Glossary

Security Training Program

A managed program that designs, delivers, and measures the security training employees receive, across the awareness and GRC capstone perspectives, so training is intentional rather than ad hoc.

Security as Code

Expressing security configuration, policies, and controls as code that is versioned, tested, and deployed alongside applications, so security is automated and consistent rather than manually managed.

Security from Observability

Using cloud-native observability data (traces, metrics, logs) for security purposes, detection, investigation, and policy, so the same telemetry that powers operations also strengthens defense.

Segregation of Duties Modeling

Modeling segregation-of-duties (SoD) constraints in IGA, identifying which combinations of access shouldn't be held by the same person, so the access model enforces SoD rather than relying on after-the-fact review.

Self-Assessment

An internal evaluation of controls or compliance against criteria, performed by the organization itself, used for ongoing assurance, audit preparation, and as a recognized validation method in some compliance regimes.

Self-Service Security

Enabling developers and engineers to handle their own security tasks safely, requesting access, fixing findings, deploying secured workloads, through guardrails and automation, scaling security beyond the central team.

Separation of Duties

An IAM principle that splits high-impact tasks across people so no single individual can complete them alone, reducing fraud, error, and abuse by requiring collaboration.

Sequence Detection

Detecting attacker activity by chaining ordered events that, individually benign, indicate compromise together, written as multi-step detection logic that fires only when the sequence completes.

Server-Side Authorization

Enforcing authorization decisions on the server, not just in client UI, so what a user can actually do is determined by trusted server checks rather than client-side controls an attacker can bypass.

Serverless Anti-Patterns

Common mistakes in securing serverless workloads, over-permissioned functions, sensitive data in environment variables, missing monitoring, that undermine the security benefits serverless can otherwise offer.

Serverless Detection

Detecting malicious activity in serverless environments, abuse of functions, anomalous invocation patterns, suspicious permissions use, given the short-lived, event-driven nature of serverless workloads.

Serverless Observability

Gaining visibility into serverless workloads, invocations, durations, errors, traces across functions and services, so security and operations can both see and reason about what's happening.

Serverless Security

The discipline of securing serverless workloads, function permissions, code, dependencies, secrets, observability, that adapts cloud-security practice to the event-driven, provider-managed runtime.

Serverless Security Model

The conceptual model for how security responsibilities and risks apply to serverless, distinguishing what the provider handles from what the customer must do, and identifying the unique risks serverless introduces.

Serverless Threat Modeling

Threat modeling applied to serverless workloads, examining function permissions, event sources, dependencies, and inter-function trust, to surface risks unique to the architecture.

Service Account Governance

Managing non-human service accounts through a PAM-aligned program, ownership, scope, rotation, monitoring, since service accounts are often privileged, long-lived, and poorly tracked.

Service Account Modernization

Replacing legacy service-account patterns (static passwords, broad rights, no rotation) with modern alternatives, managed identities, workload identity federation, short-lived credentials, that are more secure by design.

Service Account Remediation Plan

A concrete plan to bring an organization's service accounts under control, inventory, scoping, rotation, modernization, that capstone IAM work produces to address service-account risk systematically.

Service Accounts

Non-human accounts used by applications, scripts, and services to authenticate and access resources. Numerous, often privileged, and frequently neglected, they are a major identity-security focus.

Service Control Policies (SCPs)

Organization-level policies in cloud (AWS-style) that set the maximum permissions any account in scope can have, used as guardrails to enforce limits across many accounts at once.

Service Endpoints

Cloud network features that connect a customer network to a provider service over the provider's private network, avoiding public-internet exposure of those connections.

Service Mesh

Infrastructure that handles service-to-service communication for microservices, mTLS, routing, observability, policy, transparently via sidecars or proxies, common in cloud-native architectures.

Service Mesh Attacks

Attacks that target the service mesh itself, control-plane compromise, sidecar exploitation, policy bypass, that defenders must consider since the mesh is critical infrastructure attackers also pursue.

Service Mesh Security

The security capabilities and concerns of a service mesh, mTLS, identity, authorization, observability, plus protecting the mesh itself, treated as a coherent security-architecture topic.

Service Mesh Telemetry

The metrics, traces, and logs the service mesh produces about service-to-service traffic, used by both operations and security for visibility, detection, and investigation.

Service Providers

In federated identity, the applications or services that rely on an identity provider to authenticate users. The relying side of the IdP-SP relationship that powers SSO and federation.

Service-to-Service Auth

Authentication between services in cloud-native systems, typically via mTLS or short-lived tokens, so every service-to-service call is identified and authorized rather than implicitly trusted.

Session Fixation

An attack where an attacker sets or knows a victim's session identifier before they log in, then hijacks the now-authenticated session. Prevented by regenerating session IDs on login.

Session Hijacking

An attack that steals a valid session identifier, via XSS, cookie theft, sniffing, or other means, and uses it to impersonate the authenticated user, bypassing the need for credentials.

Session ID

The unique identifier that ties HTTP requests to a server-side session, usually carried in a cookie. Its secrecy is the basis of session security, so it must be hardened against theft and prediction.

Session Recording

Capturing privileged sessions, often video or keystrokes, so administrative activity is reviewable and accountable. A core PAM capability framed across IAM and PAM contexts.

Session Recording Architecture

The system design for capturing, storing, and retrieving privileged session recordings at scale, balancing fidelity, performance, storage, retention, and review needs.