Terminology Index

Glossary

2953 terms

ISAC

Information Sharing and Analysis Center: a sector-based organization through which member companies share threat intelligence relevant to their industry, enabling collective defense against threats targeting that sector.

An ISAC is an industry body that gathers, analyzes, and shares threat intelligence among members of a sector (such as finance, healthcare, or energy), so organizations benefit from each other's observations of threats targeting their industry. ISACs provide indicators, alerts, and analysis, and foster trusted sharing. For a SOC, an ISAC is a high-value external intelligence source whose sector focus makes its intelligence especially relevant to anticipating and detecting industry-specific threats.

Introduced in: Threat Intelligence for SOC Analysts

Examples

A financial-sector ISAC sharing indicators of a banking-targeted campaign.
Receiving sector-specific alerts and analysis from an ISAC.
Contributing observed threats back to the industry ISAC.

Industry Sharingrelates_to Government Intelligencerelates_to Open Source Intelligencerelates_to Indicators of Compromiserelates_to Intelligence Cyclerelates_to Government Intelligencerelates_to Industry Sharingrelates_to

ISO 27001

An international standard for an information security management system (ISMS), specifying how an organization should systematically manage information security through risk-based controls, and offering formal certification.

ISO 27001 Audit Cycle

The recurring audit timeline for maintaining ISO 27001 certification, an initial certification audit followed by periodic surveillance audits and a recertification audit, that keeps certification valid over a multi-year cycle.

ISO 27001 Certification Process

The steps to achieve ISO 27001 certification, building the ISMS, conducting internal audits and management review, then passing a two-stage external certification audit, framed within framework and control implementation.

ISO 27001 Cloud

Applying ISO 27001 to cloud environments, scoping the ISMS to include cloud services, addressing shared responsibility, and using cloud-specific guidance (like ISO 27017/27018) so the management system covers cloud risks.

ISO 27001 Controls

The set of security controls associated with ISO 27001 (its Annex A control catalog), spanning organizational, people, physical, and technological measures that an organization selects from based on its risk assessment.

ISO 27001 ISMS

The information security management system at the heart of ISO 27001, the framework of policies, processes, risk management, and controls through which an organization systematically manages and improves information security.

ISO 27002 Controls

The detailed control guidance companion to ISO 27001, ISO 27002 elaborates how to implement the information-security controls referenced in ISO 27001's Annex A, giving practical implementation detail for each.

ISO 27017

An international standard giving cloud-specific security guidance that extends ISO 27001/27002 to cloud services, addressing the shared responsibilities and controls relevant to both cloud providers and customers.

ISO 31000 Process

The risk-management process defined by ISO 31000, establishing context, then identifying, analyzing, evaluating, and treating risk, with ongoing communication and monitoring, providing a generic, principles-based framework for managing any risk.

ISO IEC 27001

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system within a defined scope.

ISO vs SOC 2 Choice

The decision between pursuing ISO 27001 certification or a SOC 2 report, two leading ways to demonstrate security to customers, based on factors like target market, geography, customer expectations, and how each is used.

ISO/IEC 27001

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system within a defined scope.

IaC Exception Governance

Infrastructure-as-code exception governance authorizes a narrowly scoped departure from policy for a specific rule, resource, environment, and period.

IaC Security Scanning

Scanning infrastructure-as-code (such as Terraform or Kubernetes manifests) for security issues before deployment, catching misconfigurations like open access or missing encryption in the code that defines the infrastructure.

IaaS

Infrastructure as a Service: a cloud model where the provider supplies virtualized compute, storage, and networking, and the customer manages everything above that, operating systems, applications, and most security configuration.

Idempotent Configuration

Configuration management where applying the same definition repeatedly always produces the same end state, so re-running it is safe and reliably reasserts the intended secure configuration, correcting any drift.

Identification

The step where an entity claims an identity, such as entering a username, distinct from authentication, which proves the claim. It is the first stage of establishing who someone is in access control.

Identifier

A value that uniquely names an identity within a system, such as a username, email, employee ID, or account number, used to reference and distinguish one identity from another.

Identity

The digital representation of a person, service, or device in a system, the set of attributes and credentials that distinguishes one actor from another and to which access and accountability are tied. It is the foundation of access control.

Identity Account Reconciliation

Identity account reconciliation compares authoritative people, workload, directory, and application records so every account has a verified identity, owner, purpose, and state.

Identity Analytics Capabilities

Analytical functions in identity governance that examine access and behavior data to surface risk, such as detecting outlier access, separation-of-duties conflicts, dormant accounts, and risky entitlements, turning identity data into actionable insight.

Identity Analytics Purpose

Identity analytics uses access, lifecycle, ownership, review, activity, and policy data to prioritize governance questions and measure control conditions at scale.

Identity Anomaly Detection

Detecting unusual identity behavior that may signal compromise, such as logins at odd times or locations, impossible travel, or atypical access, by comparing current activity against an established baseline of normal.

Identity Containment Planning

Identity containment planning addresses affected passwords, tokens, sessions, secrets, service identities, delegation, federation, recovery methods, privileges, certificates, and trust relationships.

Identity Containment Strategy

An identity containment strategy addresses affected sessions, tokens, passwords, keys, grants, federation, recovery methods, devices, privilege changes, and service dependencies in a safe sequence.

Identity Correlation

Identity correlation associates source identities, directory objects, target accounts, and entitlements with the correct canonical subject using stable identifiers and reviewable evidence.

Identity Event Normalization

Identity event normalization maps heterogeneous sign-in, token, directory, application, and authorization records into consistent fields while retaining the original evidence.

Identity Federation

Establishing trust between identity systems so a user authenticated in one can access another without a separate account, the mechanism an IAM engineer builds, via standards like SAML and OIDC, to enable single sign-on across organizations and clouds.

Identity Governance and Administration (IGA)

Identity Governance and Administration combines lifecycle, access-request, policy, certification, role, and evidence workflows for identities and entitlements.

Identity Hunt Enrichment

Identity hunt enrichment adds authoritative context such as employment state, ownership, device compliance, application, privilege, access reviews, change records, and resource activity to identity events.

Identity Hunting Value

The principle that identity data is among the highest-value sources for threat hunting, because identity is the modern attack surface, so hunting in authentication and access telemetry catches intrusions that endpoint or network hunting may miss.