Glossary

S3 Exposure Response

The incident-response approach for exposed S3 buckets (or equivalent object storage): contain the exposure, assess what was accessible, notify as required, and prevent recurrence.

SAML

Security Assertion Markup Language: a long-standing federation standard for single sign-on, where an identity provider asserts a user's identity to a service provider via signed XML messages.

SAST Implementation

Operating Static Application Security Testing in practice, integrating it into pipelines, tuning to manage noise, prioritizing findings, and making developers act on results so SAST delivers real value.

SBOM

A software bill of materials that lists components used in an application or system.

SCA Implementation

Operating Software Composition Analysis to track and secure open-source dependencies, integrating it into pipelines, managing findings, and driving updates so supply-chain risk in dependencies is actually addressed.

SCIM Protocol

System for Cross-domain Identity Management: a standard for provisioning users, groups, and identity attributes between systems, the protocol modern IAM uses to keep accounts in sync across applications.

SGID

The set-group-ID bit on Unix-like executables and directories. On executables it runs the program with the group's permissions; on directories it inherits the group to new files. A classic permission concept defenders inspect.

SHA-1

An older cryptographic hash function (160-bit) once widely used but now broken for security: practical collisions exist, so it must not be used for signatures or integrity guarantees.

SHA-256

A widely used cryptographic hash function (256-bit) from the SHA-2 family, currently the standard secure choice for integrity, signatures, and IOC fingerprints across modern cryptography.

SIEM

Security Information and Event Management: the platform that collects, stores, normalizes, and analyzes security telemetry, the central tool for detection, hunting, and investigation in modern SOCs.

SIEM Data Models

The schemas and structures SIEMs use to normalize events from many sources into common fields, so queries and detections work across them rather than re-implementing per source.

SIEM Investigation Workflow

The standard pattern analysts follow to investigate alerts and incidents in a SIEM, gathering context, pivoting across data, and building a timeline using the SIEM's query and visualization tools.

SLA and Contract Risk

Risks that arise from service-level agreements and contracts, with vendors, customers, partners, that the organization must understand, monitor, and treat as part of risk management.

SMB

Server Message Block: a Windows file-sharing and inter-system protocol heavily used legitimately and heavily abused by attackers for lateral movement and remote execution.

SMB Lateral Movement Detection

Detecting attackers using SMB to move between hosts, by spotting unusual share access, remote command execution patterns, and anomalous SMB authentication, mapped to ATT&CK.

SMS OTP

One-time passcodes delivered via SMS as an MFA factor, widely used, easy to deploy, but weaker than modern phishing-resistant methods because SMS can be intercepted, SIM-swapped, or phished.

SMTP

Simple Mail Transfer Protocol: the protocol that moves email between servers across the internet. Foundational to email infrastructure and a target for both abuse and detection.

SNI

Server Name Indication: a TLS extension that tells the server which hostname the client is connecting to, so a single IP can host TLS certificates for many names. Defenders read SNI in traffic to identify destinations.

SNMP

Simple Network Management Protocol: a protocol for monitoring and configuring network devices, widely deployed and historically prone to weak community-string authentication that attackers exploit.

SOAR

Security Orchestration, Automation, and Response: platforms that automate SOC workflows, enrichment, containment, response steps, by linking tools together, so analysts spend less time on repetitive work.

SOC

The team or function that monitors, detects, and responds to security threats day to day, the operational center of blue-team work. Often used as shorthand for Security Operations Center.

SOC 2

An audit framework from the AICPA that assesses a service organization's controls against the Trust Services Criteria, widely demanded by customers as evidence of security and operational maturity.

SOC 2 Cloud

Operating SOC 2 compliance in cloud environments, leveraging provider attestations for inherited controls and demonstrating customer-side controls for what shared responsibility leaves to the customer.

SOC 2 Gap Assessment

An internal assessment that compares current controls against SOC 2 Trust Services Criteria to find gaps before an external audit, so they can be remediated in time.

SOC 2 Policy Coverage

Ensuring an organization's policy set covers all areas SOC 2 expects, access control, change management, vendor risk, incident response, so audit evidence about policies is complete.

SOC 2 Policy Requirements

The specific policies SOC 2 expects to see, with content, ownership, and approvals appropriate to the Trust Services Criteria, that organizations meet to satisfy the policy side of SOC 2.

SOC 2 Program Design

The capstone exercise of designing a complete SOC 2 program, scope, controls, policies, evidence, audit plan, that demonstrates a working approach to satisfying SOC 2 end to end.

SOC 2 Reporting

The formal SOC 2 report produced by a CPA firm describing the service organization's controls and the auditor's opinion, the deliverable customers consume as evidence of security and operational maturity.

SOC 2 Trust Services Criteria

The five categories SOC 2 evaluates against, security (required), availability, processing integrity, confidentiality, and privacy, that define what a SOC 2 audit covers in scope.

SOC 2 Type I and Type II

The two flavors of SOC 2 reports, Type I evaluates control design at a point in time, Type II evaluates operating effectiveness over a period (typically 6-12 months), which customers usually prefer.

SOC Burnout Prevention

Deliberate practices that prevent and address burnout in SOC teams, sustainable workload, rotation, recognition, mental-health support, since burnout is a chronic risk in high-pressure operational work.

SOC Business Case

The case for investment in a SOC, costs, capabilities, risks addressed, options, that leadership uses to decide whether and how to fund the function. A SOC-program-design deliverable.