Terminology Index

Glossary

2953 terms

Service Persistence

Persistence achieved by creating or modifying a service, daemon, launch configuration, or unit so attacker-controlled code executes under service-management rules.

Service Principal Name (SPN)

A service principal name is the unique Kerberos identifier that maps a service instance to the account under which the service runs.

Service Principal Persistence Hunting

Service principal persistence hunting examines application identities, credentials, owners, consent, role assignments, federation, and activity for unauthorized durable access.

Service Provider

In federation, the application or relying party that consumes identity assertions or tokens from an identity provider to establish a local session or authorization context.

Service Providers

In federated identity, the applications or services that rely on an identity provider to authenticate users. The relying side of the IdP-SP relationship that powers SSO and federation.

Service-to-Service Auth

Authentication between services in cloud-native systems, typically via mTLS or short-lived tokens, so every service-to-service call is identified and authorized rather than implicitly trusted.

Session

A time-bounded authenticated interaction between a user and an application.

Session Brokering

Session brokering lets an access service authenticate to a target and connect an approved user without disclosing the target credential directly to that user.

Session Fixation

An attack where an attacker sets or knows a victim's session identifier before they log in, then hijacks the now-authenticated session. Prevented by regenerating session IDs on login.

Session Hijacking

An attack that steals a valid session identifier, via XSS, cookie theft, sniffing, or other means, and uses it to impersonate the authenticated user, bypassing the need for credentials.

Session ID

The unique identifier that ties HTTP requests to a server-side session, usually carried in a cookie. Its secrecy is the basis of session security, so it must be hardened against theft and prediction.

Session Lifecycle Testing

Session lifecycle testing verifies issuance, rotation, renewal, expiry, logout, revocation, concurrent use, privilege changes, recovery effects, and cookie protections for assigned sessions.

Session Recording

Capturing privileged sessions, often video or keystrokes, so administrative activity is reviewable and accountable. A core PAM capability framed across IAM and PAM contexts.

Session Recording Architecture

The system design for capturing, storing, and retrieving privileged session recordings at scale, balancing fidelity, performance, storage, retention, and review needs.

Session Replay

An attack that reuses a captured authentication or session artifact (token, request) to act as a legitimate user. Defenses include short token lifetimes, anti-replay nonces, and binding to context.

Session Revocation Limits

Session revocation limits are the conditions under which disabling an identity or invalidating refresh tokens does not immediately terminate every existing access token or application-issued session.

Session Risk Re-evaluation

Session risk re-evaluation changes or terminates an active access path when relevant identity, device, workload, policy, threat, privilege, resource, or incident conditions change.

Session Timeout

A policy that expires or reauthenticates a session after inactivity, absolute lifetime, risk change, or another trigger, without assuming expiry revokes every downstream token automatically.

Session and Data Handling Review

Session and data handling review verifies token and cookie creation, rotation, scope, invalidation, storage, caching, transport, error exposure, logs, exports, retention, and redaction.

Sessions

Server-side state that tracks a user's interactions after they log in, keeping them authenticated across requests. Sessions and their identifiers are central web-defense surfaces to harden.

Severity Classification

Categorizing incidents by severity (critical, high, medium, low) using defined criteria, so response, escalation, and reporting follow consistent rules rather than ad-hoc judgment.

Severity Rationale

Severity rationale explains a finding's exploit prerequisites, reachable assets and identities, data sensitivity, confidentiality, integrity, availability and safety effects, scale, controls, and uncertainty.

Shadow IT

Technology used inside an organization without IT or security's knowledge or approval, SaaS apps, devices, scripts, that creates blind spots and exposure since governance can't apply to what isn't visible.

Shared Control Dependency

A shared control dependency combines a provider capability with customer enablement, configuration, use, monitoring, evidence, and recovery needed to achieve an outcome.

Shared Controls

Controls implemented once for multiple systems, services, teams, or requirements, with defined provider, consumers, scope, inherited responsibilities, and evidence.

Shared Responsibility Matrix

A shared responsibility matrix records control outcomes, exact services, provider and customer activities, shared dependencies, evidence, ownership, exceptions, and failure paths.

Shared Responsibility for Compliance

How compliance responsibilities split between cloud provider and customer, both share parts of meeting frameworks, requiring customers to understand what's inherited and what they must do themselves.

Shared Responsibility for Incident Response

Shared responsibility for incident response divides investigative and response capabilities between the cloud provider and the customer according to the service and contract.

Sharing Considerations

The judgments that go into sharing threat intelligence, what to share, with whom, how to handle sensitivity, TLP, and legal constraints, so sharing improves defense without causing harm.

Sharing threat intelligence with peers, ISACs, or government partners has real value but carries considerations: what indicators are safe to share, whether sources need protection, what traffic-light-protocol (TLP) marking applies, what legal or contractual rules govern, and how to avoid disclosing victims or sensitive context. Thoughtful sharing improves community defense; careless sharing harms it. As a threat-intelligence-for-SOC topic, this is the practical discipline behind productive participation in sharing communities.

Introduced in: Threat Intelligence for SOC Analysts

Examples

Marking shared intelligence with appropriate TLP levels.
Choosing which indicators are safe to share without exposing sources.
Checking legal and contractual rules before sharing externally.

Industry Sharingrelates_to Government Intelligencerelates_to Open Source Intelligencerelates_to Intelligence Reportsrelates_to STIX and TAXIIrelates_to TI Communityrelates_to TLP (Traffic Light Protocol)relates_to Security Training Programrelates_to

Sharing Frameworks

Protocols, formats, markings, trust communities, and agreements that govern how cyber-threat information is structured, exchanged, attributed, and redistributed.

Shell

A program that interprets commands and runs them on the operating system, like bash on Linux or PowerShell on Windows. Defenders read shell activity constantly to investigate and detect attacks.

Shell Startup File

A user or system file interpreted when a shell starts or a session begins, such as a profile or rc file, and therefore a possible configuration or persistence point.