that handles incidents. At Kettle & Crane it is Alex as lead, the owners, Sam on communications and Priya as note taker, plus outside help.
cyber insurance: An insurance policy that covers the costs of a security incident. Most policies require quick notice of an incident, and many include an IR firm on retainer.

D

dd: A command that copies raw bytes. dd if=DEVICE of=copy.img bs=1M makes a bit-level copy of a drive (if is the input, of the output, and bs the block size).
decision point: A question in a playbook whose answer changes the next step, such as 'Is it spreading to other machines?'
detection: The phase of noticing that something may be wrong, from an alert, a user's report like Priya's call, or a slow shop.
differential backup: A backup of everything that has changed since the last full backup. A restore needs only the full backup plus the latest differential.
digital forensics: Collecting and examining data from computers, phones and networks in a way that would stand up in court: work on copies, prove nothing changed with hashes, and write everything down.
direct cause: What directly made an incident happen, such as malware running on Jo's laptop. It lies between the symptom you saw and the deeper root cause.
dwell time: How long an attacker was inside before being found. For Jo's laptop it was three days, from the first beacon to the hunt.

E

e-discovery: The legal process of finding, preserving, collecting, reviewing and handing over electronic information for a lawsuit or investigation. Alex's grep over the held copy of Sam's mailbox is a small-scale example.
eradication: The phase that removes the cause: the malware, the attacker's accounts, their persistence, and the hole they came in by. It is often done by rebuilding from a clean image.
event: Anything that happens and can be observed, such as Sam opening the shop's admin page. Almost all events are normal.

F

facilitator: The person who runs a tabletop exercise, reading out each inject and asking the team what they would do. Alex plays this role at Kettle & Crane.
failover: Switching automatically from a failed component to its standby, as when lb2 takes over the virtual IP after lb1 fails.
failover test: A test that deliberately switches production to the standby or recovery site. It is the only real proof that recovery works, and also the riskiest test, so plan a quiet hour and a way back.
fishbone diagram: A chart for incidents with several causes. The problem sits at the 'head', and each 'bone' lists causes in one area, such as people, process, technology or suppliers.
five whys: A simple RCA method: state the problem and keep asking 'why?' until you reach a cause you can fix. For Jo's laptop, the chain ends at the missing review of administrator rights.
flow log: A record of network connections showing who connected to whom, when, on which port and how many bytes were sent, without the content. Firewalls and flow collectors produce them, and hunters search them for patterns such as beaconing.
full backup: A backup that copies everything, such as the 100 GB file server on Sunday. Incremental and differential backups build on it.

G

gcore: A tool from the gdb package that dumps one running process's memory to a file. gcore -o mem PID writes mem.PID.
generator: A machine that makes electricity from fuel for long outages. It takes 10 to 30 seconds to start, so a UPS covers that gap.
geographic dispersion: Placing a recovery site far enough away that it doesn't share the same disaster, with a different power grid and flood zone, or another cloud region.
golden image: The company's standard, tested, clean install, used to rebuild infected machines such as Jo's laptop or the file server.

H

HAProxy: A widely used free load balancer. In the lab it shares requests between web1 and web2 in turn and drops a server that fails its health check.
hash: A short fingerprint calculated from a file's contents. If even one byte changes, the hash changes completely, so matching hashes prove that evidence or restored files are unchanged.
health check: A small test request a load balancer sends regularly to each server. HAProxy stops sending traffic to a server that fails it, and adds the server back once it passes again.
high availability: Designing a system to keep running when one of its parts fails, usually by having two or more of everything that matters, as with the shop's two web servers and load balancer pair.
hot site: A recovery site that is a fully working copy with current data, ready in minutes. You pay for everything twice.
hypothesis: A specific, testable guess about attacker behavior that starts a hunt, such as 'a laptop is beaconing to its controller at regular intervals.'

I

IC3: The FBI's Internet Crime Complaint Center (ic3.gov), where US businesses report online fraud. Kettle & Crane reports the fake bank-details fraud there.
immutable backup: A backup that nobody can change or delete until a set time has passed, even with every password. It is the answer to ransomware that hunts backups.
incident: An event that harms or threatens the confidentiality, integrity or availability of systems or data, or that breaks a security policy. Examples are Sam's stolen password and a ransomware infection.
incident response: The planned way an organization deals with incidents: stop the harm, find out what happened, put things right and learn from it, in seven phases.
incremental backup: A backup of only what changed since the last backup of any kind. It is fastest to make, but a restore needs the full backup plus every incremental in order.
inject: A short development in a tabletop exercise's story, read out to the team. Each one usually makes things worse, such as 'the backup drive also shows .locked files.'

J

jitter: A little random variation that malware adds to its beacon timer to look less regular. It wasn't enough to hide Jo's 3% spread.

K

Keepalived: Linux software that moves a virtual IP between machines using VRRP. In the lab it moves 192.168.30.10 from lb1 to lb2 when lb1 fails.

L

law enforcement: The police or, for most US cybercrime, the FBI. Report fraud, extortion and data attacks to them after talking to your lawyer and insurer.
legal hold: An instruction, usually from a lawyer, to preserve all data that may matter to a lawsuit or investigation and to stop its normal deletion. Lee sent one for Sam's mailbox.
lessons learned: The last incident response phase: a blameless meeting, usually within two weeks, and a short report whose actions improve preparation for next time.
LiME: A Linux tool for taking a full memory dump.
load balancer: A device or program that sits in front of several servers doing the same job and shares incoming requests among them. It skips servers that fail health checks, which adds both capacity and availability.

M

Magnet RAM Capture: A Windows tool for taking a full memory dump.
malware: Malicious software, such as the fake browser update that beaconed from Jo's laptop.
memory dump: A copy of a computer's RAM saved to a file. It is the most volatile evidence and often holds what never touches the disk, like the attacker's address and the ransomware key.
MFA: A second sign-in step on top of the password. Kettle & Crane turns it on for every mailbox after Sam's phishing incident.
MITRE ATT&CK: A public catalog of attacker techniques, used as a source of threat hunting hypotheses.
MTBF: Mean time between failures: the average working time between one failure and the next, calculated as (period − down time) ÷ failures. Higher is better. The shop server's MTBF is about 2,188 hours.
MTTR: Mean time to repair: the average time to fix a failure and get the system working again, calculated as total down time ÷ failures. Lower is better.

N

network namespace: A separate copy of Linux's network stack on one computer. The labs use namespaces such as irr-jo and irr-fw to play the parts of laptops, servers and the router.
nftables: Linux's firewall, controlled with the nft command. Its rules live in chains inside tables. The labs use it to block the attacker's address and quarantine a machine.
NIST SP 800-61: The incident response guide from NIST, the US standards body. It groups the steps differently from CompTIA's seven phases, and Revision 3 (April 2025) maps them onto the Cybersecurity Framework 2.0.
notification: Telling those who must know about an incident: staff, the insurer, customers and cafés, the card processor and regulators, within legal deadlines.
NUT: Network UPS Tools: Linux software that watches a UPS and can shut servers down cleanly before the battery runs flat.

O

object lock: A cloud storage feature that locks each backup file for a set number of days, so not even the account owner can delete it early. Kettle & Crane's cloud copy uses a 30-day lock.
order of volatility: The rule to collect the most short-lived evidence first: CPU registers and cache, memory, temporary files and swap, disk, remote logs, then backups. It comes from RFC 3227.
out of band: Communicating outside the systems under attack, for example a group chat on personal phones, because an attacker in your mail could read your plans.

P

parallel processing: A test where the recovery systems run the real workload alongside production and the results are compared. Production is untouched if the recovery systems fail.
PBQ: Performance-based question: a hands-on task on screen in the Security+ exam, such as putting response actions in order.
persistence: A setting that restarts malware after a reboot or login, such as a startup entry, a scheduled task or a new service. Eradication must remove it.
phishing: Tricking someone with a fake message, like the email 'from Microsoft' that led Sam to type a password into a fake login page.
PID: The number Linux gives each running process, used by ps, kill and gcore. Keepalived also writes its PIDs to files, so each copy needs its own -p and -r files.
playbook: A step-by-step checklist for one kind of incident, such as ransomware, with decision points. It says what to do, in what order, and who does it.
preparation: The first phase: everything done before an incident, such as a plan, a contact list on paper, a way to talk, working logs and backups, a response kit and practice.
process dump: A memory dump of just one running program, used to find things it holds only in memory, such as server addresses or keys. On Linux, `gcore` makes one, and on Windows, Task Manager's 'Create dump file' does.

Q

quarantine: An isolated area where a suspect machine or file is kept and examined without harming anything else. Jo's laptop could reach only Alex's laptop while it was quarantined.

R

RAM: A computer's working memory. It holds running programs, open connections and keys, and everything in it is lost at power off.
ransomware: Malware that encrypts or scrambles files and demands payment for the key, often renaming locked files with an ending such as `.locked`. Modern ransomware also tries to delete or encrypt backups so that victims can't restore.
RCA: Root cause analysis: digging from the symptom, past the direct cause, down to the root cause, starting from one UTC timeline.
recovery: The phase of bringing systems back to normal work and watching them closely for a while, for example by restoring Jo's files from a clean backup.
recovery site: A place where the business can run if its building is lost. It can be a hot, warm or cold site.
region: A separate geographic area of a cloud provider. Kettle & Crane's warm site is backups and disk images stored in another region.
replica: A continuously updated copy of a database that can take over if the main one fails. Because it also copies mistakes and corruption at once, it doesn't replace backups.
repository: The folder or server where restic keeps its backups, encrypted with a password.
response kit: Equipment prepared before an incident: a clean laptop, a USB drive of tools, cables and blank evidence forms. Memory-dump tools run from its USB drive.
rest-server: restic's small backup server. Its --append-only mode lets clients add backups but refuses deletes.
restic: A free backup program that stores encrypted snapshots in a repository. Each run copies only changes, but every snapshot restores in full.
restic backup: Backs up a folder to the repository and saves a new snapshot, such as restic backup files.
restic check: Verifies the structure of a restic repository and reports 'no errors were found' when it is healthy.
restic restore: Restores a snapshot into a folder given with --target. latest picks the newest snapshot, and --include restores only matching files.
restic snapshots: Lists the snapshots in a restic repository with their IDs and times.
restoration testing: Regularly restoring from backup into a new place and checking that the result is complete and correct. A nightly 'success' only proves that something was copied.
retainer: A contract signed in advance with a security firm so it starts work within hours instead of days. Many cyber insurance policies include one.
retention: The normal rules for how long data is kept before it is deleted, such as mail deleted after a year. A legal hold overrides them.
RFC 3227: A published guide for collecting evidence, and the source of the order of volatility.
root cause: The deepest cause you can fix that would have prevented the incident or would stop it happening again. For Jo's laptop it was that nobody reviewed administrator rights.
RPO: Recovery point objective: how much data you can afford to lose, measured back from the outage to the last good copy. The backup interval must be shorter than the RPO.
RTO: Recovery time objective: how long a system may be down, measured forward from the outage until it works again. The measured restore time must be shorter.
Run keys: Entries in the Windows registry (its settings database) that start programs automatically. They are a common persistence place for eradication to check.
runbook: The detailed technical steps for one routine task, such as 'restore the file server.' A playbook says what to do, and a runbook says how.

S

scheduled task: A job Windows runs automatically at set times or events. Attackers use scheduled tasks for persistence.
severity: A rating of how bad an incident is, which decides how fast people must act and who is told. Kettle & Crane uses low, high and critical, and the rating can change as facts emerge.
SHA-256: A hash algorithm that turns any file into a fixed 64-character hex fingerprint. It is used to prove evidence or backups are unchanged, because even a one-byte change gives a completely different hash.
sha256sum: Prints a file's SHA-256 hash. sha256sum -c re-hashes the files listed in a saved list such as known-good.sha256 and prints OK for each one that matches.
SIEM: Security information and event management: a system that collects logs in one place and runs rules over them, raising alerts such as a login from another country.
simulation: A hands-on rehearsal on test systems, such as restoring the order database into a test VM. It finds technical gaps and gives real times.
single point of failure: One part whose failure stops the whole service, like a lone load balancer. High availability removes these.
snapshot: A record of a disk's or VM's state at one moment, made almost instantly by keeping old blocks. In restic, a snapshot is one backup run. A snapshot on the same disk isn't a backup by itself.
Startup folder: A Windows folder whose programs start at login. It is a persistence place that eradication must check.
strings: Pulls readable text out of a binary file, such as a memory dump. Alex uses it to find the attacker's address and the KC-RANSOM-KEY marker.
surge protector: A device that sends voltage spikes to ground before they reach the equipment. It is rated in joules, does nothing in a blackout, and wears out after big surges.
surveillance footage: Security camera recordings used as evidence. Export them early because recorders overwrite themselves, keep the original format, and note the camera's clock error.
swap: Disk space that the system uses as overflow for memory. Together with temporary files, it is overwritten as the system runs, so it comes right after memory in the order of volatility.
symptom: What you actually saw during an incident, such as a laptop calling an unknown server. Root cause analysis digs from it, past the direct cause, to the root cause.
system image: A complete copy of a computer's system disk, used to restore or set up a whole machine in one step. A backup-style image often skips deleted space.

T

tabletop exercise: The team talks through a made-up incident one inject at a time, without touching any system, to find gaps in the plan. It costs an hour and no downtime.
threat hunting: Searching your systems for signs of an attacker before any alert fires, on the assumption that one may already be inside. Each hunt starts from a hypothesis and ends by turning the search into an alert.
threat intelligence: Reports of what attackers are doing right now, such as groups hiding tools in fake browser updates. It is a source of hunting hypotheses.
time to detect: Report measures taken from the timeline. Time to detect runs from the first attacker activity to its discovery (3 days for Jo), and time to contain runs from discovery to containment (50 minutes).
timeline: A case's time-stamped list, in UTC, of what happened and what was done. It answers when the incident started, when you noticed and how long each step took.
transaction log: A database's running record of every change. Copying it continuously gives a much shorter RPO than nightly backups.

U

UPS: Uninterruptible power supply: a battery between the wall and the equipment that takes over within milliseconds. It rides out short outages, allows clean shutdowns, and bridges the gap until a generator starts.
upsc: Asks the NUT server for a UPS's values, such as upsc closet@localhost ups.status.
upsd: The NUT (Network UPS Tools) server that reads UPS data from the driver and answers clients such as `upsc` and `upsmon`. It can be run directly as `/lib/nut/upsd` to skip the startup wrapper that checks `/etc/nut/nut.conf`.
upsmon: NUT's monitor program. It watches for OB LB (on battery, low battery) and shuts servers down cleanly while some battery is left.
UTC: Coordinated Universal Time: the world's reference clock, with no time zone or daylight saving. Writing every time in UTC lines up logs from different systems. Portland is 7 or 8 hours behind it.
UTC offset: The part of a timestamp that says how far it is from UTC. -07:00 means seven hours behind (add 7 to get UTC), and Z means zero offset, which is UTC itself.

V

VA: Volt-amperes: one of the two ratings on a UPS. Watts is the real power the equipment uses, and VA is always higher, so size a UPS by its watt rating, such as a 1000 VA / 600 W unit.
VIP: Virtual IP address: an address that belongs to whichever machine is currently active, such as the shop's 192.168.30.10, so customers keep the same address after failover.
VM: Virtual machine: a computer simulated in software. Every lab runs in an Ubuntu VM made with Multipass, and restore tests can use a spare VM.
Volatility: A tool for examining real memory dumps.
VRRP: Virtual Router Redundancy Protocol: the active machine sends an 'I'm alive' message every second, and if the standby stops hearing them, it takes the virtual IP.

W

warm site: A recovery site with equipment and network ready but not running with live data, so recovery takes hours to a day or two. Kettle & Crane chooses one in another cloud region.
WinPmem: A Windows tool for taking a full memory dump.
wire fraud: Fraud that tricks someone into sending money by bank transfer, like Steam & Co paying a fake 'new bank account'. Report it within a day or two so the bank has a chance to freeze the money.
write blocker: A device that lets you read a drive but blocks every write, protecting the original. In the lab, losetup -r acts as a software write blocker.