Glossary

IOC Operationalization

Turning indicators of compromise into active defensive use, loading them into detection tools, blocklists, and hunts, so intelligence indicators actually catch or block the threats they represent rather than sitting unused.

IP Addresses

Numeric labels assigned to devices on a network that identify them and enable routing of traffic to and from them. They are fundamental to networking and a key data point in detection, investigation, and access control.

IPv4

Internet Protocol version 4: the long-dominant IP addressing scheme using 32-bit addresses written as four numbers (like 192.168.1.1). Its limited address space led to NAT and the development of IPv6.

IPv6

Internet Protocol version 6: the newer IP addressing scheme using 128-bit addresses to vastly expand address space beyond IPv4. Defenders must account for it because it is often enabled by default and can create overlooked attack surface.

IR Evidence Preservation for Litigation

Handling incident evidence so it remains legally sound, preserving integrity, chain of custody, and completeness, in case the incident leads to litigation, regulatory action, or prosecution, a key concern of incident response leadership.

IR Execution

Carrying out the incident response in practice, coordinating investigation, containment, eradication, and recovery actions under pressure, a capstone skill of running a real response end to end rather than knowing the steps in theory.

IR Mental Demands

The psychological strain of incident response work, pressure, uncertainty, long hours, high stakes, and on-call stress, that responders must manage to stay effective and avoid burnout over a career.

IR Skill Profile

The mix of competencies an effective incident responder needs, technical depth (forensics, systems, networking), structured analytical thinking, communication, and composure under pressure, that together define the role's requirements.

IR-SOC Boundary

The dividing line and handoff between SOC operations and the incident response function, defining when an issue stops being SOC triage and becomes an incident IR owns, so the transition is clear and nothing falls between them.

ISAC

Information Sharing and Analysis Center: a sector-based organization through which member companies share threat intelligence relevant to their industry, enabling collective defense against threats targeting that sector.

ISO 27001

An international standard for an information security management system (ISMS), specifying how an organization should systematically manage information security through risk-based controls, and offering formal certification.

ISO 27001 Audit Cycle

The recurring audit timeline for maintaining ISO 27001 certification, an initial certification audit followed by periodic surveillance audits and a recertification audit, that keeps certification valid over a multi-year cycle.

ISO 27001 Certification Process

The steps to achieve ISO 27001 certification, building the ISMS, conducting internal audits and management review, then passing a two-stage external certification audit, framed within framework and control implementation.

ISO 27001 Cloud

Applying ISO 27001 to cloud environments, scoping the ISMS to include cloud services, addressing shared responsibility, and using cloud-specific guidance (like ISO 27017/27018) so the management system covers cloud risks.

ISO 27001 Controls

The set of security controls associated with ISO 27001 (its Annex A control catalog), spanning organizational, people, physical, and technological measures that an organization selects from based on its risk assessment.

ISO 27001 ISMS

The information security management system at the heart of ISO 27001, the framework of policies, processes, risk management, and controls through which an organization systematically manages and improves information security.

ISO 27002 Controls

The detailed control guidance companion to ISO 27001, ISO 27002 elaborates how to implement the information-security controls referenced in ISO 27001's Annex A, giving practical implementation detail for each.

ISO 27017

An international standard giving cloud-specific security guidance that extends ISO 27001/27002 to cloud services, addressing the shared responsibilities and controls relevant to both cloud providers and customers.

ISO 31000 Process

The risk-management process defined by ISO 31000, establishing context, then identifying, analyzing, evaluating, and treating risk, with ongoing communication and monitoring, providing a generic, principles-based framework for managing any risk.

ISO vs SOC 2 Choice

The decision between pursuing ISO 27001 certification or a SOC 2 report, two leading ways to demonstrate security to customers, based on factors like target market, geography, customer expectations, and how each is used.

IaC Security Scanning

Scanning infrastructure-as-code (such as Terraform or Kubernetes manifests) for security issues before deployment, catching misconfigurations like open access or missing encryption in the code that defines the infrastructure.

IaaS

Infrastructure as a Service: a cloud model where the provider supplies virtualized compute, storage, and networking, and the customer manages everything above that, operating systems, applications, and most security configuration.

Idempotent Configuration

Configuration management where applying the same definition repeatedly always produces the same end state, so re-running it is safe and reliably reasserts the intended secure configuration, correcting any drift.

Identification

The step where an entity claims an identity, such as entering a username, distinct from authentication, which proves the claim. It is the first stage of establishing who someone is in access control.

Identifier

A value that uniquely names an identity within a system, such as a username, email, employee ID, or account number, used to reference and distinguish one identity from another.

Identity

The digital representation of a person, service, or device in a system, the set of attributes and credentials that distinguishes one actor from another and to which access and accountability are tied. It is the foundation of access control.

Identity Anomaly Detection

Detecting unusual identity behavior that may signal compromise, such as logins at odd times or locations, impossible travel, or atypical access, by comparing current activity against an established baseline of normal.

Identity Federation

Establishing trust between identity systems so a user authenticated in one can access another without a separate account, the mechanism an IAM engineer builds, via standards like SAML and OIDC, to enable single sign-on across organizations and clouds.

Identity Hunting Value

The principle that identity data is among the highest-value sources for threat hunting, because identity is the modern attack surface, so hunting in authentication and access telemetry catches intrusions that endpoint or network hunting may miss.

Identity Lifecycle

The full arc of an identity from creation to removal, joining, moving (role changes), and leaving, during which access must be provisioned, adjusted, and revoked so it always matches the person's current legitimate needs.

Identity Outlier Detection

An identity-governance analytic that finds identities whose access is unusual compared to their peers, flagging people with more or different entitlements than similar roles, a strong signal of excessive or inappropriate access.