Glossary

Service Persistence

Persistence achieved by creating or modifying a service, daemon, launch configuration, or unit so attacker-controlled code executes under service-management rules.

Service Principal Name (SPN)

A service principal name is the unique Kerberos identifier that maps a service instance to the account under which the service runs.

Service Principal Persistence Hunting

Service principal persistence hunting examines application identities, credentials, owners, consent, role assignments, federation, and activity for unauthorized durable access.

Service Provider

In federation, the application or relying party that consumes identity assertions or tokens from an identity provider to establish a local session or authorization context.

Service-to-Service Auth

Authentication between services in cloud-native systems, typically via mTLS or short-lived tokens, so every service-to-service call is identified and authorized rather than implicitly trusted.

Session

A time-bounded authenticated interaction between a user and an application.

Session Brokering

Session brokering lets an access service authenticate to a target and connect an approved user without disclosing the target credential directly to that user.

Session Fixation

An attack where an attacker sets or knows a victim's session identifier before they log in, then hijacks the now-authenticated session. Prevented by regenerating session IDs on login.

Session Hijacking

An attack that steals a valid session identifier, via XSS, cookie theft, sniffing, or other means, and uses it to impersonate the authenticated user, bypassing the need for credentials.

Session ID

The unique identifier that ties HTTP requests to a server-side session, usually carried in a cookie. Its secrecy is the basis of session security, so it must be hardened against theft and prediction.

Session Lifecycle Testing

Session lifecycle testing verifies issuance, rotation, renewal, expiry, logout, revocation, concurrent use, privilege changes, recovery effects, and cookie protections for assigned sessions.

Session Recording

Capturing privileged sessions, often video or keystrokes, so administrative activity is reviewable and accountable. A core PAM capability framed across IAM and PAM contexts.

Session Recording Architecture

The system design for capturing, storing, and retrieving privileged session recordings at scale, balancing fidelity, performance, storage, retention, and review needs.

Session Replay

An attack that reuses a captured authentication or session artifact (token, request) to act as a legitimate user. Defenses include short token lifetimes, anti-replay nonces, and binding to context.

Session Revocation Limits

Session revocation limits are the conditions under which disabling an identity or invalidating refresh tokens does not immediately terminate every existing access token or application-issued session.

Session Risk Re-evaluation

Session risk re-evaluation changes or terminates an active access path when relevant identity, device, workload, policy, threat, privilege, resource, or incident conditions change.

Session Timeout

A policy that expires or reauthenticates a session after inactivity, absolute lifetime, risk change, or another trigger, without assuming expiry revokes every downstream token automatically.

Session and Data Handling Review

Session and data handling review verifies token and cookie creation, rotation, scope, invalidation, storage, caching, transport, error exposure, logs, exports, retention, and redaction.

Sessions

Server-side state that tracks a user's interactions after they log in, keeping them authenticated across requests. Sessions and their identifiers are central web-defense surfaces to harden.

Severity Classification

Categorizing incidents by severity (critical, high, medium, low) using defined criteria, so response, escalation, and reporting follow consistent rules rather than ad-hoc judgment.

Severity Rationale

Severity rationale explains a finding's exploit prerequisites, reachable assets and identities, data sensitivity, confidentiality, integrity, availability and safety effects, scale, controls, and uncertainty.

Shadow IT

Technology used inside an organization without IT or security's knowledge or approval, SaaS apps, devices, scripts, that creates blind spots and exposure since governance can't apply to what isn't visible.

Shared Control Dependency

A shared control dependency combines a provider capability with customer enablement, configuration, use, monitoring, evidence, and recovery needed to achieve an outcome.

Shared Controls

Controls implemented once for multiple systems, services, teams, or requirements, with defined provider, consumers, scope, inherited responsibilities, and evidence.

Shared Responsibility Matrix

A shared responsibility matrix records control outcomes, exact services, provider and customer activities, shared dependencies, evidence, ownership, exceptions, and failure paths.

Shared Responsibility for Compliance

How compliance responsibilities split between cloud provider and customer, both share parts of meeting frameworks, requiring customers to understand what's inherited and what they must do themselves.

Shared Responsibility for Incident Response

Shared responsibility for incident response divides investigative and response capabilities between the cloud provider and the customer according to the service and contract.

Sharing Considerations

The judgments that go into sharing threat intelligence, what to share, with whom, how to handle sensitivity, TLP, and legal constraints, so sharing improves defense without causing harm.

Sharing Frameworks

Protocols, formats, markings, trust communities, and agreements that govern how cyber-threat information is structured, exchanged, attributed, and redistributed.

Shell

A program that interprets commands and runs them on the operating system, like bash on Linux or PowerShell on Windows. Defenders read shell activity constantly to investigate and detect attacks.

Shell Startup File

A user or system file interpreted when a shell starts or a session begins, such as a profile or rc file, and therefore a possible configuration or persistence point.