When To Use Cybersecurity Glossary Key Scenarios And Best Practices

Glossary Design for Technical vs. Executive Communication

The effectiveness of a glossary depends on its ability to convey both technical accuracy and strategic impact. For instance, a term like "phishing simulation" may involve metrics such as false positive rates, user engagement, and training ROI for IT staff, whereas executives prioritize cost avoidance, regulatory exposure, and brand reputation. Below, a comparative framework illustrates how definitions and supporting metrics differ across roles, followed by methods to visualize complex concepts and audit glossary entries for executive clarity.

Comparative Definitions and Metrics for Technical vs. Executive Audiences

Visualizing Complex Terms Without Imagery

#### Example: Quantum Cryptography for Executives

Core Components of Quantum Cryptography

+-------------------------------------+
| QUANTUM CRYPTOGRAPHY |
+--------+------------+---------------+
| | | |
| Qubits | Quantum | Shor’s/ |
| (Q) | Key | Grover’s |
| | Distribution| Algorithms |
| | (QKD) | |
+--------+------------+---------------+

Key Definitions:

Qubits (Q): Quantum bits that exist in superposition (e.g., 0 and 1 simultaneously), enabling unbreakable encryption via Heisenberg’s uncertainty principle.

Quantum Key Distribution (QKD): Protocols (e.g., BB84) to exchange cryptographic keys using photons; any eavesdropping attempt alters the quantum state, revealing intrusion.

Shor’s Algorithm: A quantum algorithm that can factor large primes exponentially faster than classical methods, threatening RSA/ECC encryption.

#### Example: Quantum Cryptography for IT Staff

Technical Breakdown of QKD (BB84 Protocol)

1. Alice (Sender) prepares qubits in one of four states:

Horizontal (0) or Vertical (1) polarization (rectilinear basis).

Diagonal (+45°) or Anti-diagonal (-45°) polarization (diagonal basis).

2. Alice transmits qubits to Bob (Receiver) via a quantum channel.

3. Bob measures qubits in a randomly chosen basis (rectilinear or diagonal).

4. Alice and Bob publicly compare a subset of their bases:

If bases matched, they discard mismatched measurements.

Remaining bits form a shared secret key.

5. Eavesdropping (Eve) introduces errors due to the no-cloning theorem;
quantum bit error rate (QBER) > threshold (e.g., 11%) triggers alert.

Critical Metrics:

Quantum Bit Error Rate (QBER): % of errors in key transmission (target <11% for secure QKD).

Key Rate: Bits/sec of secure key generated (limited by channel loss and detector efficiency).

Distance Limitations: Current QKD systems (e.g., ID Quantique) operate up to ~500 km via trusted nodes or quantum repeaters.

Auditing Glossary Entries for Executive Clarity

#### Step 1: Identify Terms Prone to Misinterpretation

High-Risk Terms for Executives:

Ransomware: "Digital kidnapping" (analogy) + *"Average r

Glossary Integration in Threat Intelligence and Reporting

Threat intelligence teams rely on precise, contextually relevant terminology to document, analyze, and disseminate threat data. A well-integrated glossary ensures consistency in threat reporting, reduces miscommunication during incident response, and aligns technical and operational definitions with standardized frameworks. Emerging threats—such as new malware families like Clop—require dynamic updates to glossaries to reflect evolving tactics, techniques, and procedures (TTPs). Below is a structured workflow for maintaining glossaries in threat intelligence, including methods for tagging terms by TTPs, designing report-ready glossary sections, and standardizing terminology across frameworks like MITRE ATT&CK and custom taxonomies.

Glossary Workflow for Threat Intelligence Teams

A dynamic glossary workflow in threat intelligence must balance reactivity (updating definitions for emerging threats) with stability (maintaining consistency for established terms). The process involves four key phases: initial definition, TTP tagging, version control, and cross-framework mapping.

Initial Definition and Update Triggers
Glossary entries for threats should be created or revised when:

A new malware family (e.g., LockBit 3.0, QakBot) is identified by vendors (e.g., CISA, MITRE, or AlienVault OTX).

TTPs associated with a threat actor (e.g., APT29’s use of Cobalt Strike) are documented in open-source reports or closed-source intelligence.

Indicators of Compromise (IoCs) (e.g., C2 domains, YARA rules) are published with ambiguous or conflicting terminology.

Regulatory or compliance bodies (e.g., NIST SP 800-61, ISO 27035) introduce updated terminology for incident handling.

Example Update Cycle for "Clop" Ransomware:

Initial Entry (2019): Defined as a ransomware-as-a-service (RaaS) with double extortion tactics.

Update (2023): Added new delivery vectors (e.g., stolen RDP credentials, malicious ISO files) and MITRE ATT&CK mappings (e.g., T1059.003: Command-Line Interface, T1571: Hijack Execution Flow).

Version Control: Each update is timestamped and linked to the source report (e.g., CISA AA23-013A).

Tagging Terms by Threat Actor TTPs

Tagging glossary terms with TTPs enables threat analysts to quickly filter and correlate data during investigations. Tags should follow a hierarchical structure linking terms to MITRE ATT&CK, APT groups, and attack phases (e.g., Reconnaissance, Execution, Exfiltration).

Tagging Framework Example:

Term	TTP Tags	Source Framework
Cobalt Strike	T1059.001 (PowerShell), T1055.001 (Process Injection), APT29 (Cozy Bear)	MITRE ATT&CK, Mandiant
Living-off-the-Land	T1059 (Command-Line Interface), T1082 (System Information Discovery)	MITRE ATT&CK
Dridex	T1041 (Exploitation of Public-Facing Application), FIN7, FIN11	MITRE, FireEye

Implementation Steps:
1. Align with MITRE ATT&CK: Use technique IDs (e.g., T1087: Account Discovery) as primary tags.
2. Add APT Group Aliases: Include tracking names (e.g., APT41, Lazarus Group) from MITRE’s APT Groups or Group-IB.
3. Phase-Based Tagging: Categorize terms by attack lifecycle stages (e.g., Initial Access, Persistence).
4. Custom Tags for IoCs: Label IoCs with detection methods (e.g., SNORT Rule 56423, Suricata Alert).

Tool Integration:

Threat Intelligence Platforms (TIPs): Automate tagging in tools like MISP, TheHive, or Splunk ES using taxonomy plugins.

SIEM Correlation Rules: Map glossary tags to SIEM alerts (e.g., Splunk SA-CIM) for automated enrichment.

Template for Threat Report Glossary Section

A threat report glossary should be self-contained, machine-readable, and audience-adaptive (technical vs. executive). Below is a modular template for inclusion in PDF reports or slide decks, formatted for clarity and actionability.

### Glossary Section Template
(Placeholders in bold; replace with dynamic content.)

#### 1. Acronyms and Standardized Terms

Term	Definition	Source Framework	Related MITRE ATT&CK
APT	Advanced Persistent Threat: Prolonged, targeted cyber intrusion by state-sponsored actors.	CISA	N/A (Contextual)
MITRE ATT&CK	Framework documenting adversary TTPs across 14 Enterprise tactics.	MITRE	TA0001: Initial Access
IoC	Indicator of Compromise: Observable evidence of malicious activity.	NIST SP 800-61	T1005: Data from Information Repositories

2. Threat-Specific Terms

Term	Definition	Associated TTPs	Mitigation Steps
Clop Ransomware	RaaS with double extortion (data encryption + theft). Delivered via phishing or exploits.	T1566.001 (Phishing), T1059.003 (Command-Line Interface), APT29/APT41	Isolate infected systems, disable RDP, deploy EDR/XDR, patch CVE-2021-44228
C2 Domain	Command-and-Control server used by attackers for communication.	T1090 (C2), T1105 (Ingress Tool Transfer)	Block domains via DNS sinkholing, monitor outbound connections

3. Indicators of Compromise (IoCs)

IoC Type	Example	Detection Method	Confidence Level
File Hash (SHA-256)	`a1b2c3...` (Clop loader)	YARA rule, VirusTotal	High
Network IoC	`malicious[.]com:443` (C2)	SNORT/Suricata, Zeek logs	Medium
Registry Key	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe`	SIEM query, Velociraptor	High

4. Mitigation Mapping

Mitigation Action	Effectiveness	Tools/Standards
Disable macro execution in Office	High	Microsoft Office policies, CISA Guide
Segment network to limit lateral movement	Medium-High	Zero Trust Architecture, MITRE D3FEND

Design Notes for Reports:

For PDFs: Use bookmarks for quick navigation to glossary sections.

For Slide Decks: Place glossary on a dedicated slide with hyperlinks to MITRE ATT&CK or CISA resources.

Versioning: Include a last updated timestamp and source references (e.g., MITRE ATT&CK v12, CISA Alert AA23-XXX).

Standardizing Threat Terminology Across Frameworks

Standardization reduces ambiguity but requires mapping overlapping definitions across frameworks. Below are methods to align MITRE ATT&CK

A well-crafted cybersecurity glossary is not a static reference but a dynamic asset that evolves alongside an organization’s threat landscape and regulatory obligations. Its utility spans from the granularity of technical teams identifying new malware families to the strategic oversight of executives aligning cybersecurity investments with business objectives. By implementing role-specific definitions, visualizing complex concepts, and embedding glossaries into critical workflows—such as SOC 2 reporting or threat intelligence updates—organizations can transform potential communication gaps into opportunities for consistency, compliance, and resilience. The key lies in recognizing that a glossary’s value is measured not just by its presence, but by its precision in the moments when terminology directly impacts security outcomes.

• compliance documentation
• cybersecurity terminology
• executive communication
• incident response workflows
• threat intelligence

Leave a Comment

Name

Comment

Post Comment

Comments are moderated before appearing. The data you submit is processed according to the Privacy Policy of ir.msu.ac.zw.