Concept Maps

Analyst vs Adjacent Roles

The distinction between a security analyst and neighboring roles like SOC analyst, penetration tester, incident responder, or engineer, clarifying what an analyst owns (assessing and communicating risk) versus what overlapping roles do.

Analyst-Client Relationship

The working relationship between a security assessor and the team being assessed, spanning expectation-setting at kickoff, communication during the engagement, and follow-up on remediation, so findings are received and acted on rather than resisted.

Analytical Thinking for Security

The disciplined reasoning a security analyst applies to evidence: forming hypotheses, weighing what the data supports, avoiding bias, and drawing conclusions that hold up. It is the core mental skill behind good assessment and investigation.

Architecture Review Framework

A structured approach for assessing the security of a system's design, defining how reviews are scoped, what areas to examine, how findings are documented and prioritized, and how remediation is verified, so reviews are thorough and repeatable.

Assessment Challenges

The recurring difficulties that arise during security assessments, such as incomplete information, limited access, time pressure, scope disputes, and resistance from the team being assessed, that an assessor must navigate to produce useful results.

Assessment Kickoff

The opening of a security assessment where the assessor and client agree on scope, goals, timing, points of contact, and rules of engagement, setting expectations so the rest of the work runs smoothly.

Assessment Methodology

A structured, repeatable way for a security analyst to assess a system: planning the work, examining it systematically, validating findings with evidence, and communicating results, so assessments are consistent rather than ad-hoc.

Assessment Planning

The preparation that precedes a security assessment: clarifying objectives and scope, identifying targets and constraints, scheduling, and gathering the access and information needed so the assessment runs efficiently.

Assessment Report Quality

The qualities that make a security assessment report useful: clear findings tied to real risk, actionable recommendations, appropriate prioritization, accurate evidence, and writing pitched to the intended audience.

Asset Inventory for VM

A complete, current list of the systems and software in scope for vulnerability management. Without knowing what exists, scanning misses assets and vulnerabilities go unmanaged, so the inventory is the foundation of the whole program.

Authentication Testing

Systematically evaluating an application's login and identity mechanisms during a security assessment to find weaknesses, such as weak session handling, missing MFA enforcement, or flaws in password and reset flows.

Authorization Testing Methodology

A structured approach to testing whether an application correctly enforces what users are allowed to do, checking for broken access control such as accessing other users' data or reaching admin functions without rights.

AWS IAM Assessment Priority

Treating identity and access management as the first and highest-priority area when assessing AWS security, because IAM misconfigurations, like over-permissioned roles or exposed keys, are the most common path to full account compromise.

Azure Assessment Scope

Defining what is included when assessing the security of an Azure environment, the subscriptions, resource groups, identities, and services to examine, so the assessment is focused and its coverage is clear.

Azure Resource Assessment

Examining the security configuration of individual Azure resources, such as virtual machines, databases, storage, and networking, to find misconfigurations like excessive exposure, missing encryption, or weak access settings.

Azure Storage Assessment

Evaluating the security of Azure storage accounts and blobs, checking for public exposure, weak access controls, missing encryption, and overly permissive shared keys or SAS tokens that could leak data.

Burp Suite Workflow

The practical way a web application tester uses Burp Suite, an intercepting proxy and testing toolkit, to capture, inspect, modify, and replay HTTP traffic during an authorized assessment.

Business Logic Testing Methodology

A testing approach that targets flaws in an application's intended workflow and rules, rather than technical bugs, such as skipping a payment step, abusing discount logic, or bypassing an intended sequence. These flaws evade automated scanners.

Cloud Assessment Findings

The documented weaknesses a cloud security assessment uncovers, such as over-permissioned identities, publicly exposed storage, missing encryption, or absent logging, each with its risk and a recommended fix. They are the actionable output of the assessment.

Cloud Assessment Methodology

A structured, repeatable process for assessing the security of a cloud environment: scoping it, prioritizing identity, examining resources, networks, data, and logging, validating findings, and reporting. It keeps cloud assessments thorough and consistent.

Cloud Assessment Scope

The defined boundaries of a cloud security assessment, which accounts, subscriptions, services, and regions are included, and what is out of scope. It is set first so the assessment is focused and its coverage and limits are clear.

Cloud Assessment Tools

The software used to assess cloud security, including provider-native posture tools and open-source scanners (such as those that analyze IAM policies or scan for misconfigurations). They automate discovery of exposure, excessive permissions, and configuration weaknesses.

Cloud Database Assessment

Evaluating the security of managed and self-hosted cloud databases, checking for public exposure, weak authentication, missing encryption, excessive privileges, and inadequate logging, since databases often hold an organization's most sensitive data.

Cloud Findings Communication

Conveying the results of a cloud security assessment so stakeholders understand each issue, its real risk, and how to fix it, adjusting depth and framing for engineers, cloud owners, and leadership.

Cloud Storage Assessment

Evaluating the security of cloud object and file storage, checking for public exposure, weak access controls, missing encryption, and risky sharing settings, since misconfigured storage is a leading cause of cloud data breaches.

Cloud-Native Threat Modeling

Applying threat modeling to cloud-native systems, accounting for their distinctive elements, microservices, containers, orchestrators, service meshes, and managed services, to identify design-level threats specific to that architecture.

Cloudsplaining Analysis

Using Cloudsplaining, an open-source tool, to analyze AWS IAM policies for risky permissions, surfacing identities that can escalate privileges, access data broadly, or modify resources, so assessors can focus on the most dangerous access.

Common Vulnerability Categories

The recurring classes of weakness a security analyst encounters across systems, such as injection, broken access control, misconfiguration, weak authentication, and unpatched software. Knowing the categories focuses assessment on where real risk usually lives.

Compute Security Assessment

Evaluating the security of cloud compute resources, virtual machines, instances, and the services running on them, checking for public exposure, missing patches, weak access, and insecure configurations during a cloud assessment.

Container Cluster Assessment

Evaluating the security of a container orchestration cluster (such as Kubernetes) during a cloud assessment, checking API server exposure, RBAC, network policies, pod security, and admission controls for weaknesses.

Continuous VM

A vulnerability management approach that scans, prioritizes, and remediates continuously rather than in periodic cycles, so newly introduced or newly disclosed vulnerabilities are found and addressed close to when they appear.

CSPM Integration

Incorporating cloud security posture management findings into a cloud assessment, using CSPM tooling to enumerate misconfigurations at scale and feeding its results into the assessment's prioritized findings.

Entra ID Assessment

Assessing the security of Microsoft Entra ID (the cloud identity service formerly Azure AD), reviewing privileged roles, conditional access, app registrations, MFA coverage, and risky configurations, since it is the front door to Microsoft cloud resources.

Evidence-Based Assessment

A security analyst practice of grounding every finding in concrete, verifiable evidence rather than assumption, so assessment conclusions are accurate, defensible, and credible to the people who must act on them.

False Positive Management

In vulnerability management, the process of identifying scanner findings that are not actually exploitable or present, validating them, and suppressing them, so remediation effort focuses on real vulnerabilities rather than scanner noise.

Finding Documentation

Recording each assessment finding clearly and completely, what the issue is, the evidence for it, its risk, and how to remediate, so the finding is understandable, credible, and actionable to the people who must fix it.

GraphQL Security Testing

Testing GraphQL APIs for security weaknesses during a penetration test, probing for issues like overly permissive queries, missing authorization, injection, and abuse of GraphQL features such as introspection and nested queries.

IAM Privilege Escalation

Abusing cloud IAM misconfigurations to gain more permissions than originally granted, for example using a permission to modify policies or assume a more powerful role, a major focus of cloud security assessment.

Lightweight Threat Modeling

A streamlined, practical approach to threat modeling that fits into fast development, using quick, focused techniques to identify key threats without the overhead of heavyweight formal methods, so modeling actually gets done.

LINDDUN Methodology

A privacy-focused threat-modeling methodology that helps identify privacy threats in a system, structured around categories like linkability, identifiability, and non-compliance, complementing security-focused models like STRIDE.

Microservices Threat Modeling

Applying threat modeling specifically to microservices systems, examining service-to-service trust, data flows, identity, and the many interfaces, to surface threats the architecture's distinct shape creates.

Organizational Threat Modeling Capability

An organization's overall ability to do threat modeling consistently and well, the skills, processes, tools, and culture that make threat modeling a routine practice rather than an occasional or ad-hoc activity.

OWASP Testing Guide

A comprehensive, community-developed methodology for testing web application security, organizing the techniques and checks a tester uses to systematically assess an application for vulnerabilities.

PASTA Methodology

Process for Attack Simulation and Threat Analysis: a risk-centric, seven-stage threat-modeling methodology that ties technical threats to business impact, producing attacker-informed, prioritized findings.

Penetration Testing Authorization

The formal permission and scope agreement that must be in place before any penetration test, defining what may be tested, when, and how, so testing is legal, bounded, and authorized rather than an actual attack.

Pentest Reporting Excellence

Producing penetration-test reports that are clear, accurate, prioritized, and actionable, communicating findings, risk, and remediation so the client can actually fix issues, the deliverable that gives a test its value.

PMapper Analysis

Using the PMapper tool to analyze a cloud account's IAM and discover privilege-escalation paths, building a graph of identities, permissions, and connections to surface routes an attacker could chain to gain higher access.

Post-Engagement Workflow

The activities that follow a penetration test, finalizing the report, debriefing the client, supporting remediation, and retesting fixes, that determine how much real-world value the engagement delivers.

Remediation Ownership

Assigning clear ownership for remediating each vulnerability or finding to a specific team or person, so issues don't languish without anyone responsible to fix them, foundational to effective vulnerability management.

Remediation Verification

Confirming that a vulnerability or finding has actually been fixed, by retesting or re-scanning, so issues aren't closed in trackers while still exploitable in reality.

Report Finding Prioritization

Ranking assessment findings by risk and impact so the most important issues stand out in the report, helping the client know where to focus remediation effort first.

REST API Security Testing

Penetration testing focused on REST APIs, examining authentication, authorization, input handling, business logic, rate limiting, and data exposure to find vulnerabilities specific to API surfaces.

Risk Communication

Communicating risk findings and decisions to stakeholders so they understand and can act, framed from the security-analyst perspective of conveying technical risk to non-technical audiences clearly.

Risk-Based Vulnerability Prioritization

Prioritizing vulnerability remediation by the real risk each one creates, exploitability, exposure, asset value, rather than treating all vulnerabilities by raw severity score.

Scanning Coverage

How completely vulnerability scanning reaches assets across the environment, authenticated, network-reachable, cloud, and mobile, so unscanned blind spots don't hide exploitable issues.

Security Analyst Career Path

The career trajectory a security analyst can follow, from entry roles through senior analyst, lead, and into specializations like detection engineering, IR, or threat hunting, with skills and milestones that mark each step.

Security Analyst Role

The foundational role of a security analyst, monitoring, triaging, investigating, and reporting on security events, the front line of SOC operations and a starting point for many security careers.

Security Analyst Toolbox

The everyday tools a security analyst uses, SIEM, EDR, ticketing, intelligence platforms, browser, OS utilities, that together enable triage, investigation, and reporting.

Security Architecture Review

An assessment that evaluates a system's or organization's security architecture against best practice and threat scenarios, identifying gaps and recommending improvements early before they become problems.

Security Report Writing

The skill of writing clear, accurate, useful security reports, investigation findings, briefings, executive summaries, that turn analyst work into communication stakeholders can act on.

Serverless Threat Modeling

Threat modeling applied to serverless workloads, examining function permissions, event sources, dependencies, and inter-function trust, to surface risks unique to the architecture.

SQL Injection Testing

Testing an application for SQL injection vulnerabilities by probing inputs with crafted payloads to detect whether they reach the database as code, a classic web-pentest activity.

STRIDE Methodology

A threat-modeling methodology that classifies threats into six categories, Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege, that guides systematic identification.

Threat Model Maintenance

The ongoing work of keeping threat models current as systems and threats evolve, since stale models lose value quickly and can mislead decisions if treated as authoritative.

Threat Model Output Quality

How well a threat-modeling exercise's output supports decisions, specific, prioritized, actionable threats and mitigations, rather than a long, vague list that nothing changes from.

Threat Modeling Effectiveness

Whether threat modeling actually changes defensive outcomes, controls implemented, designs adjusted, risks reduced, rather than just producing documents that sit on a shelf.

Threat Modeling Facilitation Challenges

The recurring challenges in facilitating threat-modeling sessions, engagement, scope, depth, getting the right participants, that make running productive sessions harder than the technique itself.

Threat Modeling for Analysts

How security analysts use threat modeling in day-to-day work, scoping investigations, anticipating attacker behavior, communicating risk, not as a one-off design exercise but as ongoing thinking.

Threat Modeling in SDLC

Integrating threat modeling into software development lifecycle stages, design, before release, and on major change, so threats are addressed when they're cheapest to fix.

Threat Modeling Output

The artifacts a threat-modeling exercise produces, documented threats, mitigations, decisions, follow-ups, that downstream engineers and analysts actually consume and act on.

Threat Modeling Tools

Specific tools that support threat modeling, from diagramming tools like OWASP Threat Dragon and Microsoft Threat Modeling Tool to lightweight collaborative whiteboards, used to capture and share models.

Threat Modeling Value

The real benefits threat modeling delivers, earlier detection of design issues, more focused controls, better risk communication, that justify investing in the practice across the SDLC.

Threat Modeling Workshop Design

The deliberate design of threat-modeling workshops, scope, attendees, materials, timeboxing, that makes sessions productive rather than wandering or hollow.

VM Exception Management

Managing exceptions in vulnerability management, the cases where a vulnerability can't be remediated in the normal window, with documented rationale, compensating controls, and expiration.

VM Integration

Integrating vulnerability management with adjacent functions, asset inventory, patching, ticketing, IR, so VM data flows into operational work rather than sitting in standalone reports.

VM Maturity Model

A model for assessing vulnerability-management program maturity from basic scanning through risk-prioritized, integrated, automated remediation, that helps programs see where they are and where to invest next.

VM Program Metrics

The metrics that measure a vulnerability-management program, MTTR, SLA compliance, critical-vulnerability backlog, scan coverage, that give leaders a credible view of program health.

VM Reporting to Leadership

Communicating vulnerability-management posture and progress to leadership clearly and credibly, what's at risk, what's improving, what investments help, that turns VM data into decision support.

VPC Assessment

A structured assessment of a VPC (or set of VPCs) for security, posture, routing, segmentation, exposure, and connectivity, used to find misconfigurations and risky design choices.

XSS Testing

Testing a web application for cross-site scripting vulnerabilities by probing inputs with crafted payloads to find where untrusted content reaches the browser as code.