Glossary

Control Mapping

Linking a single control to all the framework requirements it satisfies, so one well-run control can demonstrate compliance across several standards and gaps where no control meets a requirement become visible.

Cookies

Small pieces of data a website stores in the browser and sends back on each request, commonly used to maintain sessions and remember state. Because session cookies can authenticate a user, protecting them is central to web security.

Corrective Controls

Security controls that act after an incident to limit damage and restore normal operations, such as restoring from backups, applying patches after exploitation, or removing malware. They respond to and recover from events rather than preventing them.

Correlation Detection

A detection technique that combines multiple events or signals, across logs, hosts, or time, to identify a threat that no single event would reveal, such as a failed-login burst followed by a success and unusual data access.

Coverage Metrics

Measurements of how much of the relevant attack surface or technique space a defense actually covers, such as the share of MITRE ATT&CK techniques with a detection, or the percentage of assets monitored. They reveal blind spots.

Coverage Validation

Actively confirming that detections genuinely catch the techniques they are meant to, by testing them against real or simulated attacker behavior, rather than assuming a written rule provides coverage.

Credential Access

The attacker objective and tactic of stealing valid credentials, passwords, hashes, tokens, or keys, to authenticate as legitimate users. With stolen credentials, attackers move and act while looking like normal activity.

Credential Access Hunts

Threat hunts focused on finding signs of credential theft that detections missed, searching telemetry for behaviors like memory access to credential stores, suspicious authentication, or tools associated with harvesting credentials.

Credential Checkout

In privileged access management, the process by which a user or system retrieves a privileged credential from a vault for temporary use, with the credential tracked, time-limited, and often rotated after use so it is never freely held.

Credential Dumping

An attacker technique of extracting stored credentials, passwords, hashes, or tickets, from a compromised system, often from memory (like LSASS on Windows) or credential files, to reuse them for lateral movement and escalation.

Credential Dumping Indicators

The observable signals in logs and telemetry that credential dumping is occurring, such as suspicious access to LSASS memory, use of known dumping tools, or unusual reads of credential stores, that SIEM queries are written to catch.

Credential Phishing

A phishing attack that tricks a victim into entering their credentials on a fake login page, handing the attacker a valid username and password. It is one of the most common ways attackers gain initial access.

Credential Rotation

Changing credentials, passwords, keys, and tokens, to invalidate any that an attacker may hold, a key containment and recovery step when credentials are suspected compromised during an incident.

Credential Stuffing

An attack that tries reused username and password pairs from other breaches.

Credential Vaults

Secure, centralized stores for sensitive credentials, passwords, keys, and secrets, that control access, issue credentials on demand, log usage, and rotate them, so secrets are never scattered or held in the clear.

Crisis Communication

Communicating during a major disruption covered by a business continuity plan, keeping employees, customers, partners, and the public informed accurately and calmly while operations are degraded or down, to limit harm and maintain trust.

Crisis External Communication

Communicating with outside parties, customers, regulators, media, and the public, during a major incident, managed by incident leadership to inform stakeholders accurately while protecting the organization legally and reputationally.

Crontab

The configuration that schedules recurring jobs on Linux and Unix systems. Because it runs commands automatically on a schedule, attackers abuse it as a persistence mechanism by adding a malicious scheduled task.

Cross-Account Access

Granting identities in one cloud account permission to access resources in another, typically via role assumption and trust policies. It enables shared services and centralized management but, if too broad, can let an attacker pivot between accounts.

Cross-Border Data Transfer

Moving personal or regulated data across national boundaries in the cloud, which triggers legal requirements about where data may go and how it must be protected. It is a core cloud compliance concern driven by data-protection laws.

Cross-Border Data Transfer Requirements

The specific legal mechanisms and obligations, under privacy laws like the GDPR, that must be satisfied to lawfully move personal data across borders, such as adequacy decisions, standard contractual clauses, and supplementary safeguards.

Cross-Cutting Concerns

Security and operational requirements that apply across all services in a cloud-native system rather than to one component, such as authentication, secrets management, observability, and resilience, best handled consistently rather than reimplemented per service.

Cross-Functional Communication

A SOC analyst's communication with teams outside the SOC, IT, engineering, legal, management, and affected business units, to gather context, coordinate response, and escalate effectively. Much of an analyst's impact depends on it.

Cross-Functional Risk

Risk that spans multiple departments or functions and cannot be owned or managed by one team alone, such as a risk involving IT, legal, and operations together, requiring coordination across the organization to address.

Cross-Site Request Forgery

An attack that causes a user's browser to send an unwanted authenticated request.

Cross-Site Scripting

A web vulnerability where attacker-controlled script runs in another user's browser.

Cross-Source Correlation

An analyst skill of combining evidence from different data sources, endpoint, network, identity, and cloud logs, to build a complete picture of an event that no single source reveals on its own.

Cross-System SoD

Separation of duties enforced across multiple systems, ensuring that a combination of access spread over different applications does not let one person complete a sensitive process alone, even when no single system shows a conflict.

Cryptography

The science of protecting information using mathematical techniques, providing confidentiality through encryption, integrity through hashing, and authenticity and non-repudiation through signatures. It underpins nearly all modern security.

Cryptojacking

The unauthorized use of compromised computing resources to mine cryptocurrency, common in cloud-native environments where attackers hijack cluster compute. It steals capacity and runs up costs rather than stealing data.

Cryptomining Incident Response

The response to a cryptomining (cryptojacking) incident in the cloud, confirming the unauthorized mining, scoping how the attacker got in, containing and removing the mining workloads, and closing the entry point, often using a predefined playbook.