Terminology Index

Glossary

2953 terms

SOC 2 Reporting

The formal SOC 2 report produced by a CPA firm describing the service organization's controls and the auditor's opinion, the deliverable customers consume as evidence of security and operational maturity.

SOC 2 Trust Services Criteria

The five categories SOC 2 evaluates against, security (required), availability, processing integrity, confidentiality, and privacy, that define what a SOC 2 audit covers in scope.

SOC 2 Type I and Type II

The two flavors of SOC 2 reports, Type I evaluates control design at a point in time, Type II evaluates operating effectiveness over a period (typically 6-12 months), which customers usually prefer.

SOC Analyst

A security operations practitioner who monitors, validates, investigates, documents, escalates, and helps contain security events using approved telemetry and playbooks.

SOC Burnout Prevention

Deliberate practices that prevent and address burnout in SOC teams, sustainable workload, rotation, recognition, mental-health support, since burnout is a chronic risk in high-pressure operational work.

SOC Business Case

The case for investment in a SOC, costs, capabilities, risks addressed, options, that leadership uses to decide whether and how to fund the function. A SOC-program-design deliverable.

SOC Career Reflection

Looking back deliberately on a SOC analyst journey, what was learned, what worked, what didn't, where to go next, a capstone-level practice that turns experience into growth and direction.

SOC Coverage Calculation

Calculating the staffing needed to provide given SOC coverage (24/7, business hours, follow-the-sun), accounting for shifts, overlap, leave, attrition, so the model is realistic.

Designing SOC coverage means math: 24/7 coverage doesn't come from one analyst working long hours, it requires multiple shifts, overlap for handoffs, allowance for leave and attrition, and headcount to staff the resulting schedule. Coverage calculation produces the headcount needed and informs operating-model and budget choices. As a SOC-program-design topic, it forces honest conversations about what coverage is actually achievable for a given investment.

Introduced in: Security Operations Program Design

Examples

Calculating how many analysts are needed for sustainable 24/7 coverage.
Accounting for shifts, overlap, leave, and attrition in the model.
Using coverage calculation to inform operating-model choices.

Follow-the-Sunrelates_to SOC Operating Modelsrelates_to On-Call Dynamicsrelates_to SOC Business Caserelates_to Hybrid SOCrelates_to Alert Management Designrelates_to SOC Business Caserelates_to SOC Operating Modelsrelates_to

SOC Leadership Communication

How SOC leaders communicate with their team and with executives, vision, expectations, performance, support, that shapes morale, retention, and how the SOC is perceived across the organization.

SOC Manager

The role responsible for running the SOC, leading analysts, managing operations and performance, representing the SOC to leadership. A pivotal blue-team leadership role.

SOC Maturity Levels

A maturity model describing levels of SOC capability, from ad hoc through optimized, used to assess where a SOC stands and plan its growth across people, process, and technology.

SOC Metrics Framework

The structured framework an organization uses to organize SOC metrics, what to measure, how to define them, how they roll up, so SOC performance is reported coherently rather than ad hoc.

SOC Metrics That Matter

The principle of choosing SOC metrics deliberately for what they actually reveal about effectiveness and decisions, avoiding vanity metrics like raw alert counts that don't tie to outcomes.

SOC Metrics from Incidents

Metrics derived from incident data, MTTD, MTTR, dwell time, severity distributions, that show how the SOC actually performed against real events rather than against synthetic measures.

SOC Operating Model

A SOC operating model defines monitoring scope, services, hours, roles, authority, workflows, platforms, evidence, handoffs, quality review, suppliers, resilience, and measures.

SOC Operating Models

The structural models a SOC can run as, in-house, outsourced (MSSP/MDR), hybrid, follow-the-sun, virtual, each with different staffing, cost, and capability trade-offs.

SOC Reporting

An audit-and-assurance category covering the family of SOC (System and Organization Controls) reports, of which SOC 2 is best known, but also SOC 1 (financial controls) and SOC 3 (public-facing) exist.

SOC Tiering

The traditional structure that splits SOC analysts into tiers, T1 for initial triage, T2 for deeper investigation, T3 for advanced work, that organizes workflow and growth but has trade-offs in modern SOCs.

SOC-Engineering Interface

The working relationship between SOC analysts and security engineering, how detection ideas, tuning needs, and platform issues flow between them, that determines whether tooling actually serves operations.

SOC-Hunting Interface

The working relationship between routine SOC operations and threat hunting, how hunt hypotheses, findings, and new detections flow between them, that turns hunt output into operational defense.

SOC-IR Interface

The working relationship between SOC operations and incident response, how alerts become incidents, who takes ownership when, and how response feeds back into operations, that defines the handoff.

SPIFFE Identity

A SPIFFE identity is a URI-form workload identity proved with a SPIFFE Verifiable Identity Document such as an X.509-SVID or JWT-SVID.

SQL Injection

A vulnerability where untrusted input changes the meaning of a database query.

SQL Injection Testing

Testing an application for SQL injection vulnerabilities by probing inputs with crafted payloads to detect whether they reach the database as code, a classic web-pentest activity.

SSH

Secure Shell: a cryptographic protocol for remote shell access and other secure connections, widely used for Linux/Unix administration and as a heavily targeted attack surface when exposed.

SSO Implementation

Operating single sign-on in practice, choosing protocols, integrating applications, managing trust, that an IAM engineer handles to deliver SSO reliably and securely across an organization's apps.

STIG

A Security Technical Implementation Guide published for U.S. Department of Defense use that specifies technology configuration requirements, findings, and severity under its applicable authority and version.

STIGs

Security Technical Implementation Guides from the US Defense Information Systems Agency, detailed hardening checklists for specific products. STIGs are widely used hardening benchmarks beyond just defense.

STIX and TAXII

Open standards for threat intelligence: STIX defines a structured language for indicators, actors, and techniques; TAXII defines a protocol for exchanging them between systems and organizations.

STRIDE

A threat-modeling mnemonic for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

STRIDE Methodology

A threat-modeling methodology that classifies threats into six categories, Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege, that guides systematic identification.

STRIDE for Architecture

Applying the STRIDE threat-categorization model to architecture reviews, examining a system's components and flows for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.