Terminology Index

Glossary

2953 terms

Secure Flag

A cookie attribute telling the browser to send the cookie only over HTTPS. Setting Secure on sensitive cookies (especially session cookies) prevents them from leaking over plaintext HTTP.

Secure Infrastructure Modules

Secure infrastructure modules provide reusable, reviewed defaults for cloud resources such as identity, logging, encryption, networking, backup, and observability.

Secure SDLC

Integrating security activities throughout the software development lifecycle, requirements, design, build, test, deploy, run, so security is built in rather than bolted on after release.

Secure by Default

A design principle that systems should be safe out of the box, requiring no user action to be secure. The opposite, insecure defaults, is a major source of misconfiguration and exposure.

Secure by default means shipping with safe settings turned on, dangerous features off, restrictive permissions, encryption enabled, so a user who installs and does nothing is still protected. It contrasts with insecure defaults that require expert configuration to harden. Adopted broadly across modern frameworks, OSes, and cloud services, secure-by-default thinking removes whole classes of misconfigurations and is a foundational hardening principle. Where defaults are bad, baselines and policy-as-code re-impose secure-by-default behavior.

Introduced in: System Hardening Fundamentals

Examples

An OS shipping with firewall enabled and no public services open.
A framework parameterizing queries by default to prevent SQL injection.
Cloud services shipping with encryption on rather than off.

Default Configurationsrelates_to Secure by Designrelates_to Configuration Baselinesrelates_to Hardening Guidesrelates_to Attack Surface Reductionrelates_to Configuration as Coderelates_to CSRF Tokenrelates_to Default Configurationsrelates_to Injectionrelates_to Parameterized Queriesrelates_to Secure by Designrelates_to Standard Patternsrelates_to System Hardeningrelates_to

Secure by Design

Building security into systems from the start rather than bolting it on later, integrating threat modeling, secure defaults, and protective patterns into design itself.

Security Analyst Career Path

The career trajectory a security analyst can follow, from entry roles through senior analyst, lead, and into specializations like detection engineering, IR, or threat hunting, with skills and milestones that mark each step.

Security Analyst Role

The foundational role of a security analyst, monitoring, triaging, investigating, and reporting on security events, the front line of SOC operations and a starting point for many security careers.

Security Analyst Toolbox

The everyday tools a security analyst uses, SIEM, EDR, ticketing, intelligence platforms, browser, OS utilities, that together enable triage, investigation, and reporting.

Security Architecture

The overall design of how security is realized across systems, identity, data, network, applications, monitoring, so the parts fit together coherently rather than working as disconnected controls.

Security Architecture Review

An assessment that evaluates a system's or organization's security architecture against best practice and threat scenarios, identifying gaps and recommending improvements early before they become problems.

Security Automation Patterns

Reusable approaches for automating security in the cloud, automated remediation, posture enforcement, response actions, that a cloud engineer applies to scale security with the environment.

Security Awareness

Building the knowledge, attitudes, and behaviors people need to act securely in their work. A foundational discipline because most attacks ultimately depend on human decisions and reactions.

Security Awareness Program Design

Designing an awareness program deliberately, audience analysis, learning objectives, content, channels, simulation, metrics, so it actually changes behavior rather than ticking a compliance box.

Security Capability Model

A security capability model defines required outcomes, people, process, technology, information, authority, dependencies, evidence, resilience, and improvement for a security domain.

Security Champions Program

An awareness/culture program that recruits and supports volunteers across the organization who promote security within their teams, multiplying the security function's reach.

Security Communication Strategy

How security communicates with the rest of the organization, channels, frequency, tone, audience targeting, that shapes whether security is heard, trusted, and acted on rather than ignored.

Security Context

The identity and privileges under which a process or action operates, the user or service account whose rights apply. Reading security context is foundational to interpreting operating-system events.

Security Control

A technical, administrative, physical, or organizational measure designed to modify risk or support a required security outcome, with operation and effectiveness requiring evidence.

Security Controls

Measures put in place to reduce security risks, technical, administrative, and physical, that together provide defense in depth. The fundamental building blocks of any security program.

Security Culture

The shared norms, behaviors, and attitudes around security in an organization. A foundational governance topic because culture determines whether formal security programs translate into actual behavior.

Security Culture Building

The deliberate work of growing security culture, leadership modeling, programs, recognition, communication, that turns abstract culture into observable behavior across the organization over time.

Security Culture Metrics

Measures that gauge security culture, reporting rates, near-misses, survey results, behavior changes, that turn culture from a feeling into something the organization can measure and improve.

Security Engineering

The discipline of building, deploying, and operating the security systems a SOC relies on, EDR, SIEM, identity, and detection infrastructure, so blue-team operations rest on capable, well-run platforms.

Security Event Semantics

The documented meaning, source, actors, targets, outcomes, and field interpretations of a security event.

Security Event Validation

Security event validation checks an alert or report's authenticity, relevance, source health, asset and identity context, expected activity, time, observable effect, and plausible alternatives.

Security Feedback Loops

Security feedback loops turn findings, incidents, and developer experience into earlier detection, safer shared patterns, and improved controls.

Security Framework Types

The different categories of security frameworks (control catalogs, risk frameworks, regulatory regimes, certifications) that serve different purposes and combine into how an organization manages compliance.

Security Governance

The structures and processes that direct and oversee security in an organization, leadership, policies, decisions, accountability, that align security with business objectives and risk.

Security Groups

Stateful firewalls attached to cloud resources (instances, services) that allow or deny inbound and outbound traffic by rules. A core building block of cloud network security every cloud engineer uses.

Security Header

An HTTP response or request header that influences browser or intermediary security behavior, with effectiveness dependent on correct values, coverage, protocol, and application design.

Security Incident

An event that compromises, or could compromise, the confidentiality, integrity, or availability of information or systems. The foundational category that incident response is organized around.

Security Investment

How an organization allocates resources, budget, people, attention, to security across competing priorities, a leadership decision that shapes which risks get treated and how the program grows.