Glossary

Container Images

The packaged, immutable templates that define what runs in a container, bundling an application with its dependencies and configuration. Images are built in layers and run as containers, making their security foundational to container security.

Container Registries

The repositories that store and distribute container images, public or private, from which images are pulled to run. Because they are the source of what gets deployed, their security and integrity are critical to the software supply chain.

Container Registry Security

Protecting the container registry through access control, image signing and verification, vulnerability scanning of stored images, and provenance checks, so only trusted, clean images can be stored and deployed.

Container Runtime Protection

Securing containers while they are running by monitoring their behavior and blocking malicious activity in real time, such as detecting and stopping a container escape, unexpected process execution, or anomalous network connection.

Container Runtime Security

Securing running containers as practiced by a cloud security engineer, applying runtime monitoring, detection, and response to containerized workloads as part of operating cloud security, alongside build-time and platform controls.

Container Security

The discipline of securing containers across their whole life, from building and scanning images, through hardening and signing, to runtime protection and orchestration security, so containerized workloads resist compromise and isolation holds.

Container Security Lifecycle

The stages of securing a container over its life, build (hardened, scanned, signed images), ship (secure registry), and run (admission control and runtime protection), with security applied at each stage rather than only at the end.

Container Security Model

Within DevSecOps, the conceptual model for how container security is layered, image, build, registry, runtime, and orchestration, that guides where to place controls in a secure software delivery pipeline.

Container Vulnerability Scanning

Scanning container images and running containers for known software vulnerabilities, identifying vulnerable packages in image layers so they can be fixed before deployment and tracked while running.

Containerization Patterns

Common ways of structuring and deploying containers, such as one process per container, sidecar and ambassador patterns, and init containers, each with security implications for isolation, privilege, and the attack surface.

Containment

Actions taken to limit the spread or impact of an incident.

Containment Actions

The steps responders take to stop an incident from spreading or causing further harm, such as isolating a host, disabling an account, blocking a network connection, or revoking credentials, while preserving evidence for investigation.

Containment Risk

The downside of a containment action, such as disrupting legitimate business, tipping off the attacker, or destroying evidence, that responders must weigh against the benefit of stopping the threat.

Containment Validation

Confirming that containment actually worked, that the attacker's access is cut off, the threat cannot spread, and no overlooked foothold remains, rather than assuming an action succeeded.

Content Security Policy

A browser security policy that limits where scripts, images, styles, and other resources can load from.

Context Gathering

Collecting the surrounding information an analyst needs to make sense of an alert, the user, host, asset criticality, recent activity, and related events, so triage decisions rest on a full picture rather than the alert alone.

Continuous Access Evaluation

A zero-trust capability that re-checks a session's validity in near real time rather than only at login, so that if conditions change, a token is revoked, risk rises, or a device falls out of compliance, access is cut off promptly.

Continuous Architecture Review

Treating security architecture review as an ongoing practice rather than a one-time event, periodically re-examining a cloud design as it evolves so new services, changes, and drift do not silently undermine its security.

Continuous Audit

An audit approach that tests controls and analyzes data continuously, rather than only at periodic intervals, using automation to detect control failures and anomalies close to when they happen.

Continuous Compliance

Maintaining and proving compliance on an ongoing basis rather than only at audit time, by continuously checking controls, collecting evidence, and detecting drift, so the organization is always in a demonstrable compliant state.

Continuous Evidence Collection

Automatically gathering compliance evidence on an ongoing basis, configurations, logs, access reviews, and tickets, as it is generated, so audits draw on a continuously maintained evidence store rather than a last-minute manual scramble.

Continuous Improvement

The ongoing practice of learning from incidents, exercises, and metrics to steadily strengthen defenses, detections, and processes, so the security program gets better over time rather than repeating the same gaps.

Continuous Improvement Loop

In policy practice, the cycle of measuring whether a policy works, identifying gaps, and revising it, so policies evolve based on real effectiveness rather than being written once and left to go stale.

Continuous Learning

The ongoing effort security analysts make to keep their skills and knowledge current, through study, labs, certifications, and reflection, because threats, tools, and techniques change constantly and yesterday's knowledge decays.

Continuous Risk Management

Treating risk management as an ongoing, living process rather than a periodic exercise, continuously identifying, assessing, treating, and monitoring risks as the environment and threats change, so the risk picture stays current.

Continuous Risk Monitoring

Ongoing tracking of risks and their indicators so changes are detected early, using key risk indicators, control status, and threat data to signal when a risk is rising or a treatment is failing.

Continuous VM

A vulnerability management approach that scans, prioritizes, and remediates continuously rather than in periodic cycles, so newly introduced or newly disclosed vulnerabilities are found and addressed close to when they appear.

Continuous Vendor Monitoring

Keeping watch on third-party vendors' security and risk on an ongoing basis, rather than only at onboarding, so that a vendor's deteriorating posture, breach, or new risk is detected while the relationship is active.

Control Assessments

Evaluations that test whether specific controls exist, are designed correctly, and operate effectively, providing evidence about control health. They sit between informal review and formal audit in rigor and purpose.

Control Baselines

Predefined sets of controls selected as a starting point for a system or organization, often tiered by impact or risk level, that provide a known-good minimum rather than choosing every control from scratch.

Control Implementation

The work of putting a control into practice, configuring the technology, defining the process, and assigning ownership, so that a requirement on paper becomes a control that actually operates and can be evidenced.