Glossary

Specific Tooling

The specific tools auditors and assurance professionals use, GRC platforms, audit workpaper systems, data-analytics tools, that support evidence collection, testing, and reporting at scale.

Splunk SPL

Search Processing Language, the query language used in Splunk to search, transform, and visualize event data. A widely used SIEM query language alongside KQL.

Stack Counting

A hunting and analytics technique that counts how often each value of a field occurs to surface rare items, on the premise that unusual values often indicate threats worth investigating.

Stakeholder Mapping

Identifying and characterizing the intelligence consumers a SOC serves, their roles, needs, and influence, so intelligence products fit who will actually consume them.

Stakeholder Preparation

Preparing stakeholders, business owners, leaders, control owners, for an upcoming audit, what they'll be asked, what's expected, so the audit experience runs smoothly and credibly.

Stakeholder Updates

Regular, structured updates to internal stakeholders during an incident, with the right cadence, audience, and detail, so people stay informed without drowning in noise or losing focus.

Stakeholder and Decision Mapping

Stakeholder and decision mapping identifies who recommends, supplies evidence, is consulted, approves, and is informed for each material GRC decision.

Stale Threat Model Indicators

Stale threat model indicators are mismatches between the model and current components, data, identities, dependencies, owners, controls, tests, classifications, provider assumptions, incidents, and decisions.

Standard Deviation Limits

Standard deviation limits compare an observation with the spread around a historical mean, often through a z-score.

Standard Patterns

Pre-approved, reusable architectural and configuration patterns that engineers deploy from, so cloud workloads are secure by construction without each team reinventing security from scratch.

Standards

Documents that specify how to meet policy requirements, with specific technical or procedural rules, sitting between policies (what) and procedures (how-to) in the governance hierarchy.

Standards and Procedures

The complementary pair of governance documents, standards (specific requirements) and procedures (step-by-step how-to), that translate policy into actionable rules a GRC analyst maintains together.

Standing Privilege

Privileged access that exists continuously, available all the time rather than being granted just when needed. Reducing standing privilege is a foundational identity-security goal, since it shrinks what attackers can use.

Standing Requirements

Ongoing intelligence requirements that persist over time, rather than one-off questions, defining the long-running topics the threat-intelligence program continually answers.

Startup Folder

A Windows directory whose contents automatically launch when a user logs on. A persistence location attackers abuse and defenders inspect during investigation and hardening.

State and Lifecycle Modeling

State and lifecycle modeling represents creation, pending, active, expired, consumed, revoked, suspended, deleted, retained, restored, migrated, and retired states and their permitted transitions.

Stateful Firewall

A firewall that tracks connection state when deciding whether traffic should be allowed.

Stateless Firewall

A firewall that evaluates packets using rules without tracking connection state.

Stateless Protocol

A protocol where each request is independent and the server keeps no memory of previous requests, like HTTP, which is why applications layer sessions on top to keep users logged in.

Statement of Applicability

A core ISO 27001 document listing which controls from the standard apply, which don't, and why, the bridge between risk assessment and selected controls in the ISMS.

Static Analysis Fundamentals

The basics of analyzing malware without running it, inspecting strings, imports, headers, and structure, to learn capabilities and indicators safely before deciding whether deeper dynamic analysis is warranted.

Static Secret Migration

Static secret migration removes credentials from code and configuration or, when federation is unavailable, moves them into a controlled retrieval and coordinated rotation process.

Statistical Analysis for Detection

Using statistics on SIEM data, counts, percentiles, baselines, anomalies, to write detections that catch unusual activity by behavior rather than known signatures.

Status Code

A three-digit number in an HTTP response indicating outcome, 200 OK, 401 Unauthorized, 500 Internal Server Error, that defenders read to understand application behavior and detect abuse.

Stealer Analysis

Analyzing information-stealer malware (credentials, cookies, wallets) to understand its targets, exfiltration paths, and indicators, producing intelligence and detections against a fast-growing threat family.

Stealth

An ATT&CK Enterprise tactic describing the adversary goal of concealing activity or making it appear normal so actions are less likely to be noticed.

Step-Up Decision Design

Step-up decision design requires stronger, fresher, or transaction-specific evidence for a sensitive action based on account, session, resource, and transaction risk.

Sticky Bit

A Unix permission that, on directories, restricts file deletion to the file's owner even when the directory is writable by others. Common on /tmp and similar shared directories.

Strategic Intelligence

Big-picture threat intelligence about trends, actors, and risks at the level of months and years, that informs leadership decisions and strategy rather than day-to-day operations.

Stream Cipher

A keyed symmetric primitive that combines plaintext with a pseudorandom keystream, requiring strict nonce and key-use discipline to avoid keystream reuse.

Stream Ciphers

Symmetric encryption algorithms that encrypt data one bit or byte at a time, useful for streaming use cases like real-time audio/video, contrasted with block ciphers that encrypt fixed-size chunks.