Terminology Index

Glossary

2953 terms

SAML

Security Assertion Markup Language: a long-standing federation standard for single sign-on, where an identity provider asserts a user's identity to a service provider via signed XML messages.

SAML 2.0

SAML 2.0 is an XML-based federation standard in which an identity provider sends signed assertions about an authenticated subject to a service provider.

SAST Implementation

Operating Static Application Security Testing in practice, integrating it into pipelines, tuning to manage noise, prioritizing findings, and making developers act on results so SAST delivers real value.

SBOM

A software bill of materials that lists components used in an application or system.

SBOM and Dependency Correlation

SBOM and dependency correlation maps vulnerability information to software components, relationships, builds, artifacts, products, and deployments using supplier and package identity evidence.

SCA Implementation

Operating Software Composition Analysis to track and secure open-source dependencies, integrating it into pipelines, managing findings, and driving updates so supply-chain risk in dependencies is actually addressed.

SCIM Protocol

System for Cross-domain Identity Management: a standard for provisioning users, groups, and identity attributes between systems, the protocol modern IAM uses to keep accounts in sync across applications.

SCIM Provisioning Validation

SCIM provisioning validation proves that identity create, update, disable, rehire, and entitlement changes reach the intended target with correct attributes and state.

SGID

The set-group-ID bit on Unix-like executables and directories. On executables it runs the program with the group's permissions; on directories it inherits the group to new files. A classic permission concept defenders inspect.

SHA-1

An older cryptographic hash function (160-bit) once widely used but now broken for security: practical collisions exist, so it must not be used for signatures or integrity guarantees.

SHA-256

A widely used cryptographic hash function (256-bit) from the SHA-2 family, currently the standard secure choice for integrity, signatures, and IOC fingerprints across modern cryptography.

SIEM

Security Information and Event Management: the platform that collects, stores, normalizes, and analyzes security telemetry, the central tool for detection, hunting, and investigation in modern SOCs.

SIEM Data Models

The schemas and structures SIEMs use to normalize events from many sources into common fields, so queries and detections work across them rather than re-implementing per source.

SIEM Investigation Workflow

The standard pattern analysts follow to investigate alerts and incidents in a SIEM, gathering context, pivoting across data, and building a timeline using the SIEM's query and visualization tools.

SLA (Service Level Agreement) Tracking

SLA tracking measures a documented service commitment using explicit scope, start and stop events, pauses, exclusions, priority rules, data source, and owner.

SLA and Contract Risk

Risks that arise from service-level agreements and contracts, with vendors, customers, partners, that the organization must understand, monitor, and treat as part of risk management.

SMB

Server Message Block: a Windows file-sharing and inter-system protocol heavily used legitimately and heavily abused by attackers for lateral movement and remote execution.

SMB Hardening (SMBv1/Signing)

SMB hardening removes obsolete SMB dialects and requires modern protections such as signing, safe authentication, and encryption where confidentiality is needed.

SMB Lateral Movement Detection

Detecting attackers using SMB to move between hosts, by spotting unusual share access, remote command execution patterns, and anomalous SMB authentication, mapped to ATT&CK.

Because SMB is heavily abused for lateral movement, detection focuses on its specific anomalies: unusual administrative-share access, PsExec-like remote execution patterns, anomalous SMB authentication, file transfers between hosts not normally interacting. Built on Windows authentication and process telemetry and mapped to the relevant ATT&CK technique, SMB lateral-movement detection is high-value because attackers reliably use SMB after initial access. It complements RDP and pass-the-hash detections in covering Windows lateral movement.

Introduced in: Writing Detections with ATT&CK

Examples

Alerting on PsExec-style remote execution patterns over SMB.
Detecting unusual administrative-share access between hosts.
Mapping the detection to the ATT&CK SMB lateral-movement technique.

SMBrelates_to Lateral Movementrelates_to RDP Lateral Movement Detectionrelates_to Pass-the-Hash Detectionrelates_to MITRE ATT&CK Frameworkrelates_to Startup Folderrelates_to System Callsrelates_to SMBrelates_to

SMS OTP

One-time passcodes delivered via SMS as an MFA factor, widely used, easy to deploy, but weaker than modern phishing-resistant methods because SMS can be intercepted, SIM-swapped, or phished.

SMTP

Simple Mail Transfer Protocol: the protocol that moves email between servers across the internet. Foundational to email infrastructure and a target for both abuse and detection.

SNI

Server Name Indication: a TLS extension that tells the server which hostname the client is connecting to, so a single IP can host TLS certificates for many names. Defenders read SNI in traffic to identify destinations.

SNMP

Simple Network Management Protocol: a protocol for monitoring and configuring network devices, widely deployed and historically prone to weak community-string authentication that attackers exploit.

SOAR

Security Orchestration, Automation, and Response: platforms that automate SOC workflows, enrichment, containment, response steps, by linking tools together, so analysts spend less time on repetitive work.

SOAR Integration Safety

SOAR integration safety constrains automated security actions with authorization, confidence gates, dependency checks, scope limits, reversibility, expiry, rollback, failure handling, and audit records.

SOC

The team or function that monitors, detects, and responds to security threats day to day, the operational center of blue-team work. Often used as shorthand for Security Operations Center.

SOC 2

An audit framework from the AICPA that assesses a service organization's controls against the Trust Services Criteria, widely demanded by customers as evidence of security and operational maturity.

SOC 2 Cloud

Operating SOC 2 compliance in cloud environments, leveraging provider attestations for inherited controls and demonstrating customer-side controls for what shared responsibility leaves to the customer.

SOC 2 Gap Assessment

An internal assessment that compares current controls against SOC 2 Trust Services Criteria to find gaps before an external audit, so they can be remediated in time.

SOC 2 Policy Coverage

Ensuring an organization's policy set covers all areas SOC 2 expects, access control, change management, vendor risk, incident response, so audit evidence about policies is complete.

SOC 2 Policy Requirements

The specific policies SOC 2 expects to see, with content, ownership, and approvals appropriate to the Trust Services Criteria, that organizations meet to satisfy the policy side of SOC 2.

SOC 2 Program Design

The capstone exercise of designing a complete SOC 2 program, scope, controls, policies, evidence, audit plan, that demonstrates a working approach to satisfying SOC 2 end to end.