Glossary

SNMP

Simple Network Management Protocol: a protocol for monitoring and configuring network devices, widely deployed and historically prone to weak community-string authentication that attackers exploit.

SOAR

Security Orchestration, Automation, and Response: platforms that automate SOC workflows, enrichment, containment, response steps, by linking tools together, so analysts spend less time on repetitive work.

SOC

The team or function that monitors, detects, and responds to security threats day to day, the operational center of blue-team work. Often used as shorthand for Security Operations Center.

SOC 2

An audit framework from the AICPA that assesses a service organization's controls against the Trust Services Criteria, widely demanded by customers as evidence of security and operational maturity.

SOC 2 Cloud

Operating SOC 2 compliance in cloud environments, leveraging provider attestations for inherited controls and demonstrating customer-side controls for what shared responsibility leaves to the customer.

SOC 2 Gap Assessment

An internal assessment that compares current controls against SOC 2 Trust Services Criteria to find gaps before an external audit, so they can be remediated in time.

SOC 2 Policy Coverage

Ensuring an organization's policy set covers all areas SOC 2 expects, access control, change management, vendor risk, incident response, so audit evidence about policies is complete.

SOC 2 Policy Requirements

The specific policies SOC 2 expects to see, with content, ownership, and approvals appropriate to the Trust Services Criteria, that organizations meet to satisfy the policy side of SOC 2.

SOC 2 Program Design

The capstone exercise of designing a complete SOC 2 program, scope, controls, policies, evidence, audit plan, that demonstrates a working approach to satisfying SOC 2 end to end.

SOC 2 Reporting

The formal SOC 2 report produced by a CPA firm describing the service organization's controls and the auditor's opinion, the deliverable customers consume as evidence of security and operational maturity.

SOC 2 Trust Services Criteria

The five categories SOC 2 evaluates against, security (required), availability, processing integrity, confidentiality, and privacy, that define what a SOC 2 audit covers in scope.

SOC 2 Type I and Type II

The two flavors of SOC 2 reports, Type I evaluates control design at a point in time, Type II evaluates operating effectiveness over a period (typically 6-12 months), which customers usually prefer.

SOC Burnout Prevention

Deliberate practices that prevent and address burnout in SOC teams, sustainable workload, rotation, recognition, mental-health support, since burnout is a chronic risk in high-pressure operational work.

SOC Business Case

The case for investment in a SOC, costs, capabilities, risks addressed, options, that leadership uses to decide whether and how to fund the function. A SOC-program-design deliverable.

SOC Career Reflection

Looking back deliberately on a SOC analyst journey, what was learned, what worked, what didn't, where to go next, a capstone-level practice that turns experience into growth and direction.

SOC Coverage Calculation

Calculating the staffing needed to provide given SOC coverage (24/7, business hours, follow-the-sun), accounting for shifts, overlap, leave, attrition, so the model is realistic.

SOC Leadership Communication

How SOC leaders communicate with their team and with executives, vision, expectations, performance, support, that shapes morale, retention, and how the SOC is perceived across the organization.

SOC Manager

The role responsible for running the SOC, leading analysts, managing operations and performance, representing the SOC to leadership. A pivotal blue-team leadership role.

SOC Maturity Levels

A maturity model describing levels of SOC capability, from ad hoc through optimized, used to assess where a SOC stands and plan its growth across people, process, and technology.

SOC Metrics Framework

The structured framework an organization uses to organize SOC metrics, what to measure, how to define them, how they roll up, so SOC performance is reported coherently rather than ad hoc.

SOC Metrics That Matter

The principle of choosing SOC metrics deliberately for what they actually reveal about effectiveness and decisions, avoiding vanity metrics like raw alert counts that don't tie to outcomes.

SOC Metrics from Incidents

Metrics derived from incident data, MTTD, MTTR, dwell time, severity distributions, that show how the SOC actually performed against real events rather than against synthetic measures.

SOC Operating Models

The structural models a SOC can run as, in-house, outsourced (MSSP/MDR), hybrid, follow-the-sun, virtual, each with different staffing, cost, and capability trade-offs.

SOC Reporting

An audit-and-assurance category covering the family of SOC (System and Organization Controls) reports, of which SOC 2 is best known, but also SOC 1 (financial controls) and SOC 3 (public-facing) exist.

SOC Tiering

The traditional structure that splits SOC analysts into tiers, T1 for initial triage, T2 for deeper investigation, T3 for advanced work, that organizes workflow and growth but has trade-offs in modern SOCs.

SOC-Engineering Interface

The working relationship between SOC analysts and security engineering, how detection ideas, tuning needs, and platform issues flow between them, that determines whether tooling actually serves operations.

SOC-Hunting Interface

The working relationship between routine SOC operations and threat hunting, how hunt hypotheses, findings, and new detections flow between them, that turns hunt output into operational defense.

SOC-IR Interface

The working relationship between SOC operations and incident response, how alerts become incidents, who takes ownership when, and how response feeds back into operations, that defines the handoff.

SQL Injection

A vulnerability where untrusted input changes the meaning of a database query.

SQL Injection Testing

Testing an application for SQL injection vulnerabilities by probing inputs with crafted payloads to detect whether they reach the database as code, a classic web-pentest activity.

SSH

Secure Shell: a cryptographic protocol for remote shell access and other secure connections, widely used for Linux/Unix administration and as a heavily targeted attack surface when exposed.