Glossary

Role Mining Methodology

Systematically deriving role definitions from existing access data and job-function information, top-down (from organization roles) or bottom-up (from entitlements analysis), producing roles grounded in real use.

Role Mining Tools

Software tools that automate role mining, clustering entitlements, identifying candidate roles, and presenting them for review, making large-scale role engineering practical for sizeable organizations.

Role Model Implementation

Putting a designed role model into operation, defining roles in the IGA system, migrating users to them, and managing day-to-day, so the engineered roles actually drive access in practice.

Roles

Collections of permissions assigned together to identities to grant access by job function. Roles are a foundational mechanism in IAM, simplifying administration and enabling least privilege at scale.

Root Account

The all-powerful original account of a cloud provider account or tenant. Because it can do anything, including disabling controls, the root account must be locked down, with MFA enforced and day-to-day use avoided.

Root CA

A top-level certificate authority whose self-signed certificate sits at the apex of a PKI hierarchy. Browsers and operating systems ship with trusted root CAs that anchor the chain of trust for all subordinate certificates.

Root Cause Analysis

A review focused on the underlying conditions that allowed a problem to happen.

Routing

The process by which packets find their way across networks from source to destination, hop by hop through routers that decide where to send each packet. Foundational to how internetworking works.

Routing Tables

Data structures routers use to decide where to forward each packet, mapping destination networks to next hops. Understanding routing tables is foundational to network defense and to investigating traffic paths.

Rule Logic Design

Designing the logic of a detection rule, the conditions, thresholds, joins, and exclusions, so it accurately flags malicious activity with manageable false positives and stable behavior over time.

Run Key

A Windows registry key whose entries point to programs the OS launches automatically at logon. Run keys are a classic persistence location attackers abuse and defenders inspect.

Runbooks

Concrete step-by-step guides for handling specific situations in the SOC, like a particular alert type or routine task. Runbooks make operations consistent and accelerate analyst onboarding.

Runtime Security

Protecting workloads while they run, watching live process, file, and network behavior on hosts or containers to detect and block malicious activity that bypassed earlier defenses.

Runtime Security Monitoring

Continuously monitoring running workloads for malicious behavior in DevSecOps practice, integrating runtime telemetry with build-time security so the secure SDLC covers what happens after deployment.

S3 Exposure Response

The incident-response approach for exposed S3 buckets (or equivalent object storage): contain the exposure, assess what was accessible, notify as required, and prevent recurrence.

SAML

Security Assertion Markup Language: a long-standing federation standard for single sign-on, where an identity provider asserts a user's identity to a service provider via signed XML messages.

SAST Implementation

Operating Static Application Security Testing in practice, integrating it into pipelines, tuning to manage noise, prioritizing findings, and making developers act on results so SAST delivers real value.

SBOM

A software bill of materials that lists components used in an application or system.

SCIM Protocol

System for Cross-domain Identity Management: a standard for provisioning users, groups, and identity attributes between systems, the protocol modern IAM uses to keep accounts in sync across applications.

SGID

The set-group-ID bit on Unix-like executables and directories. On executables it runs the program with the group's permissions; on directories it inherits the group to new files. A classic permission concept defenders inspect.

SHA-1

An older cryptographic hash function (160-bit) once widely used but now broken for security: practical collisions exist, so it must not be used for signatures or integrity guarantees.

SHA-256

A widely used cryptographic hash function (256-bit) from the SHA-2 family, currently the standard secure choice for integrity, signatures, and IOC fingerprints across modern cryptography.

SIEM

Security Information and Event Management: the platform that collects, stores, normalizes, and analyzes security telemetry, the central tool for detection, hunting, and investigation in modern SOCs.

SIEM Data Models

The schemas and structures SIEMs use to normalize events from many sources into common fields, so queries and detections work across them rather than re-implementing per source.

SIEM Investigation Workflow

The standard pattern analysts follow to investigate alerts and incidents in a SIEM, gathering context, pivoting across data, and building a timeline using the SIEM's query and visualization tools.

SLA and Contract Risk

Risks that arise from service-level agreements and contracts, with vendors, customers, partners, that the organization must understand, monitor, and treat as part of risk management.

SMB

Server Message Block: a Windows file-sharing and inter-system protocol heavily used legitimately and heavily abused by attackers for lateral movement and remote execution.

SMB Lateral Movement Detection

Detecting attackers using SMB to move between hosts, by spotting unusual share access, remote command execution patterns, and anomalous SMB authentication, mapped to ATT&CK.

SMS OTP

One-time passcodes delivered via SMS as an MFA factor, widely used, easy to deploy, but weaker than modern phishing-resistant methods because SMS can be intercepted, SIM-swapped, or phished.

SMTP

Simple Mail Transfer Protocol: the protocol that moves email between servers across the internet. Foundational to email infrastructure and a target for both abuse and detection.

SNI

Server Name Indication: a TLS extension that tells the server which hostname the client is connecting to, so a single IP can host TLS certificates for many names. Defenders read SNI in traffic to identify destinations.