Glossary

Audit Standards

The formal frameworks that define how audits must be conducted, such as the IIA Standards for internal audit or ISACA's standards for IT audit. They set expectations for independence, evidence, documentation, and reporting.

Audit Strategic Value

The contribution audit makes beyond compliance checking, by surfacing risks early, improving controls, and informing leadership decisions. It reframes audit as a partner that protects and enables the business rather than a cost.

Audit Trail

A chronological record of actions and events in a system, showing who did what and when, that lets reviewers reconstruct activity. In cloud compliance, it is core evidence that controls operated as required.

Audit Trails

Records that capture who performed which actions and when, providing the accountability that lets defenders trace events back to a responsible identity. They are foundational to investigation and to proving what happened.

Audit Universe

The complete set of areas, processes, and systems that could potentially be audited in an organization. It is the master list from which a risk-based audit plan selects what to audit and when.

Auditor Engagement

How an organization works with an external auditor across an audit, from initial engagement through fieldwork and findings. Productive engagement keeps the audit accurate, efficient, and free of surprises.

Auditor Relationships

The ongoing working relationship a GRC team maintains with internal and external auditors, built on trust, responsiveness, and transparency. A good relationship makes audits smoother and findings more constructive.

Auditor Selection

Auditor selection is the process of choosing a qualified and independent reviewer for a security, compliance, or assurance assessment.

Auditor Skills

The competencies an effective auditor needs, combining technical knowledge and methodology with communication, skepticism, and judgment. They determine how reliably an auditor can find and explain real issues.

Auth Log

An auth log records authentication activity such as sign-in attempts, successful logins, failures, MFA challenges, and account lockouts.

Authenticated Encryption

Authenticated encryption protects data confidentiality while also verifying that the ciphertext has not been changed.

Authentication

Authentication is the process of proving that a user, device, service, or system is who it claims to be.

Authentication Alerts

SOC alerts triggered by login and identity events, such as failed-login bursts, impossible travel, or logins from unusual locations or devices. They are a frequent and high-value alert category because attackers often start by abusing credentials.

Authentication Anomaly Detection

Detections that flag logins deviating from normal patterns, such as unusual times, locations, devices, or velocity, rather than matching a fixed signature. They catch credential abuse that looks technically valid.

Authentication Architecture Review

Assessing how a system proves who users are, examining the design of login flows, multi-factor authentication, session handling, token issuance, and federation, to find design weaknesses before they are exploited.

Authentication Factors

The categories of evidence used to prove identity: something you know (a password), something you have (a phone or token), and something you are (a fingerprint or face). Combining factors from different categories is what makes multi-factor authentication strong.

Authentication Protocols

The standardized methods systems use to verify identity and exchange authentication information, such as Kerberos, SAML, OAuth, OpenID Connect, and RADIUS. Each has its own trust model and security considerations.

Authentication Testing

Systematically evaluating an application's login and identity mechanisms during a security assessment to find weaknesses, such as weak session handling, missing MFA enforcement, or flaws in password and reset flows.

Authenticity

Authenticity is confidence that data, users, systems, or messages are genuine and not impersonated or altered.

Authoritative DNS Servers

The DNS servers that hold the official, definitive records for a domain and answer queries about it. When a resolver needs the true address for a name, the answer ultimately comes from the domain's authoritative server.

Authorization

Authorization is the decision about what an authenticated user, service, or system is allowed to do.

Authorization Architecture Review

Assessing how a system decides what an authenticated user is allowed to do, examining the design of its access model (such as RBAC or ABAC), enforcement points, and default-deny posture, to find gaps that allow excess access.

Authorization Code Flow

The standard OAuth 2.0 and OpenID Connect flow for web and mobile apps, where the app receives a short-lived authorization code and exchanges it server-side for tokens. It keeps tokens off the browser front channel, making it the recommended secure flow.

Authorization Models

The different schemes for deciding what an authenticated user may do, such as role-based access control (RBAC), attribute-based access control (ABAC), and relationship-based models. Each balances simplicity, flexibility, and manageability differently.

Authorization Policies

In cloud-native environments, the rules that define which services, workloads, or users may access which resources, often expressed declaratively and enforced by a service mesh or admission controller. They implement least privilege between components.

Authorization Testing Methodology

A structured approach to testing whether an application correctly enforces what users are allowed to do, checking for broken access control such as accessing other users' data or reaching admin functions without rights.

Authorized Keys

On Linux and Unix systems, the file listing public SSH keys permitted to log into an account without a password. Because it grants direct access, attackers abuse it as a stealthy persistence mechanism by adding their own key.

Auto-Remediation

Automatically correcting an insecure cloud configuration as soon as it is detected, without waiting for a human, for example re-enabling logging or removing a public access setting that violates policy.

Automated Provisioning Implementation

Building the systems and workflows that automatically create, update, and remove user access as people join, change roles, or leave, replacing manual account setup with rules driven by an authoritative identity source.

Automated Reporting

Generating compliance and security reports automatically from live data, such as control status, evidence, and posture, instead of compiling them by hand. It keeps reports current and frees teams from manual collection.

Availability Zones

Physically separate data center locations within a cloud region, each with independent power, cooling, and networking. Spreading workloads across zones lets a service survive the failure of one zone, supporting high availability.