Glossary

Pipeline Guardrails

Automated security checks and policy enforcement built into a CI/CD pipeline that block insecure code, configurations, or dependencies from progressing, so security is enforced as code moves toward deployment.

Pipeline Security

Securing the CI/CD pipeline itself, its code, build steps, dependencies, secrets, and infrastructure, so attackers cannot compromise the path that builds and deploys software, a key cloud-native supply-chain concern.

Pipeline Security Architecture

The structured design of security throughout a CI/CD pipeline, the stages, controls, and gates from code commit to deployment, so security is built into the delivery path rather than bolted on, central to DevSecOps.

Pivoting

In SOC investigation, moving from one piece of evidence to related ones, following an indicator, account, host, or behavior to uncover connected activity and expand understanding of an incident.

Playbook Development

Building and refining the procedural guides analysts follow for handling specific alert types or incidents, a capstone SOC skill that turns repeated experience into consistent, repeatable, teachable response.

Pod Security Standards

Kubernetes' standard security policies for pods, organized into baseline, restricted, and privileged levels, that constrain what pods can do, blocking dangerous capabilities like host access or privileged execution.

Pod Security Standards Production

Operating Pod Security Standards in real production clusters, choosing the right level per workload, rolling out without breaking existing apps, handling exceptions, and monitoring effectiveness over time.

Policies

In identity and access management, the rules that determine who can do what under which conditions, encoded in directories, IAM systems, or policy engines, enforced consistently across the organization.

Policy

A formal organizational document expressing the requirements, expectations, and responsibilities around a topic such as acceptable use or access control. Policies are the top of the governance hierarchy that controls and procedures implement.

Policy Anatomy

The standard structural elements of a well-written policy, purpose, scope, statements, roles, exceptions, references, that make policies clear, complete, and consistent so readers can find what they need.

Policy Communication

Making policies known and understood across the organization, through accessible language, awareness campaigns, training, and easy-to-find publication, so people can actually follow what policies require.

Policy Drafting

The discipline of writing policies, choosing the right scope, anatomy, language, and statements, so they are clear, enforceable, complete, and aligned with organizational and regulatory needs.

Policy Effectiveness Measurement

Assessing how well policies are working in practice, through awareness scores, compliance rates, exception trends, and incident links, so policy is managed on evidence rather than assumption.

Policy Exceptions

Formally approved deviations from a policy when full compliance isn't possible or appropriate, granted with rationale, time limits, and compensating controls, so exceptions are tracked rather than quietly ignored.

Policy Failure Modes

The ways policies fail in practice, being unknown, unrealistic, unenforced, contradictory, or out of date, that policy writers must anticipate and defend against so policies actually work.

Policy Hierarchy

The layered structure of policy, standard, procedure, and guideline, where each level specifies the previous more concretely, providing a clear chain from high-level mandate to step-by-step instruction.

Policy Library Structure

How an organization organizes its set of policies, by topic, hierarchy, ownership, and version, so the library is navigable, complete, and maintainable, an essential GRC and capstone-level deliverable.

Policy Lifecycle

The full cycle policies move through, drafting, approval, communication, operation, review, revision, and eventual retirement, ensuring policies are managed deliberately over time rather than written and forgotten.

Policy Retirement

Formally removing a policy when it is no longer needed, obsolete, superseded, or merged into another, so the library stays current and policies that no longer apply don't confuse readers or create false obligations.

Policy Review

The recurring practice of examining policies to ensure they remain accurate, relevant, and effective, and updating them as needed, so the policy library stays aligned with changing risk, regulation, and operations.

Policy Stakeholder Identification

Identifying the people and groups affected by, or needed to support, a policy, including subject experts, affected teams, legal, HR, and leadership, so the right voices shape and approve it.

Policy Statement Construction

Writing the individual statements within a policy clearly and precisely, choosing words that make obligations, scope, and conditions unambiguous, so readers know exactly what is required.

Policy Versioning

Tracking changes to policies over time with version numbers, change history, and metadata, so readers know which version they are looking at and the library has an auditable record of how policies evolved.

Policy as Code

Expressing policy rules in code that automated systems evaluate and enforce, so policy is consistent, versioned, testable, and applied automatically wherever it's needed across cloud and pipelines.

Port

A port is a numbered communication endpoint used by network protocols to identify which service should receive traffic.

Port Scanning

Probing a system or network to discover which ports are open and what services respond, a fundamental reconnaissance technique attackers use and defenders both perform (for inventory) and watch for (as a threat signal).

Ports

Numbered endpoints on a host that identify specific services or processes for network communication. Together with IP addresses, ports tell traffic where to go, and they are a primary attack surface.

Positive Recognition

Acknowledging and rewarding security-positive behaviors, like reporting phishing or surfacing risks, so people are encouraged to do them again. A culture-building technique that complements correction with reinforcement.

Possession Factor

An authentication factor based on something you have, a hardware key, phone, smart card, that demonstrates possession to verify identity. One of the three classic factor types alongside knowledge and inherence.

Post-Containment Threat Hunting

Hunting after an incident's initial containment to find any attacker footholds, accounts, or activity the response missed, ensuring eradication is truly complete before recovery proceeds.

Post-Engagement Workflow

The activities that follow a penetration test, finalizing the report, debriefing the client, supporting remediation, and retesting fixes, that determine how much real-world value the engagement delivers.