Terminology Index

Glossary

2953 terms

Case Management System

The tool a SOC uses to create, track, and document investigation cases, holding alerts, evidence, actions, and outcomes in one place. It provides structure, accountability, and an audit trail for security operations.

Certifiable vs Reference

A distinction between security frameworks you can be formally certified against (like ISO 27001) and reference frameworks meant as guidance you adopt and adapt (like the NIST Cybersecurity Framework). The type changes how you use the framework.

Certificate

A digital certificate is a signed electronic document that binds a public key to an identity, such as a website's domain, and is vouched for by a trusted certificate authority. It is what lets clients trust they are talking to the real party in HTTPS.

Certificate Authority

A trusted entity that issues digital certificates.

Certificate Pinning

A defense where an application is configured to trust only a specific certificate or key for a server, rejecting any other even if signed by a valid authority. It blocks attackers who obtain a fraudulent but technically valid certificate.

Certificate Transparency

A public-logging system that records every TLS certificate issued by participating authorities, so domain owners and the public can detect mis-issued or unauthorized certificates for their domains.

Certificate Validation

The checks a client performs before trusting a certificate: confirming a trusted authority signed it, that it matches the expected identity, that it has not expired, and that it has not been revoked. Skipping or weakening these checks is a serious flaw.

Certifications

Professional credentials that validate a security analyst's knowledge, such as Security+, CySA+, or vendor and SOC-focused certifications. They help with hiring and advancement but complement, rather than replace, hands-on skill.

ChaCha20

A modern stream cipher used for fast, secure symmetric encryption, often paired with the Poly1305 authenticator as ChaCha20-Poly1305. It is a common alternative to AES, especially on devices without AES hardware acceleration.

Chain of Custody

A record of who handled evidence and when, used to preserve trust in the evidence.

Chief Information Security Officer

The senior executive accountable for an organization's information security program, setting strategy, managing security risk, leading the security function, and reporting to executives and the board. The CISO bridges security and business leadership.

Choke Point

A constrained path through which important traffic or operations pass, creating a useful enforcement and observation location as well as concentration and availability risk.

Choke Points

Network locations through which traffic must pass, such as gateways, proxies, or segmentation boundaries, where defenders can concentrate monitoring and control. Channeling traffic through choke points makes it easier to inspect and stop attacks.

Rather than watching everywhere, defenders design networks so traffic funnels through a few controllable points where logging, filtering, and inspection are applied. Choke points also constrain lateral movement, since an attacker must cross them to reach new segments, giving defenders a place to detect and block them.

Introduced in: Networking Foundations

Examples

Routing internet egress through a single inspected gateway.
Placing monitoring at a segmentation boundary between zones.
Forcing traffic between subnets through a controlled firewall.

Lateral Movementrelates_to Network Evidencerelates_to Networkrelates_to Egress Filteringrelates_to Bastion Hostsrelates_to DMZrelates_to VLANsrelates_to CIAM Platform Landscaperelates_to

Cipher Suite

A named bundle of cryptographic algorithms a TLS connection agrees to use, typically specifying the key exchange, authentication, bulk encryption, and integrity methods. The chosen suite determines how strong and modern the connection's protection is.

Cipher Suite Negotiation

Selection of mutually supported TLS cryptographic parameters under protocol-version rules and local policy; TLS 1.3 cipher suites cover different components than TLS 1.2 suites.

Ciphertext

Data that has been encrypted, rendering it unreadable without the correct key. It is the scrambled output of applying a cipher to plaintext, and protecting confidentiality means ensuring sensitive data exists as ciphertext wherever attackers might reach it.

Clickjacking

An attack that hides or frames a real page so a user clicks something they did not intend to click.

Cloud Account

A cloud account is a logical container for cloud resources, identities, billing, permissions, and configuration.

Cloud Alert

An alert from cloud identity, control-plane, data-plane, workload, network, configuration, or managed-service telemetry with provider and tenant context.

Cloud Alerts

SOC alerts generated from cloud platform activity, such as suspicious API calls, risky configuration changes, new identities or keys, and provider threat-detection findings. They require cloud-specific context to triage because the cloud control plane behaves differently from on-premises systems.

Cloud Architecture Dependency

A cloud architecture dependency links services, identities, network, DNS, keys, secrets, data, pipelines, quotas, suppliers, observability, and recovery into trust and failure paths.

Cloud Architecture Security Review

A security architecture review focused on a cloud environment, examining how accounts, identity, networking, data protection, and services are designed to find systemic weaknesses such as over-broad access, flat networks, or unprotected data.

Cloud Assessment Authorization

Cloud assessment authorization is explicit permission to examine or test named cloud organizations, tenants, accounts, subscriptions, projects, services, regions, identities, data, and environments.

Cloud Assessment Evidence Handling

Cloud assessment evidence handling minimizes, protects, redacts, transfers, retains, and disposes of exported policies, inventories, logs, screenshots, queries, and architecture data.

Cloud Assessment Findings

The documented weaknesses a cloud security assessment uncovers, such as over-permissioned identities, publicly exposed storage, missing encryption, or absent logging, each with its risk and a recommended fix. They are the actionable output of the assessment.

Cloud Assessment Methodology

A structured, repeatable process for assessing the security of a cloud environment: scoping it, prioritizing identity, examining resources, networks, data, and logging, validating findings, and reporting. It keeps cloud assessments thorough and consistent.

Cloud Assessment Scope

The defined boundaries of a cloud security assessment, which accounts, subscriptions, services, and regions are included, and what is out of scope. It is set first so the assessment is focused and its coverage and limits are clear.

Cloud Assessment Test Plan

A cloud assessment test plan links each expected control to its cloud objects, assessment method, depth, sample, evidence, determination statement, and completion status.

Cloud Assessment Tools

The software used to assess cloud security, including provider-native posture tools and open-source scanners (such as those that analyze IAM policies or scan for misconfigurations). They automate discovery of exposure, excessive permissions, and configuration weaknesses.

Cloud Asset Inventory Confidence

Cloud asset inventory confidence is the assessed completeness, freshness, permission reach, region and service coverage, history, and reconciliation quality of a cloud resource inventory.

Cloud Audit Coverage

Cloud audit coverage measures which event classes, accounts, subscriptions, projects, regions, resources, and periods are actually collected and retained.

Cloud Audit Log

A cloud platform's record of control-plane activity, who called which API, on what resource, when, and from where. It is the foundational telemetry for detecting, investigating, and auditing actions in a cloud environment.