Glossaire
Définitions claires des termes d'exercice et de réponse à incident utilisés sur le site.
Les articles paraissent d'abord en anglais. Ces liens ouvrent la version anglaise.
- After-action report (AAR)
- A written analysis produced after an exercise or incident that documents strengths, areas for improvement, root causes and an improvement plan.
- Hotwash
- The structured debrief held immediately after an exercise or incident, capturing what worked, what did not and the most important fixes.
- HSEEP
- The Homeland Security Exercise and Evaluation Program: a US methodology for designing, conducting, evaluating and improving exercises.
- Incident commander
- The person with overall authority for managing an incident response: setting priorities, assigning tasks and coordinating decisions and communications.
- Inject
- A piece of information introduced during a tabletop exercise, such as an alert, call or email, that moves the scenario forward and prompts decisions.
- MSEL (Master Scenario Events List)
- The ordered list of all injects in an exercise, with timing, delivery method, recipients, expected actions and the objective each supports.
- Out-of-band communications
- Communication channels that are independent of the systems affected by an incident, used when corporate email, chat or identity may be compromised.
- Playbook
- A documented, scenario-specific set of steps, decisions and contacts that guides responders through a particular type of incident.
- Recovery time objective (RTO)
- The maximum acceptable time to restore a business process or system after a disruption, set by the business and used to design recovery.
- Tabletop exercise
- A discussion-based exercise in which a team talks through a simulated incident to test plans, roles and decisions without touching real systems.
- Traffic Light Protocol (TLP)
- A labelling scheme (TLP:RED, AMBER, GREEN, CLEAR) that tells recipients how widely they may share sensitive information.
- White cell
- The exercise-control team that plays every party not in the room, such as the attacker, regulator, media or vendor, and manages the flow of injects.