Glossary

Session Replay

An attack that reuses a captured authentication or session artifact (token, request) to act as a legitimate user. Defenses include short token lifetimes, anti-replay nonces, and binding to context.

Sessions

Server-side state that tracks a user's interactions after they log in, keeping them authenticated across requests. Sessions and their identifiers are central web-defense surfaces to harden.

Severity Classification

Categorizing incidents by severity (critical, high, medium, low) using defined criteria, so response, escalation, and reporting follow consistent rules rather than ad-hoc judgment.

Shadow IT

Technology used inside an organization without IT or security's knowledge or approval, SaaS apps, devices, scripts, that creates blind spots and exposure since governance can't apply to what isn't visible.

Shared Responsibility for Compliance

How compliance responsibilities split between cloud provider and customer, both share parts of meeting frameworks, requiring customers to understand what's inherited and what they must do themselves.

Sharing Considerations

The judgments that go into sharing threat intelligence, what to share, with whom, how to handle sensitivity, TLP, and legal constraints, so sharing improves defense without causing harm.

Shell

A program that interprets commands and runs them on the operating system, like bash on Linux or PowerShell on Windows. Defenders read shell activity constantly to investigate and detect attacks.

Side Channels

Indirect ways to extract information from a system, timing, power, electromagnetic emissions, cache behavior, that can leak secrets even when the cryptography itself is sound.

Side Projects

Personal or extracurricular projects an analyst pursues, lab work, write-ups, contributions, that build skills and credibility beyond what day-to-day SOC work alone provides.

Sigma Rules

An open, vendor-neutral format for writing detection rules in YAML, that can be converted to many SIEM and EDR query languages. Sigma enables community sharing of portable detections.

Signature-Based Detection

Detection that matches known indicators or patterns, hashes, strings, byte sequences, against observed data. Fast and precise for known threats, but unable to detect novel attacks on its own.

Silo Model Architecture

A multi-tenant cloud architecture where each customer gets dedicated infrastructure, providing stronger isolation than pooled models at the cost of efficiency and scale.

Single Point of Failure

A component whose failure brings down a system or process, a fragility every resilient design tries to eliminate through redundancy, redundancy of components, paths, sites, or vendors.

Single Sign-On

A sign-in model where one identity provider grants access to multiple applications.

SoD Enforcement Approaches

The mechanisms used to enforce segregation of duties in IGA, preventive blocking at provisioning, detective alerting in reviews, compensating controls, applied per situation to keep SoD real.

Social Engineering

Manipulating people into revealing information, granting access, or making unsafe decisions.

Social Login Conversion Impact

The effect of social login (sign-in with Google, Apple, Facebook, etc.) on user signup and conversion rates in customer identity, often improving conversion but with security and privacy trade-offs.

Social Login Fundamentals

The foundational concepts behind social login, OAuth/OIDC flows, redirect handling, attribute mapping, account linking, that explain how 'sign in with X' actually works under the hood.

Social Login Security

Securing social-login flows in CIAM, validating tokens, protecting redirects, account linking pitfalls, IdP trust assumptions, so the convenience doesn't introduce account-takeover paths.

Soft Skills

Non-technical skills like communication, collaboration, empathy, and time management that are essential to security-analyst effectiveness alongside technical knowledge.

Software Bill of Materials

A formal inventory of components in a piece of software, libraries, versions, licenses, sources, that supports vulnerability management, supply-chain security, and incident response.

Source Bias

The systematic skew that comes from any intelligence source, vendor incentives, geographic focus, sectoral perspective, that consumers must account for so analysis reflects reality rather than the source's lens.

Source Evaluation

Evaluating the reliability, recency, scope, and bias of intelligence sources so analysis weights information appropriately and consumers can judge confidence in conclusions.

Spearphishing

A targeted phishing attack tailored to a specific individual or small group using research about them, far more convincing and dangerous than generic phishing.

Specific Audit Types

The various categories of audit a GRC analyst encounters, internal, external, regulatory, financial, operational, that differ in purpose, scope, and methodology, so the analyst applies the right approach to each.

Specific Frameworks for Assessment

The named frameworks audit and assessment work uses as criteria, COBIT, COSO, ISO 19011, ISACA's IT audit standards, each suited to particular assessment focuses.

Specific Tooling

The specific tools auditors and assurance professionals use, GRC platforms, audit workpaper systems, data-analytics tools, that support evidence collection, testing, and reporting at scale.

Splunk SPL

Search Processing Language, the query language used in Splunk to search, transform, and visualize event data. A widely used SIEM query language alongside KQL.

Stack Counting

A hunting and analytics technique that counts how often each value of a field occurs to surface rare items, on the premise that unusual values often indicate threats worth investigating.

Stakeholder Mapping

Identifying and characterizing the intelligence consumers a SOC serves, their roles, needs, and influence, so intelligence products fit who will actually consume them.

Stakeholder Preparation

Preparing stakeholders, business owners, leaders, control owners, for an upcoming audit, what they'll be asked, what's expected, so the audit experience runs smoothly and credibly.