The SOC Analyst
Glossary

The history of ransomware traces one extortion idea from the 1989 AIDS Trojan through stronger encryption, anonymous crypto payment, self-spreading worms, double extortion, and rentable ransomware-as-a-service.

A honey account is a decoy user account placed inside a real identity store, such as Active Directory, and monitored so that any use of it raises an alert.

A honeypot is a deliberately deployed decoy system, server, or network resource designed to lure attackers away from real production assets, expose their tactics, and generate actionable threat intelligence. Unlike perimeter controls that block threats at the gate, a honeypot lets an attacker inside a controlled, isolated trap and then watches everything they do.

A honeypot is a cybersecurity mechanism that uses a manufactured, decoy attack target to lure attackers away from legitimate systems and record how they operate.

A honeytoken is a fake credential, file, record, or token planted among real assets, with no legitimate use, that fires an alert the moment anyone accesses it.

Ransomware spreads in two phases: it gains a foothold through vectors like phishing or exposed RDP, then propagates across the network with stolen credentials and lateral movement.

A zero trust strategy is the plan to move from a perimeter-trust network to an architecture that removes implicit trust and verifies every access request per session on identity and device posture, grounded in NIST SP 800-207.

Choosing a cybersecurity vendor means scoring candidates against eight criteria (reputation, 24/7 accessibility, customer proof, pricing, incident response, warranty, scalability, and holistic coverage), with accessibility and incident response as hard gates.

A cybersecurity budget is the planned allocation of money, over a defined period, to the people, tools, services, and processes that protect an organization from cyber threats.

Hiring a cybersecurity expert means scoping the work first, then choosing whether to staff it in-house, outsource it to a provider, or blend both, and staffing the specific roles your risk requires.

Implementing zero trust in stages means moving each of the five CISA pillars (identity, devices, networks, applications, data) up a four-rung maturity ladder from Traditional to Optimal, grounded in NIST SP 800-207.

How to grow and justify an existing small business cybersecurity budget by arming yourself with current data, framing spend as business value, proving return on investment, and reporting the metrics leadership trusts.

An insider threat is the risk that someone with authorized access to a small business's systems or data, an employee, former employee, contractor, or vendor, uses that access to cause harm, deliberately or by mistake.

Spotting a phishing email means checking the sender domain, tone, links, attachments, and above all the request, then confirming with the email headers before you act.

Human intelligence (HUMINT) is threat intelligence collected from and by people, with researchers building personas and access inside criminal forums and chats to engage attackers directly and learn who they are and what they plan.

Hybrid cloud is an architecture that joins a private environment (on-premises or private cloud) to one or more public clouds, connected so data and applications can move and work across the boundary as a single system.

Hybrid cloud security is the set of tools, controls, and processes that protect data and infrastructure spread across private cloud, public cloud, and on-premises environments run as one connected system.

A hypervisor, also called a virtual machine monitor (VMM), is software that creates and runs multiple virtual machines on a single physical host, sitting between the hardware and the guest operating systems.

IaC scanning is the practice of analyzing infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests) before they are applied, to find misconfigurations, exposed secrets, overly permissive access, and policy violations in the code that defines the infrastructure.

Identity and Access Management (IAM) is the framework of policies, processes, and technology that governs digital identities and controls their access to systems, applications, and data.

An identity-based attack is a cyberattack that targets credentials and authentication (passwords, hashes, Kerberos tickets, and session tokens) to gain access to systems and data as a legitimate user.

Identity governance and administration (IGA) is the framework for managing digital identities and their access across the full lifecycle, and governing that access so it stays appropriate, least-privilege, and auditable.

Identity monitoring is the continuous analysis of authentication activity, access behavior, and privilege change to detect identity-based threats.

Identity provider (IdP) security is the practice of protecting the service that authenticates users and issues the signed tokens every connected application trusts.

Identity security, also called identity protection, is the practice of protecting accounts, credentials, and entitlements from being stolen, abused, or escalated, and detecting when they are.

Identity Security Posture Management (ISPM) is a continuous practice of assessing and hardening an organization's identity infrastructure (accounts, access rights, and authentication) to prevent identity-based breaches.

Identity segmentation restricts access to applications and resources based on the identity making the request and how it behaves, rather than the network it sits on.

Identity theft prevention is the set of strategies that make stolen personal information hard to use, from phishing-resistant authentication to monitoring and credit freezes.

Identity threat detection and response (ITDR) is the discipline that detects, investigates, and stops attacks abusing identities, credentials, and directories.

An IIS log is the access record Internet Information Services writes for a Windows web server, one line per HTTP request, capturing who connected, what they requested, and how the server answered.

An incident responder is a security professional who investigates, contains, and remediates security incidents, taking a confirmed or suspected breach and driving it to closure while preserving evidence.

Incident response is the organized process a team uses to detect, contain, and recover from a cyberattack, combining a written plan, a trained team, and a repeatable set of steps to limit the damage.

Incident response steps are the ordered phases a team runs to take a security incident from first alert to closure: preparation, identification, containment, eradication, recovery, and lessons learned.

An indicator of attack (IOA) is evidence of the intent and behavior behind an attack, the sequence of actions an adversary must take to reach their goal, observed in real time while the attack is happening.

An indicator of compromise (IOC) is a piece of forensic evidence, such as a file hash, malicious IP, callback domain, or registry change, that suggests an endpoint or network has been breached.

An Indicator of Compromise (IOC) is a piece of forensic evidence that signals a network, endpoint, or system has likely been breached. Unlike a warning that an attack *might* occur, an IOC is evidence that one *already has*  whether through malware installation, unauthorized access, credential theft, or data exfiltration.

Information security (InfoSec) is the practice of protecting information from unauthorized access, use, disclosure, modification, or destruction in order to preserve its confidentiality, integrity, and availability.

Infrastructure as a Service (IaaS) is a cloud computing model in which a third-party provider delivers virtualized compute, storage, and networking resources on demand over the internet, billed by consumption.

Infrastructure as Code is the practice of provisioning and managing infrastructure (servers, networks, and security policy) through machine-readable definition files stored in version control instead of manual configuration.

Infrastructure as Code security is the practice of finding and fixing security problems (misconfigurations, hardcoded secrets, over-privileged access, drift) in the code that defines cloud infrastructure, before that code is deployed.

Infrastructure monitoring is the continuous collection and analysis of performance and health data from IT systems (servers, VMs, containers, databases, network devices, and cloud services) to keep them healthy and to surface anomalies that can signal an attack.

An injection attack occurs when an application passes untrusted input to an interpreter (a SQL engine, a shell, an LDAP directory, or a browser) in a way that lets the input change the command or query being run.

Insider threat indicators are the behavioral and digital warning signs that a person with authorized access may be on the path to harming the organization, whether deliberately or by accident.

An insider threat is the risk that someone with authorized access to an organization uses that access, intentionally or by accident, to cause harm.

Interactive application security testing is a method that evaluates a running application from inside the process, using an instrumentation agent that observes code execution and data flow while the app is exercised, so a finding confirms the flaw is exploitable and names the source line that caused it.

IoT security is the set of controls that protect internet-connected devices, the data they handle, and the networks they sit on, from compromise and misuse.

An intrusion detection system (IDS) monitors and analyzes network or system events to find unauthorized access attempts and raises an alert when it sees one.

An indicator of attack (IOA) is a behavioral signal that an attack is happening, while an indicator of compromise (IOC) is a static artifact (hash, domain, IP) showing a compromise already occurred.

ISO compliance is adherence to the ISO/IEC standards for information security, in practice the ISO/IEC 27001 standard that specifies the requirements for an information security management system.

IT asset discovery is the process of automatically finding, identifying, and cataloging every device, application, cloud instance, and service connected to an organization's environment, then keeping that inventory current as the environment changes.