Responsible disclosure: A principle that promotes the ethical reporting of security vulnerabilities. Under this principle, when someone discovers a security vulnerability, they should privately notify the relevant entity, providing them adequate time to rectify the issue before disclosing the vulnerability to the public. This practice helps to prevent potential exploitation of the vulnerability by malicious actors, ensuring that corrective measures are put in place to protect users and systems.

Restricted interface: A security principle that advocates for limiting the exposure of the working of a system. It involves providing only the necessary features and functionalities needed to fulfill specific tasks, thereby reducing the attack surface and limiting the potential for misuse. By restricting the functionality and information available, the scope for errors or security breaches can be significantly reduced.

Restrictive defaults: A security principle that advocates for configuring systems with the most secure settings by default. This approach limits access and permissions to the minimum necessary, requiring explicit granting of additional access by users or administrators to ensure security and prevent unintended access or breaches.

Return on Investment (ROI): A performance measure used to evaluate the efficiency or profitability of an investment or to compare the efficiency of a number of different investments. In a security context, ROI could refer to the benefits gained from investments in security measures weighed against their cost. It helps organizations justify the necessity of security expenditures by demonstrating their value in terms of risk reduction, loss prevention, and compliance.

Return-Oriented Programming (ROP) Attacks: A sophisticated attack that manipulates how a program uses its control flow by executing existing code sequences, known as gadgets, found in a system's memory. This technique avoids direct code injection, making it a stealthy way to execute arbitrary operations, and is commonly used to circumvent non-executable memory protections.

Reverse DNS: A process of resolving an IP address back to a domain name. Unlike the standard (forward) DNS lookup which translates a domain name into an IP address, rDNS does the opposite. This can be used as a simple form of verification, as it can be slightly more difficult for a malicious party to ensure a proper rDNS configuration compared to spoofing DNS responses.