Glossary

SUID

The set-user-ID bit on Unix executables that runs the program with the owner's privileges regardless of who invoked it. SUID root binaries are a primary Linux privilege-escalation target.

SYSTEM Account

The Windows built-in account with the highest local-machine privileges, used by the OS itself and many system services. Code running as SYSTEM has total local-host authority, a major attacker objective.

SaaS

Software as a Service is a cloud model where users access an application operated by a provider over the internet.

SaaS Security Requirements

The security requirements organizations apply when adopting Software as a Service, identity integration, data protection, logging, configurations, that ensure SaaS use meets the organization's security expectations.

SaaS Tenancy Models

The architectural ways SaaS providers separate customers, single-tenant, pooled multi-tenant, hybrid, each with different security, performance, and cost trade-offs that shape what customers can expect.

Safe Response Automation

Safe response automation uses a narrow trigger, evidence threshold, authorized scope, least-privilege identity, idempotency, concurrency control, test mode, audit, verification, timeout, rollback, failure alerting, and escalation.

Safe Scanning Design

Safe scanning design defines authorization, targets, exclusions, source addresses, timing, intensity, stop conditions, contacts, and recovery arrangements before active vulnerability assessment.

Sales Security Workflow

A sales security workflow routes customer assurance requests through scoped intake, authoritative content, expert escalation, required approvals, controlled delivery, and follow-up ownership.

Salt

Random data added before hashing to make identical inputs produce different hash values.

Same-Origin Policy

A browser rule that limits how pages from one origin can interact with another origin.

SameSite Attribute

A cookie attribute that controls whether browsers send the cookie on cross-site requests. Properly set, SameSite blunts CSRF and information-leakage risks tied to cross-site cookie use.

Sample Evidence Handling

Sample evidence handling preserves the provenance, integrity, custody, transformations, access, and storage of a suspicious artifact and its derived files.

Sample Handling

The safe practices for receiving, storing, transporting, and disposing of malware samples, so analysts work without accidentally infecting hosts or letting samples escape the lab.

Scanner Evidence Validation

Scanner evidence validation determines what a check directly observed, what it inferred, and whether its method and evidence support the reported vulnerable condition.

Scanning Coverage

How completely vulnerability scanning reaches assets across the environment, authenticated, network-reachable, cloud, and mobile, so unscanned blind spots don't hide exploitable issues.

Scenario-Based Identification

An approach to risk identification that imagines specific 'what-if' scenarios, an attacker doing X, a system failing in Y way, to surface risks that abstract analysis might miss.

Scheduled Task

A Windows-managed trigger and action executed on a schedule or event under a configured identity, usable for legitimate automation or persistence.

Scheduled Task Detection

Detecting attacker use of scheduled tasks for persistence or execution by monitoring task creation and changes, often mapped to ATT&CK, a high-value detection class for Windows endpoints.

Scheduled Task Hunting

Scheduled task hunting examines task creation, modification, deletion, definition, principal, trigger, action, execution, and initiating context for unauthorized persistence or execution.

Scheduled Tasks

Windows entries that run programs at defined times or events, useful for legitimate automation and heavily abused by attackers for persistence and execution. A core mechanism defenders must understand.

Scheme

The portion of a URL that names the protocol used (http, https, ftp, etc.), the first piece that tells the browser how to fetch the resource. Foundational to reading URLs and understanding web requests.

Scope

A defined boundary stating which systems, people, data, time periods, actions, environments, or requirements are included and excluded from an activity or conclusion.

Scope Change Control

Scope change control evaluates and records how a product, system, location, vendor, data flow, acquisition, or contract changes a compliance boundary.

Scoped Suppression

Scoped suppression reduces a documented expected pattern using the narrowest practical combination of identity, source, target, artifact, command, time, approval, and workflow.

Scopes

In OAuth, named permissions an application requests on behalf of a user (like read:email or write:files). Scopes let users grant limited delegated access rather than full account permissions.

Screen Lock

An OS feature that locks the screen and requires authentication to resume after a period of inactivity, a simple but high-value hardening control that protects unattended sessions from physical or shoulder-surfing access.

Secrets Management

The discipline of storing, distributing, and rotating sensitive values (passwords, keys, tokens) safely, central to hardening every environment where applications need credentials to work.

Secrets Scanning in CI/CD

Scanning code and pipelines for accidentally committed secrets, API keys, passwords, tokens, so they are caught before reaching production and can be promptly rotated.

Secrets in Kubernetes

How sensitive credentials and tokens are stored, accessed, and protected in Kubernetes, native Secrets resources, external secret stores, and integrations, so workloads get secrets safely without leaks.

Sector-Specific Cloud

Cloud compliance frameworks and requirements tailored to specific industries, healthcare, finance, government, that build on or replace general cloud frameworks with sector-aware demands.

Secure Default

A product or service setting that starts in a risk-reducing state and requires an explicit, informed action to enable broader access or weaker protection.