Glossary

STIGs

Security Technical Implementation Guides from the US Defense Information Systems Agency, detailed hardening checklists for specific products. STIGs are widely used hardening benchmarks beyond just defense.

STIX and TAXII

Open standards for threat intelligence: STIX defines a structured language for indicators, actors, and techniques; TAXII defines a protocol for exchanging them between systems and organizations.

STRIDE Methodology

A threat-modeling methodology that classifies threats into six categories, Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege, that guides systematic identification.

STRIDE for Architecture

Applying the STRIDE threat-categorization model to architecture reviews, examining a system's components and flows for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

SUID

The set-user-ID bit on Unix executables that runs the program with the owner's privileges regardless of who invoked it. SUID root binaries are a primary Linux privilege-escalation target.

SYSTEM Account

The Windows built-in account with the highest local-machine privileges, used by the OS itself and many system services. Code running as SYSTEM has total local-host authority, a major attacker objective.

SaaS

Software as a Service is a cloud model where users access an application operated by a provider over the internet.

SaaS Security Requirements

The security requirements organizations apply when adopting Software as a Service, identity integration, data protection, logging, configurations, that ensure SaaS use meets the organization's security expectations.

SaaS Tenancy Models

The architectural ways SaaS providers separate customers, single-tenant, pooled multi-tenant, hybrid, each with different security, performance, and cost trade-offs that shape what customers can expect.

Salt

Random data added before hashing to make identical inputs produce different hash values.

Same-Origin Policy

A browser rule that limits how pages from one origin can interact with another origin.

SameSite Attribute

A cookie attribute that controls whether browsers send the cookie on cross-site requests. Properly set, SameSite blunts CSRF and information-leakage risks tied to cross-site cookie use.

Sample Handling

The safe practices for receiving, storing, transporting, and disposing of malware samples, so analysts work without accidentally infecting hosts or letting samples escape the lab.

Sanitization

Cleaning untrusted input before it is rendered, stored, or used in commands, so embedded harmful content is neutralized. Sanitization is a foundational defensive-web technique alongside validation and output encoding.

Scanning Coverage

How completely vulnerability scanning reaches assets across the environment, authenticated, network-reachable, cloud, and mobile, so unscanned blind spots don't hide exploitable issues.

Scenario-Based Identification

An approach to risk identification that imagines specific 'what-if' scenarios, an attacker doing X, a system failing in Y way, to surface risks that abstract analysis might miss.

Scheduled Task Detection

Detecting attacker use of scheduled tasks for persistence or execution by monitoring task creation and changes, often mapped to ATT&CK, a high-value detection class for Windows endpoints.

Scheduled Tasks

Windows entries that run programs at defined times or events, useful for legitimate automation and heavily abused by attackers for persistence and execution. A core mechanism defenders must understand.

Scheme

The portion of a URL that names the protocol used (http, https, ftp, etc.), the first piece that tells the browser how to fetch the resource. Foundational to reading URLs and understanding web requests.

Scopes

In OAuth, named permissions an application requests on behalf of a user (like read:email or write:files). Scopes let users grant limited delegated access rather than full account permissions.

Screen Lock

An OS feature that locks the screen and requires authentication to resume after a period of inactivity, a simple but high-value hardening control that protects unattended sessions from physical or shoulder-surfing access.

Secrets Management

The discipline of storing, distributing, and rotating sensitive values (passwords, keys, tokens) safely, central to hardening every environment where applications need credentials to work.

Secrets Scanning in CI/CD

Scanning code and pipelines for accidentally committed secrets, API keys, passwords, tokens, so they are caught before reaching production and can be promptly rotated.

Secrets in Kubernetes

How sensitive credentials and tokens are stored, accessed, and protected in Kubernetes, native Secrets resources, external secret stores, and integrations, so workloads get secrets safely without leaks.

Sector-Specific Cloud

Cloud compliance frameworks and requirements tailored to specific industries, healthcare, finance, government, that build on or replace general cloud frameworks with sector-aware demands.

Secure Flag

A cookie attribute telling the browser to send the cookie only over HTTPS. Setting Secure on sensitive cookies (especially session cookies) prevents them from leaking over plaintext HTTP.

Secure SDLC

Integrating security activities throughout the software development lifecycle, requirements, design, build, test, deploy, run, so security is built in rather than bolted on after release.

Secure by Default

A design principle that systems should be safe out of the box, requiring no user action to be secure. The opposite, insecure defaults, is a major source of misconfiguration and exposure.

Secure by Design

Building security into systems from the start rather than bolting it on later, integrating threat modeling, secure defaults, and protective patterns into design itself.

Security Analyst Career Path

The career trajectory a security analyst can follow, from entry roles through senior analyst, lead, and into specializations like detection engineering, IR, or threat hunting, with skills and milestones that mark each step.

Security Analyst Role

The foundational role of a security analyst, monitoring, triaging, investigating, and reporting on security events, the front line of SOC operations and a starting point for many security careers.

Security Analyst Toolbox

The everyday tools a security analyst uses, SIEM, EDR, ticketing, intelligence platforms, browser, OS utilities, that together enable triage, investigation, and reporting.