Terminology Index

Glossary

2953 terms

Shift Coverage

Shift coverage defines staffed periods, on-call responsibility, overlap, handover, queue ownership, backup, fatigue controls, and surge support for security operations.

Shift Pattern Design

Shift pattern design selects and validates work periods, rotation, overlap, recovery, on-call, and backup arrangements against demand and worker health.

Short-Term Containment

Immediate actions taken to stop an active incident from spreading or worsening, isolating hosts, blocking IPs, disabling accounts, while longer-term containment and eradication are planned.

Side Channel

Information leaked through implementation behavior-such as timing, cache use, power, faults, sound, or memory access - that can reveal secrets outside the intended interface.

Side Channels

Indirect ways to extract information from a system, timing, power, electromagnetic emissions, cache behavior, that can leak secrets even when the cryptography itself is sound.

Side Projects

Personal or extracurricular projects an analyst pursues, lab work, write-ups, contributions, that build skills and credibility beyond what day-to-day SOC work alone provides.

Sigma Rules

An open, vendor-neutral format for writing detection rules in YAML, that can be converted to many SIEM and EDR query languages. Sigma enables community sharing of portable detections.

Sigma is an open standard for detection rules: written in YAML in a vendor-neutral way, then converted to specific platform query languages (KQL, SPL, EQL, and more). Sigma rules let the community share detections that work across SIEM and EDR products, accelerating coverage and collaboration. As a logging-monitoring-telemetry topic, Sigma is widely used in detection engineering, supports detection-as-code workflows, and benefits from active open-source contribution.

Introduced in: Logging, Monitoring, and Telemetry

Examples

Writing a Sigma rule in YAML and converting it to KQL for one platform.
Adopting a community Sigma rule and tailoring it to local data.
Contributing a new Sigma rule to a community repository.

Open Source Contributionrelates_to Kusto Query Languagerelates_to Detection engineeringrelates_to Rule Logic Designrelates_to Open Source Contributionrelates_to Splunk SPLrelates_to Yara Rulesrelates_to Hypothesis-Driven Huntingrelates_to

Signature Verification

The process of checking a digital signature against the exact message, algorithm parameters, public key, and identity or trust policy before relying on it.

Signature-Based Detection

Detection that matches known indicators or patterns, hashes, strings, byte sequences, against observed data. Fast and precise for known threats, but unable to detect novel attacks on its own.

Silo Model Architecture

A multi-tenant cloud architecture where each customer gets dedicated infrastructure, providing stronger isolation than pooled models at the cost of efficiency and scale.

Silver Ticket Attack

A Silver Ticket attack forges a Kerberos service ticket with key material from the account that runs a particular service.

Simulated Network Services

Simulated network services provide controlled DNS, HTTP, TLS, mail, or raw-protocol responses inside an isolated analysis network so behavior can be observed without contacting real infrastructure.

Simulation Template Design

The controlled design of a security simulation's scenario, audience, variables, safeguards, measurements, feedback, and ethical boundaries.

Single Point of Failure

A component whose failure brings down a system or process, a fragility every resilient design tries to eliminate through redundancy, redundancy of components, paths, sites, or vendors.

Single Sign-On

A sign-in model where one identity provider grants access to multiple applications.

Situational Awareness

Situational awareness is a current, time-bounded view of incident facts, uncertainty, impact, actions, dependencies, and pending decisions.

Skeleton Key Malware

Skeleton Key malware modifies domain-controller authentication processing so an attacker-controlled master password can authenticate as multiple users while their real passwords continue to work.

SoD Enforcement Approaches

The mechanisms used to enforce segregation of duties in IGA, preventive blocking at provisioning, detective alerting in reviews, compensating controls, applied per situation to keep SoD real.

SoD Exception Governance

Segregation-of-duties exception governance authorizes a narrowly defined conflict only with independent approval, scope, duration, compensating controls, monitoring, evidence, expiry, and removal.

Social Engineering

Manipulating people into revealing information, granting access, or making unsafe decisions.

Social Login Conversion Impact

The effect of social login (sign-in with Google, Apple, Facebook, etc.) on user signup and conversion rates in customer identity, often improving conversion but with security and privacy trade-offs.

Social Login Federation

Social login federation uses an external OpenID Provider to authenticate a user while the local relying party retains responsibility for linking, authorization, profile, consent, fraud, session, recovery, and closure.

Social Login Fundamentals

The foundational concepts behind social login, OAuth/OIDC flows, redirect handling, attribute mapping, account linking, that explain how 'sign in with X' actually works under the hood.

Social Login Security

Securing social-login flows in CIAM, validating tokens, protecting redirects, account linking pitfalls, IdP trust assumptions, so the convenience doesn't introduce account-takeover paths.

Soft Skills

Non-technical skills like communication, collaboration, empathy, and time management that are essential to security-analyst effectiveness alongside technical knowledge.

Software Bill of Materials

A formal inventory of components in a piece of software, libraries, versions, licenses, sources, that supports vulnerability management, supply-chain security, and incident response.

Software Composition Analysis

Software composition analysis inventories third-party and transitive components and relates their resolved versions to advisories, licenses, and other supply-chain information.

Source Bias

The systematic skew that comes from any intelligence source, vendor incentives, geographic focus, sectoral perspective, that consumers must account for so analysis reflects reality rather than the source's lens.

Source Evaluation

Evaluating the reliability, recency, scope, and bias of intelligence sources so analysis weights information appropriately and consumers can judge confidence in conclusions.

Spearphishing

A targeted phishing attack tailored to a specific individual or small group using research about them, far more convincing and dangerous than generic phishing.

Specific Audit Types

The various categories of audit a GRC analyst encounters, internal, external, regulatory, financial, operational, that differ in purpose, scope, and methodology, so the analyst applies the right approach to each.

Specific Frameworks for Assessment

The named frameworks audit and assessment work uses as criteria, COBIT, COSO, ISO 19011, ISACA's IT audit standards, each suited to particular assessment focuses.