Terminology Index

Glossary

2953 terms

CNAPP Integration

Combining cloud workload protection with the broader CNAPP platform so that workload findings (vulnerabilities, runtime threats) are correlated with posture and identity context, producing prioritized, attack-path-aware risk rather than isolated alerts.

CORS

Cross-Origin Resource Sharing: a browser mechanism that lets a server specify which other origins may access its resources via scripts, relaxing the default same-origin policy in a controlled way. Misconfigured CORS can expose data to malicious sites.

CSA STAR

The Cloud Security Alliance's Security, Trust, Assurance and Risk registry, a public program where cloud providers publish assessments of their security controls, letting customers evaluate and compare providers' security and compliance.

CSF Functions

The six high-level NIST Cybersecurity Framework 2.0 functions-Govern, Identify, Protect, Detect, Respond, and Recover - that organize cybersecurity outcomes.

CSF Profiles

In the NIST Cybersecurity Framework, a Profile is a snapshot of an organization's chosen cybersecurity outcomes, used to describe its current state, define a target state, and plan the gap between them.

CSF Tiers

The NIST Cybersecurity Framework's Implementation Tiers, from Partial (Tier 1) to Adaptive (Tier 4), that describe how rigorous and integrated an organization's cybersecurity risk management practices are.

CSF vs 800-53 Use Cases

Guidance on when to use the NIST Cybersecurity Framework versus NIST SP 800-53: the CSF as a flexible, outcome-based structure for risk management and communication, and 800-53 as a detailed control catalog for implementation and federal compliance.

CSP

Content Security Policy: a browser security mechanism, delivered via an HTTP header, that lets a site restrict which sources of scripts, styles, and other content the browser will load, sharply reducing the impact of cross-site scripting.

CSP tells the browser which origins are trusted for each content type, so even if an attacker injects a script, the browser refuses to run it unless its source is allowed. A well-crafted policy is one of the strongest defenses against cross-site scripting and related injection, though it must be tuned carefully to avoid breaking legitimate content. It is configured through response headers alongside other browser protections.

Introduced in: Defensive Web Fundamentals

Examples

A policy that only allows scripts from the site's own origin, blocking injected ones.
Using CSP to disallow inline scripts that XSS often relies on.
Tuning a policy so legitimate third-party resources still load.

Content Security Policyrelates_to Cross-Site Scriptingrelates_to Clickjackingrelates_to CORSrelates_to HTTPrelates_to Fragmentrelates_to HTTP Methodrelates_to Mixed Contentrelates_to

CSPM

Cloud Security Posture Management: tools that continuously assess cloud configurations against secure baselines and compliance standards, flagging misconfigurations like public exposure or disabled logging, and often remediating them automatically.

CSPM Integration

Incorporating cloud security posture management findings into a cloud assessment, using CSPM tooling to enumerate misconfigurations at scale and feeding its results into the assessment's prioritized findings.

CSRF

Cross-Site Request Forgery: a web attack that tricks a logged-in user's browser into sending an unwanted, authenticated request to a site, performing an action the user did not intend, like changing a setting or making a transfer.

CSRF Token

A secret, unpredictable value a web app embeds in forms and requires on state-changing requests, so it can verify the request came from its own page and not a forged cross-site one. It is the primary defense against CSRF.

CVE

Common Vulnerabilities and Exposures: a standardized identifier (like CVE-2024-12345) assigned to a publicly known software vulnerability, giving everyone a common reference to track, discuss, and remediate the same flaw.

CVSS

The Common Vulnerability Scoring System: a standardized way to rate a vulnerability's severity on a 0-10 scale based on factors like exploitability and impact, helping teams compare and prioritize vulnerabilities consistently.

CVSS Contextualization

CVSS contextualization records the scoring version, full vector, metric assumptions, and relevant Threat and Environmental inputs, then combines the result with organizational risk factors outside CVSS.

CVSS v4 Interpretation

CVSS v4 interpretation reads the versioned vector and its Base, Threat, Environmental, and Supplemental metric groups as technical context rather than a complete organizational risk decision.

CVSS v4 Use and Limitations

CVSS v4 use and limitations describe vulnerability characteristics with the FIRST version 4.0 Base, Threat, Environmental, and Supplemental metrics while preserving the vector and assumptions.

CWPP

Cloud Workload Protection Platform: tooling that secures running cloud workloads, VMs, containers, and serverless, through vulnerability scanning, hardening checks, and runtime threat detection, wherever the workload runs.

CWPP Capabilities

The core functions a cloud workload protection platform provides, vulnerability scanning, configuration and compliance checks, integrity monitoring, and runtime threat detection, across VMs, containers, and serverless, delivered via agents or agentless methods.

CWPP Operations

The day-to-day work of running a cloud workload protection platform, deploying agents or agentless scanning, tuning detections, triaging workload alerts, and remediating findings, so the platform's capabilities translate into actual protection.

Calibrated Estimation

A skill for making numerical risk estimates whose stated confidence matches reality, so that when an estimator says they are 90% confident, they are right about 90% of the time. It produces honest, useful ranges instead of false precision or vague guesses.

Calibration

The process of aligning estimators' confidence with their actual accuracy, so probability and range estimates used in risk analysis are reliable rather than over- or under-confident. It is what makes expert judgment trustworthy in quantitative risk work.

Campaign Tracking

Following a coordinated set of related attacker activity over time, a campaign, by grouping shared indicators, infrastructure, and techniques. It helps a SOC connect isolated events into a bigger picture and anticipate the adversary's moves.

Campaign-Based Hunting

A threat-hunting approach built around a specific attack campaign, searching for the indicators, infrastructure, and techniques associated with that coordinated activity to find whether it has touched your environment.

Capstone Case Integrity

Capstone case integrity preserves original alert, rule, event, entity, timestamp, query, result, action, and analyst-decision evidence with appropriate access and provenance.

Cardholder Data Environment (CDE)

The cardholder data environment comprises the people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus connected or security-impacting components included by PCI DSS scoping rules.

Career Arc IR

The typical career progression in incident response, from junior responder through senior responder and incident commander toward leadership, and the skills and mindset shifts each stage requires.

Career Ladder

A documented progression of role expectations, competencies, scope, decision authority, evidence of performance, and compensation or promotion criteria.

Career Ladders

Defined progression paths for security analysts, laying out the levels (such as Tier 1 to Tier 3 and into specialties or leadership) and the skills and responsibilities expected at each. They give analysts a clear way to grow.

Career Pivots

Moves an analyst makes to change direction within or beyond security, such as shifting from SOC work into detection engineering, threat intelligence, incident response, or cloud security, building on transferable skills.

Case

A record that groups the alerts, evidence, actions, and notes related to a single investigation in a SOC. It is the unit of work analysts open, work, and close, keeping an investigation organized and auditable.

Case Lifecycle

The stages an investigation case moves through, from creation and triage, through investigation and response, to resolution and closure. Tracking the lifecycle keeps work flowing and ensures cases are not dropped or left open.