Glossary

OAuth 2.0

An authorization framework that lets an application obtain limited access to a user's resources on another service without handling the user's password, by issuing scoped access tokens. It underpins much of modern delegated access.

OPA Gatekeeper

A Kubernetes admission controller built on Open Policy Agent that enforces policy on resources as they are created, blocking or auditing workloads that violate rules, so cluster policy is enforced automatically.

OPA and Sentinel

Two policy-as-code tools, Open Policy Agent (OPA) and HashiCorp Sentinel, that a cloud engineer uses to define and automatically enforce policies on infrastructure and access, codifying guardrails as testable rules.

OWASP Testing Guide

A comprehensive, community-developed methodology for testing web application security, organizing the techniques and checks a tester uses to systematically assess an application for vulnerabilities.

Obligation vs Aspiration

The distinction in policy writing between mandatory requirements (obligations, what people must do) and aspirational guidance (what is encouraged), so policies are clear about what is enforceable versus merely desirable.

On-Call Dynamics

The realities of being on-call for incident response, unpredictable disruptions, pressure to respond fast, fatigue, and impact on life, that affect responder effectiveness and wellbeing and must be managed deliberately.

One-Way Functions

Functions that are easy to compute in one direction but infeasible to reverse, the mathematical basis of much cryptography, especially hashing, where you cannot practically recover the input from the output.

Open Policy Agent for IaC

Using Open Policy Agent to enforce security policy on infrastructure-as-code before deployment, evaluating Terraform or similar definitions against rules so non-compliant infrastructure is blocked in the pipeline.

Open Source Contribution

Contributing to shared open-source detection content, rules, analytics, and tools, so detection engineers both benefit from and give back to the community, raising the collective quality of detections.

Open Source Intelligence

OSINT: intelligence gathered from publicly available sources, websites, social media, public records, forums, that a SOC uses to understand threats, actors, and its own exposure without privileged access.

OpenID Connect

An identity layer on top of OAuth that helps applications verify who a user is.

OpenTelemetry

An open standard and toolset for collecting telemetry, traces, metrics, and logs, from applications and infrastructure in a vendor-neutral way, giving consistent observability that also supports security monitoring in cloud-native systems.

Operational Evidence

Compliance evidence showing that a control operated consistently over time, logs, tickets, records of recurring activities, as opposed to point-in-time proof, demonstrating the control works in practice, not just on paper.

Operational Intelligence

Threat intelligence about specific campaigns, operations, or imminent threats, more detailed than strategic intelligence but broader than individual indicators, helping defenders prepare for and respond to active threat activity.

Opportunistic Attackers

Attackers who target whatever is easy and vulnerable rather than a specific victim, exploiting widely scanned weaknesses and known vulnerabilities at scale. Most organizations face them constantly.

Organizational Incident Learning

How an organization, not just individuals, learns from incidents, capturing lessons, changing processes and controls, and building institutional memory, so it gets measurably better after each incident.

Organizational Threat Modeling Capability

An organization's overall ability to do threat modeling consistently and well, the skills, processes, tools, and culture that make threat modeling a routine practice rather than an occasional or ad-hoc activity.

Organizational Units

Containers within a directory (like Active Directory) used to group and organize users, computers, and other objects, so administration, policy, and delegation can be applied to logical groupings.

Origin

The scheme, host, and port that define where a web page or request comes from.

Outlier Detection

A hunting and analysis technique that finds data points deviating markedly from the norm, unusual hosts, accounts, or behaviors, on the principle that statistical outliers often warrant investigation as possible threats.

Output Encoding

Safely representing data for a specific context so it is treated as text instead of code.

Overlap and Efficiency

The principle that security frameworks share many common requirements, so mapping their overlap lets one control and its evidence satisfy multiple frameworks, the key to efficient multi-framework compliance.