Glossary

Next-Generation Firewall

A firewall that considers application, identity, content, and threat context in addition to ports.

Next-Generation Firewalls

Firewalls that inspect traffic beyond ports and addresses, looking at applications, users, and content, with features like deep packet inspection, IPS, and identity awareness, providing richer policy and detection than traditional firewalls.

No Implicit Trust by Location

No implicit trust by location means that an internal address, office network, VPN tunnel, cloud network, owned device, or organizational affiliation does not by itself authorize resource access.

Non-Repudiation

The property that a party cannot credibly deny having performed an action, since cryptographic or audit evidence ties them to it. It supports accountability alongside the CIA triad's other properties.

Non-Root Container Execution

Non-root container execution runs the workload as a dedicated unprivileged operating-system identity instead of UID 0 inside the container.

Nonresponse and Default Outcomes

Nonresponse and default outcomes specify the tested action when an access reviewer does not decide by the deadline.

OAuth 2.0

An authorization framework that lets an application obtain limited access to a user's resources on another service without handling the user's password, by issuing scoped access tokens. It underpins much of modern delegated access.

OAuth and OIDC Client Testing

OAuth and OIDC client testing verifies how an application initiates, binds, validates, stores, and ends authorization and authentication transactions with an authorized identity provider.

OIDC Client Security

OIDC client security protects authorization-code initiation, redirect handling, PKCE, state or nonce binding, issuer selection, token validation, key rollover, client authentication, and token storage.

OIDC Federation for CI/CD

OIDC federation for CI/CD exchanges signed workflow identity claims for short-lived cloud or broker credentials instead of storing a copied long-lived key.

OPA Gatekeeper

A Kubernetes admission controller built on Open Policy Agent that enforces policy on resources as they are created, blocking or auditing workloads that violate rules, so cluster policy is enforced automatically.

OPA and Sentinel

Two policy-as-code tools, Open Policy Agent (OPA) and HashiCorp Sentinel, that a cloud engineer uses to define and automatically enforce policies on infrastructure and access, codifying guardrails as testable rules.

OSI Model

A conceptual model that organizes network communication into layers.

OWASP Testing Guide

A comprehensive, community-developed methodology for testing web application security, organizing the techniques and checks a tester uses to systematically assess an application for vulnerabilities.

Object Storage Security Assessment

Object storage security assessment reviews bucket or account policy, public protections, identities, networks, encryption, keys, versions, retention, replication, events, logs, lifecycle, deletion, and intended publication.

Object and Function Authorization Testing

Object and function authorization testing verifies that the server permits each subject to perform only approved actions on approved objects in the correct role, tenant, and workflow state.

Obligation Source

An obligation source is the authoritative law, regulation, order, contract, license, incorporated standard, policy, or governance decision from which a requirement arises.

Obligation Source Register

An obligation source register records legal, regulatory, contractual, policy, and voluntary requirements with their authoritative source, applicability, owner, interpretation, evidence, effective date, and review trigger.

Obligation vs Aspiration

The distinction in policy writing between mandatory requirements (obligations, what people must do) and aspirational guidance (what is encouraged), so policies are clear about what is enforceable versus merely desirable.

Obligations Applicability Matrix

An obligations applicability matrix records which privacy requirements apply to each entity, role, population, jurisdiction, and processing activity and why.

Obligations Inventory

An obligations inventory is a maintained register of legal, regulatory, contractual, standard, and internal commitments that can create compliance work.

Offboarding Orchestration

Offboarding orchestration coordinates central sign-in blocking, token and session response, entitlement removal, device actions, ownership transfer, downstream deprovisioning, evidence retention, and verification.

On-Call Dynamics

The realities of being on-call for incident response, unpredictable disruptions, pressure to respond fast, fatigue, and impact on life, that affect responder effectiveness and wellbeing and must be managed deliberately.

One-Page Risk Brief

A one-page risk brief summarizes a quantified decision with its owner, scoped scenario, horizon, current and residual exposure, alternatives, cost, recommendation, drivers, and limitations.

One-Way Function

A function designed to be practical to compute while making inversion computationally infeasible under stated assumptions and parameters.

One-Way Functions

Functions that are easy to compute in one direction but infeasible to reverse, the mathematical basis of much cryptography, especially hashing, where you cannot practically recover the input from the output.

Open Policy Agent for IaC

Using Open Policy Agent to enforce security policy on infrastructure-as-code before deployment, evaluating Terraform or similar definitions against rules so non-compliant infrastructure is blocked in the pipeline.

Open Source Contribution

Contributing to shared open-source detection content, rules, analytics, and tools, so detection engineers both benefit from and give back to the community, raising the collective quality of detections.

Open Source Intelligence

OSINT: intelligence gathered from publicly available sources, websites, social media, public records, forums, that a SOC uses to understand threats, actors, and its own exposure without privileged access.

OpenID Connect

An identity layer on top of OAuth that helps applications verify who a user is.

OpenID Connect (OIDC)

OpenID Connect is an identity layer on OAuth 2.0 that lets a client verify an authentication event through a validated ID Token.