The SOC Analyst
Glossary

Cloud security frameworks are structured sets of guidelines, controls, and best practices for securing the data, applications, and infrastructure you run in the cloud.

Cloud security risks come from speed, scale, and the loss of a network perimeter, making misconfiguration and identity the issues that drive most breaches.

A cloud security policy is a formal document that defines the rules, responsibilities, and standards for using and protecting an organization's cloud environments.

Cloud security posture management (CSPM) is the continuous process and tooling that finds and fixes misconfigurations and compliance drift across cloud infrastructure.

A cloud security strategy is a governing plan that aligns an organization's cloud security controls to its business risk, regulatory obligations, and operating model.

Cloud service provider abuse is the use of a cloud provider's capabilities, infrastructure, and trusted relationships to attack an organization indirectly rather than attacking that organization directly.

A cloud SIEM is a security information and event management platform delivered as a cloud-hosted software-as-a-service offering, with ingest, storage, correlation, and search run on the provider's infrastructure.

Cloud sprawl is the uncontrolled growth of cloud services, instances, and resources beyond what an organization can effectively track and manage.

Cloud threat hunting is the proactive, hypothesis-driven search for attacker activity in cloud environments that automated detection did not catch.

Cloud threat management is the end-to-end discipline of identifying, assessing, and responding to threats across cloud environments, spanning visibility, detection, intelligence, response, and posture.

Cloud vulnerabilities are weaknesses in a cloud environment (most often misconfigurations, over-permissioned identities, or insecure architecture) that let an attacker gain access, escalate privilege, or reach data they should not.

Cloud vulnerability exploitation is the act of using a weakness in a cloud environment (a misconfiguration, an exposed API, a leaked credential, or an unpatched internet-facing CVE) to gain access, run code, escalate privilege, or reach data.

Cloud workload protection (CWP) is the practice of continuously securing cloud workloads (VMs, containers, Kubernetes pods, and serverless functions) against threats while they run.

A Cloud Workload Protection Platform is a security product that protects server workloads (VMs, containers, and serverless functions) at runtime wherever they run.

CWPP is the runtime workload-protection pillar that sits inside a CNAPP, alongside CSPM for posture and CIEM for identities, so the two are not really alternatives.

Code security is the practice of finding and preventing vulnerabilities in an application's source code and its dependencies, before and during development.

Code-to-cloud security is a unified approach to securing software across its full lifecycle, from source code through the build pipeline to running cloud workloads, with traceability that links a runtime risk back to the code and owner that caused it.

Command and control (C2) is the set of techniques an attacker uses to communicate with compromised systems in order to control them.

A CVE is a unique, public identifier for one specific, known security vulnerability or exposure, consisting of an ID, a short description, and references.

The Common Vulnerability Scoring System (CVSS) is an open framework maintained by FIRST for rating the severity of a software vulnerability on a 0.0 to 10.0 scale.

A compromise assessment is a point-in-time, evidence-driven investigation of an environment for signs that an unauthorized actor has accessed, persisted in, or moved through it.

A computer worm is standalone malware that self-replicates and spreads from host to host on its own, without attaching to a host file and often without any user action after the initial infection.

Conditional access is the policy-driven identity gate that evaluates signals at sign-in and decides whether to grant, block, or step up access.

Container-as-a-Service is a cloud service model that provides a managed environment for deploying, scaling, and running containerized applications without operating the underlying servers or orchestration software yourself.

Containerization is operating-system-level virtualization that packages an application with its dependencies into a portable image run as an isolated process on a shared host kernel.

Container lifecycle management is the practice of governing a container through every stage of its existence, from creation and build through deployment, orchestration, monitoring, and maintenance, to retirement.

Container scanning is the process of analyzing the components inside containers (the image, file system, and configuration) to uncover vulnerabilities, misconfigurations, exposed secrets, and policy violations before and after deployment.

Container security is the set of controls that protect containerized workloads across their lifecycle, from the image you build through the registry, runtime, and orchestrator.

Container security best practices are the controls a team applies across build, ship, run, and the orchestrator to protect containerized workloads at every stage they can be attacked.

CAEP is an OpenID Foundation Shared Signals Framework profile that defines security event types so an identity provider can push access changes (such as session revocation) to relying parties in near real time.

Continuous monitoring is the ongoing collection and analysis of security data so threats, misconfigurations, and policy violations are detected in near real time rather than at scheduled intervals.

Continuous Threat Exposure Management (CTEM) is Gartner's five-stage program for continuously assessing, prioritizing, validating, and reducing an organization's exposure to attack.

The control plane is the management and API layer that provisions, configures, and orchestrates cloud or cluster resources, as opposed to the data plane where workloads run.

Cookie logging is the theft and capture of session cookies so an attacker can replay them to hijack an already authenticated session and bypass MFA.

Counter adversary operations (CAO) is a security model that fuses threat intelligence and threat hunting into a single, continuous, adversary-focused loop, so intelligence about an actor immediately drives a hunt for that actor in your environment.

Credential dumping is the technique of extracting account credentials (usually password hashes, Kerberos tickets, or plaintext passwords) from the places an operating system stores them.

Credential harvesting is the large-scale collection of authentication data (usernames, passwords, hashes, session tokens, and API keys) so an attacker can authenticate as someone they are not.

Credential stuffing is an automated cyberattack in which threat actors inject stolen username and password pairs into login forms across multiple websites and applications to gain unauthorized access to user accounts. Because many users reuse the same credentials across different platforms, a single data breach can give attackers a working key to dozens of unrelated services.

Credential theft is the act of stealing authentication data (usernames, passwords, hashes, tokens, and keys) so an attacker can access an account or system as the legitimate owner.

Cross-site scripting (XSS) is an injection attack in which a web application delivers attacker-supplied script to another user's browser, where it runs with the privileges of the trusted site.

CRUD is the acronym for Create, Read, Update, and Delete, the four operations that manage persistent data in relational and NoSQL databases.

CRUD is the set of four database operations (Create, Read, Update, Delete), while REST is an architectural style for web APIs over HTTP that commonly exposes those operations through HTTP methods; CRUD is the data layer and REST is the network layer.

Cryptojacking is the unauthorized use of someone else's computing resources (CPU, GPU, or cloud compute) to mine cryptocurrency without consent.

Crypto-malware is malicious software that hijacks a victim's computing resources, CPU, GPU, or cloud compute, to mine cryptocurrency without consent, an activity known as cryptojacking.

CWPP secures running cloud workloads at runtime while CSPM continuously assesses cloud configuration in the control plane for misconfigurations and compliance drift.

CAASM is a way to build one complete, current inventory of all cyber assets by aggregating data from existing tools through their APIs, then querying it for security control gaps.

An attacker scans the internet for a specific model of VPN appliance running a version with a known flaw. They find a few thousand. One belongs to a mid-sized company that has not patched.

Cyberattacks on small businesses are intrusions (phishing, ransomware, credential theft, and fraud) that target smaller organizations because their defenses, budget, and staffing are thinner than those of large enterprises.

Big game hunting is a type of cyberattack, usually delivered through ransomware, that targets large, high-value organizations chosen for their ability to pay a large ransom.

Cyber espionage is the covert theft of secrets, intellectual property, and intelligence from a target, usually by a nation-state or a group working on a government's behalf.