Glossary

CSPM Integration

Incorporating cloud security posture management findings into a cloud assessment, using CSPM tooling to enumerate misconfigurations at scale and feeding its results into the assessment's prioritized findings.

CSRF

Cross-Site Request Forgery: a web attack that tricks a logged-in user's browser into sending an unwanted, authenticated request to a site, performing an action the user did not intend, like changing a setting or making a transfer.

CSRF Token

A secret, unpredictable value a web app embeds in forms and requires on state-changing requests, so it can verify the request came from its own page and not a forged cross-site one. It is the primary defense against CSRF.

CVE

Common Vulnerabilities and Exposures: a standardized identifier (like CVE-2024-12345) assigned to a publicly known software vulnerability, giving everyone a common reference to track, discuss, and remediate the same flaw.

CVSS

The Common Vulnerability Scoring System: a standardized way to rate a vulnerability's severity on a 0-10 scale based on factors like exploitability and impact, helping teams compare and prioritize vulnerabilities consistently.

CWPP

Cloud Workload Protection Platform: tooling that secures running cloud workloads, VMs, containers, and serverless, through vulnerability scanning, hardening checks, and runtime threat detection, wherever the workload runs.

CWPP Capabilities

The core functions a cloud workload protection platform provides, vulnerability scanning, configuration and compliance checks, integrity monitoring, and runtime threat detection, across VMs, containers, and serverless, delivered via agents or agentless methods.

CWPP Operations

The day-to-day work of running a cloud workload protection platform, deploying agents or agentless scanning, tuning detections, triaging workload alerts, and remediating findings, so the platform's capabilities translate into actual protection.

Calibration

The process of aligning estimators' confidence with their actual accuracy, so probability and range estimates used in risk analysis are reliable rather than over- or under-confident. It is what makes expert judgment trustworthy in quantitative risk work.

Campaign Tracking

Following a coordinated set of related attacker activity over time, a campaign, by grouping shared indicators, infrastructure, and techniques. It helps a SOC connect isolated events into a bigger picture and anticipate the adversary's moves.

Campaign-Based Hunting

A threat-hunting approach built around a specific attack campaign, searching for the indicators, infrastructure, and techniques associated with that coordinated activity to find whether it has touched your environment.

Career Arc IR

The typical career progression in incident response, from junior responder through senior responder and incident commander toward leadership, and the skills and mindset shifts each stage requires.

Career Ladders

Defined progression paths for security analysts, laying out the levels (such as Tier 1 to Tier 3 and into specialties or leadership) and the skills and responsibilities expected at each. They give analysts a clear way to grow.

Career Pivots

Moves an analyst makes to change direction within or beyond security, such as shifting from SOC work into detection engineering, threat intelligence, incident response, or cloud security, building on transferable skills.

Case

A record that groups the alerts, evidence, actions, and notes related to a single investigation in a SOC. It is the unit of work analysts open, work, and close, keeping an investigation organized and auditable.

Case Lifecycle

The stages an investigation case moves through, from creation and triage, through investigation and response, to resolution and closure. Tracking the lifecycle keeps work flowing and ensures cases are not dropped or left open.

Case Management System

The tool a SOC uses to create, track, and document investigation cases, holding alerts, evidence, actions, and outcomes in one place. It provides structure, accountability, and an audit trail for security operations.

Certifiable vs Reference

A distinction between security frameworks you can be formally certified against (like ISO 27001) and reference frameworks meant as guidance you adopt and adapt (like the NIST Cybersecurity Framework). The type changes how you use the framework.

Certificate

A digital certificate is a signed electronic document that binds a public key to an identity, such as a website's domain, and is vouched for by a trusted certificate authority. It is what lets clients trust they are talking to the real party in HTTPS.

Certificate Authority

A trusted entity that issues digital certificates.

Certificate Pinning

A defense where an application is configured to trust only a specific certificate or key for a server, rejecting any other even if signed by a valid authority. It blocks attackers who obtain a fraudulent but technically valid certificate.

Certificate Transparency

A public-logging system that records every TLS certificate issued by participating authorities, so domain owners and the public can detect mis-issued or unauthorized certificates for their domains.

Certificate Validation

The checks a client performs before trusting a certificate: confirming a trusted authority signed it, that it matches the expected identity, that it has not expired, and that it has not been revoked. Skipping or weakening these checks is a serious flaw.

Certifications

Professional credentials that validate a security analyst's knowledge, such as Security+, CySA+, or vendor and SOC-focused certifications. They help with hiring and advancement but complement, rather than replace, hands-on skill.

ChaCha20

A modern stream cipher used for fast, secure symmetric encryption, often paired with the Poly1305 authenticator as ChaCha20-Poly1305. It is a common alternative to AES, especially on devices without AES hardware acceleration.

Chief Information Security Officer

The senior executive accountable for an organization's information security program, setting strategy, managing security risk, leading the security function, and reporting to executives and the board. The CISO bridges security and business leadership.

Choke Points

Network locations through which traffic must pass, such as gateways, proxies, or segmentation boundaries, where defenders can concentrate monitoring and control. Channeling traffic through choke points makes it easier to inspect and stop attacks.

Cipher Suite

A named bundle of cryptographic algorithms a TLS connection agrees to use, typically specifying the key exchange, authentication, bulk encryption, and integrity methods. The chosen suite determines how strong and modern the connection's protection is.

Clickjacking

An attack that hides or frames a real page so a user clicks something they did not intend to click.

Cloud Account

A cloud account is a logical container for cloud resources, identities, billing, permissions, and configuration.

Cloud Alerts

SOC alerts generated from cloud platform activity, such as suspicious API calls, risky configuration changes, new identities or keys, and provider threat-detection findings. They require cloud-specific context to triage because the cloud control plane behaves differently from on-premises systems.