Glossary

Stakeholder Updates

Regular, structured updates to internal stakeholders during an incident, with the right cadence, audience, and detail, so people stay informed without drowning in noise or losing focus.

Standards

Documents that specify how to meet policy requirements, with specific technical or procedural rules, sitting between policies (what) and procedures (how-to) in the governance hierarchy.

Standards and Procedures

The complementary pair of governance documents, standards (specific requirements) and procedures (step-by-step how-to), that translate policy into actionable rules a GRC analyst maintains together.

Standing Privilege

Privileged access that exists continuously, available all the time rather than being granted just when needed. Reducing standing privilege is a foundational identity-security goal, since it shrinks what attackers can use.

Standing Requirements

Ongoing intelligence requirements that persist over time, rather than one-off questions, defining the long-running topics the threat-intelligence program continually answers.

Startup Folder

A Windows directory whose contents automatically launch when a user logs on. A persistence location attackers abuse and defenders inspect during investigation and hardening.

Stateful Firewall

A firewall that tracks connection state when deciding whether traffic should be allowed.

Stateless Firewall

A firewall that evaluates packets using rules without tracking connection state.

Stateless Protocol

A protocol where each request is independent and the server keeps no memory of previous requests, like HTTP, which is why applications layer sessions on top to keep users logged in.

Statement of Applicability

A core ISO 27001 document listing which controls from the standard apply, which don't, and why, the bridge between risk assessment and selected controls in the ISMS.

Static Analysis Fundamentals

The basics of analyzing malware without running it, inspecting strings, imports, headers, and structure, to learn capabilities and indicators safely before deciding whether deeper dynamic analysis is warranted.

Statistical Analysis for Detection

Using statistics on SIEM data, counts, percentiles, baselines, anomalies, to write detections that catch unusual activity by behavior rather than known signatures.

Statistical Detection

A detection-engineering approach that builds rules on statistical properties of data, distributions, thresholds, behavioral baselines, complementing signature- and rule-based methods with behavior-driven coverage.

Status Code

A three-digit number in an HTTP response indicating outcome, 200 OK, 401 Unauthorized, 500 Internal Server Error, that defenders read to understand application behavior and detect abuse.

Stealer Analysis

Analyzing information-stealer malware (credentials, cookies, wallets) to understand its targets, exfiltration paths, and indicators, producing intelligence and detections against a fast-growing threat family.

Sticky Bit

A Unix permission that, on directories, restricts file deletion to the file's owner even when the directory is writable by others. Common on /tmp and similar shared directories.

Strategic Intelligence

Big-picture threat intelligence about trends, actors, and risks at the level of months and years, that informs leadership decisions and strategy rather than day-to-day operations.

Stream Ciphers

Symmetric encryption algorithms that encrypt data one bit or byte at a time, useful for streaming use cases like real-time audio/video, contrasted with block ciphers that encrypt fixed-size chunks.

Structured Logging

Producing logs as structured data, JSON or similar with named fields, rather than free-text, so events can be parsed, queried, and correlated reliably in SIEM and analytics.

Sub-Techniques

Finer subdivisions of MITRE ATT&CK techniques, providing more specific descriptions of how a technique is realized in practice, so coverage and detections can be more precise.

Subdomain

A domain that sits below another in the DNS hierarchy, like mail.example.com under example.com. Defenders inventory subdomains, since forgotten or misconfigured ones become attack paths.

Subnet

A subnet is a smaller range of IP addresses carved out of a larger network.

Sudo

A Unix command that runs another command with elevated (typically root) privileges according to policy in /etc/sudoers. Sudo is a defining administrative tool whose configuration and use defenders audit closely.

Supply Chain Attack

An attack that compromises a target indirectly by going through a vendor, partner, or shared component the target relies on. SolarWinds and CCleaner are notorious examples.

Supply Chain Attacks

Cloud-native supply chain attacks: compromises of container images, IaC modules, Helm charts, or CI/CD systems that flow into customer cloud workloads through trusted package and build paths.

Supply Chain Risk

The risk an organization faces from its software, vendor, and component dependencies, that they may be compromised, vulnerable, or untrustworthy in ways the organization can't fully control directly.

Supply Chain Security

The cloud-native discipline of securing the path from source code to running workload, signed images, verified dependencies, hardened pipelines, provenance, so that what runs is what was intended.

Supply Chain Visibility

Knowing what's in your supply chain, which vendors, components, libraries, and services the organization depends on, so risk can be assessed and managed rather than left invisible.

Symmetric Encryption

Encryption that uses the same shared key to encrypt and decrypt data.

Synthetic Test Data

Artificially generated data used to test detections safely, simulating attacker behavior or specific event patterns without running real attacks against production systems.

Syslog

A long-standing standard for forwarding log messages from systems and devices over the network. Defenders rely on syslog daily as a primary way Linux and networking gear ship logs to central collection.