✳ 94 terms / The plain-English glossary

Less jargon.
More understanding.

Every definition comes with a concrete example. Search a term you’ve heard, or test yourself with a few flashcards.

Find a term or acronym

94 terms

Account recovery

The process that restores access when authenticators are lost, which can become the weakest authenticator.

See it in practice

A chat-based photo reset can undo a passkey rollout if help desk treats it as a formality.

Connect the ideas: identity-authn-authz · data-protection-and-resilience

Alert

A notification that a rule or model wants a human to look at one or more records.

See it in practice

Impossible travel is an alert title; it is not the name of the incident.

Connect the ideas: logs-alerts-evidence · identity-alert-triage

Attack surface management

ASM

Discovery of internet-facing assets and services an organization may not have inventoried.

See it in practice

ASM is how Riverstone might notice a forgotten staging TrackPort still serving TLS on the internet.

Connect the ideas: vulnerability-prioritization · networks-dns-http-tls

Asset

Anything whose disclosure, alteration, destruction, or downtime would harm a person or organization.

See it in practice

Riverstone treats YardOS pallet records as an asset because a wrong location can hide theft.

Connect the ideas: assets-and-cia · data-protection-and-resilience

Attestation

A signed statement about a device, workload, or control state that another system can verify.

See it in practice

A device attestation that FleetLink is running on a managed phone can inform authorization without being authorization by itself.

Connect the ideas: identity-authn-authz · least-privilege-and-layers

Audit trail

An append-oriented history of security-relevant actions that can be shown to a later reviewer.

See it in practice

Priya’s approval to disable jordan.h should live in an audit trail, not only in a disappearing chat.

Connect the ideas: logs-alerts-evidence · investigate-respond-verify

Authentication

The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.

See it in practice

A password plus an MFA push that succeeds means the account proved itself, not that the assigned driver was present.

Connect the ideas: identity-authn-authz · identity-alert-triage

Authorization

The decision about which actions an authenticated identity may perform on which objects.

See it in practice

Even after MFA, jordan.h should be denied an address export for a trailer assigned to someone else.

Connect the ideas: identity-authn-authz · least-privilege-and-layers

Availability

The property that authorized people can use a system or record when they need it.

See it in practice

Ransomware encrypting YardOS before the morning load is an availability failure.

Connect the ideas: assets-and-cia · data-protection-and-resilience

Backup

A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.

See it in practice

Nightly files on a share the YardOS account can encrypt are not a trustworthy backup until proven isolated.

Connect the ideas: data-protection-and-resilience · investigate-respond-verify

Blast radius

How much additional loss a failure or a response action can cause beyond the original asset.

See it in practice

Deleting every FleetLink mailbox because one API timed out is a self-inflicted blast radius.

Connect the ideas: least-privilege-and-layers · investigate-respond-verify

Cloud access security broker

CASB

A control point for observing or constraining use of cloud services, including unsanctioned ones.

See it in practice

CASB might have shown the contractor forwarding a TrackPort export to a personal inbox.

Connect the ideas: data-protection-and-resilience · frameworks-and-categories

Confidentiality, Integrity, Availability

CIA triad

A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.

See it in practice

Maya writes CIA in the incident note so a later product discussion still names the failed property.

Connect the ideas: assets-and-cia · frameworks-and-categories

Cloud-native application protection platform

CNAPP

A bundled category covering cloud posture, workload, and related application-risk features; boundaries vary by vendor.

See it in practice

A CNAPP purchase does not automatically include TrackPort’s in-app authorization tests.

Connect the ideas: frameworks-and-categories · vulnerability-prioritization

Compensating control

An alternative control used for a limited time when the preferred control cannot yet be applied, with an owner and expiry.

See it in practice

A geofence on VPN logins can compensate for a delayed patch, but only with a named owner and a review date.

Connect the ideas: vulnerability-prioritization · least-privilege-and-layers

Confidentiality

The property that information is available only to people or systems authorized to see it.

See it in practice

A contractor emailing TrackPort addresses to a personal inbox is a confidentiality failure.

Connect the ideas: assets-and-cia · identity-authn-authz

Control

A process, configuration, or technology meant to reduce a named risk or detect a named failure.

See it in practice

Phishing-resistant MFA is a control for TrackPort account takeover, not a general luck charm.

Connect the ideas: least-privilege-and-layers · frameworks-and-categories

Coverage

An explicit statement of which sources, time windows, and rows were actually collected, including truncation.

See it in practice

“EDR not connected” is a coverage statement that belongs on CASE-8821, not a silent gap.

Connect the ideas: logs-alerts-evidence · agentic-soc-and-iris

Cloud security posture management

CSPM

Checks of cloud configuration against policy, such as public storage or open security groups.

See it in practice

Review backup-bucket delete and retention-bypass permissions alongside retention locks; a delete permission alone does not prove a protected object can be erased.

Connect the ideas: data-protection-and-resilience · frameworks-and-categories

Continuous threat exposure management

CTEM

A program for repeatedly finding, prioritizing, and reducing exposed attack surface rather than running a yearly scan.

See it in practice

CTEM would keep the VPN appliance in an owned queue instead of a quarterly PDF.

Connect the ideas: vulnerability-prioritization · frameworks-and-categories

Common Vulnerabilities and Exposures

CVE

A public identifier for a specific disclosed vulnerability record.

See it in practice

The VPN finding should be tracked by CVE identifier so KEV membership can be checked without relying on a scanner nickname.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Common Vulnerability Scoring System

CVSS

FIRST’s method for describing characteristics and technical severity of a vulnerability, not a full remediation order.

See it in practice

Two CVSS-critical findings can still be queued differently once exposure and KEV are considered.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Dynamic application security testing

DAST

Testing a running application from the outside to find exploitable behavior.

See it in practice

DAST against TrackPort staging can show whether the parser proof-of-concept actually works.

Connect the ideas: vulnerability-prioritization · networks-dns-http-tls

Data classification

Labeling records by the harm of disclosure, alteration, or loss so protection and retention can follow.

See it in practice

Customer addresses are confidential; public tracking FAQs are not in the same class.

Connect the ideas: assets-and-cia · data-protection-and-resilience

Defense in depth

Layering independent controls so that one failure does not become a complete compromise.

See it in practice

MFA plus scoped tokens plus a contractor VLAN still matter if any one of them is mis-set.

Connect the ideas: least-privilege-and-layers · frameworks-and-categories

Data loss prevention

DLP

Controls that detect or block sensitive data leaving a channel such as email, web, or endpoint.

See it in practice

DLP on email could have blocked the address export, but only if TrackPort fields were classified.

Connect the ideas: assets-and-cia · data-protection-and-resilience

Domain Name System

DNS

The lookup system that maps a name people type to an address a computer can contact.

See it in practice

If DNS for track.riverstone.example points at an unexpected IP, the customer may never reach Riverstone.

Connect the ideas: networks-dns-http-tls

Endpoint detection and response

EDR

Telemetry and response capability on laptops and servers for process, file, and similar host activity.

See it in practice

EDR showing no FleetLink process contradicts a FleetLink user-agent and becomes useful tension in the case.

Connect the ideas: identity-alert-triage · investigate-respond-verify

Encryption

Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.

See it in practice

TLS encrypts the TrackPort session; it does not encrypt backups if those copies are stored in cleartext elsewhere.

Connect the ideas: networks-dns-http-tls · data-protection-and-resilience

Exploit Prediction Scoring System

EPSS

FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.

See it in practice

A low EPSS on the wiki plugin is a forecast, not a promise it will never be used against Riverstone.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Evidence

A record you are willing to cite in a decision, with enough provenance to explain what it can prove.

See it in practice

A raw TrackPort export log with collection time is evidence; a Slack rumor is not.

Connect the ideas: logs-alerts-evidence · investigate-respond-verify

Exploit

A method or code that uses a vulnerability to cause an unauthorized effect.

See it in practice

A public proof-of-concept against TrackPort’s document parser is an exploit path, not yet proof of local use.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Exposure

Whether and how a vulnerability or service can actually be reached in this environment.

See it in practice

An internal wiki plugin has less exposure than an internet-facing VPN even with a similar CVSS.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

False positive

An alert that did not represent the harmful event the detector was meant to catch.

See it in practice

A VPN egress that looks like impossible travel can be a false positive for “stolen account” and still worth a look.

Connect the ideas: logs-alerts-evidence · identity-alert-triage

Federation

Trusting authentication assertions from an external identity provider instead of storing every password locally.

See it in practice

FleetLink federates to Riverstone’s identity provider, so TrackPort should not keep a second password for Jordan.

Connect the ideas: identity-authn-authz · least-privilege-and-layers

Governance, risk, and compliance

GRC

The organizational functions that set policy, track risk, and collect assurance evidence. Not a product that grants safety.

See it in practice

GRC can own the exception record when the VPN patch waits for a maintenance window.

Connect the ideas: frameworks-and-categories · vulnerability-prioritization

Hashing

A one-way fingerprint of data used to detect change or store verifiers, not a reversible way to hide records you must later read.

See it in practice

Hashing bills of lading can detect tampering; it cannot restore the document after ransomware.

Connect the ideas: assets-and-cia · data-protection-and-resilience

Hypertext Transfer Protocol

HTTP

The application protocol that names methods, paths, headers, and bodies for web requests.

See it in practice

GET /exports/addresses with a session cookie is an HTTP request whose meaning TrackPort must authorize.

Connect the ideas: networks-dns-http-tls · identity-authn-authz

Identity and access management

IAM

The capability for creating identities, authenticating them, authorizing actions, and managing their lifecycle.

See it in practice

IAM is how Riverstone should issue contractor accounts with an expiry instead of sharing a clipboard password.

Connect the ideas: identity-authn-authz · frameworks-and-categories

Idempotency

The property that repeating the same operation has the same intended effect on state as performing it once; separate audit records may still be created.

See it in practice

Disable-account should be idempotent; retrying a transfer of funds or a unique firewall rule may not be.

Connect the ideas: investigate-respond-verify · agentic-soc-and-iris

Identity

The record an organization uses for a person, device, or workload that can be authenticated.

See it in practice

jordan.h is an identity record; it is not automatically the human Jordan Hale.

Connect the ideas: identity-authn-authz · identity-alert-triage

Identity governance and administration

IGA

Processes and tools for reviewing who should have which access and removing what is no longer justified.

See it in practice

An IGA review should have caught jordan.h still sitting in Warehouse-Admins after the Friday job ended.

Connect the ideas: least-privilege-and-layers · frameworks-and-categories

Impact

How badly people or the business are hurt if the loss actually happens.

See it in practice

Taking the driver VPN down stalls FleetLink assignments and the Oakland dock wave.

Connect the ideas: assets-and-cia · threat-vulnerability-risk

Incident

An event or set of events that actually or potentially causes a security loss requiring coordinated handling.

See it in practice

The unassigned address export is an incident even if Jordan later proves the travel was real.

Connect the ideas: logs-alerts-evidence · investigate-respond-verify

Indicator of compromise

An observable such as an address, hash, or account pattern that may indicate a compromise, with limited shelf life.

See it in practice

203.0.113.40 is an IOC candidate for this case, not a permanent blocklist of a whole country.

Connect the ideas: identity-alert-triage · investigate-respond-verify

Integrity

The property that data and processes remain complete and unaltered except by authorized action.

See it in practice

A dock scanner marking a full pallet empty attacks integrity so the goods can be stolen.

Connect the ideas: assets-and-cia · data-protection-and-resilience

Internet Protocol address

IP address

A numeric locator used to deliver packets to a host on a network.

See it in practice

203.0.113.40 in the 02:14 log is an address, not proof of which human held the phone.

Connect the ideas: networks-dns-http-tls · identity-alert-triage

Known Exploited Vulnerabilities

KEV

CISA’s catalog of vulnerabilities with evidence of exploitation in the wild.

See it in practice

The VPN’s KEV listing is observed evidence from somewhere; it is not a Riverstone incident by itself.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Least privilege

Granting each identity only the actions, objects, and time window required for the current job.

See it in practice

Contractor access to dock 3 on Friday is least privilege; Warehouse-Admins is not.

Connect the ideas: least-privilege-and-layers · investigate-respond-verify

Likelihood

How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.

See it in practice

Internet exposure plus a KEV listing raises likelihood for the VPN relative to an internal wiki plugin.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Log

A record emitted by a system that something happened, which may later be used as evidence.

See it in practice

The identity-provider line at 02:14 is a log, not a conclusion about Jordan’s intent.

Connect the ideas: logs-alerts-evidence · identity-alert-triage

Managed detection and response

MDR

A service that combines tooling with people who triage and investigate on a customer’s behalf.

See it in practice

MDR can watch Riverstone overnight, but Riverstone still owns authorization for destructive actions.

Connect the ideas: frameworks-and-categories · agentic-soc-and-iris

Mean time to detect

An operational metric for how long events of a type remain unnoticed; it is only as honest as the clock and the catalog of events.

See it in practice

If export logs are delayed 40 minutes, MTTD for export abuse cannot be five minutes no matter the alert banner.

Connect the ideas: logs-alerts-evidence · identity-alert-triage

Multifactor authentication

MFA

Authentication that requires more than one factor, such as something you know plus something you have.

See it in practice

Riverstone’s phone prompt is MFA, and a two-second approval can still be social engineering.

Connect the ideas: identity-authn-authz · identity-alert-triage

Network detection and response

NDR

Detection and investigation based on network traffic or metadata rather than host agents alone.

See it in practice

NDR might show a large HTTPS POST to an unknown address even if the laptop’s EDR agent was tampered with.

Connect the ideas: networks-dns-http-tls · frameworks-and-categories

Non-repudiation

The ability to show that a particular identity performed an action, with records that are hard to credibly deny.

See it in practice

A shared warehouse login destroys non-repudiation because the log cannot name a person.

Connect the ideas: identity-authn-authz · logs-alerts-evidence

Privileged access management

PAM

Controls that broker, record, and constrain powerful administrative identities and sessions.

See it in practice

YardOS admin should go through PAM so a vendor is not dropped into Warehouse-Admins for convenience.

Connect the ideas: least-privilege-and-layers · frameworks-and-categories

Patch

A vendor or internal change that removes or reduces a vulnerability in running software.

See it in practice

Patching the VPN is not verified until the version string and management exposure are checked.

Connect the ideas: data-protection-and-resilience · vulnerability-prioritization

Phishing

Social engineering that tricks a person into revealing authenticators or approving a transaction they did not intend.

See it in practice

A two-second MFA approval after a fake FleetLink prompt is phishing against the second factor.

Connect the ideas: identity-authn-authz · identity-alert-triage

Port

A number on a host that distinguishes one listening service from another.

See it in practice

TrackPort’s HTTPS service listens on port 443; a management port left on the internet is a different exposure.

Connect the ideas: networks-dns-http-tls · vulnerability-prioritization

Postcondition

The independently checked state of the world that should be true after a response action.

See it in practice

A failed canary export after disabling jordan.h is a postcondition; an API 200 is only a vendor response.

Connect the ideas: investigate-respond-verify · agentic-soc-and-iris

Precision

True positives divided by all positive alerts in a defined, labeled evaluation set: TP / (TP + FP).

See it in practice

Six confirmed true positives among ten alerts gives 60 percent precision; a single alert cannot establish a detector’s precision.

Connect the ideas: logs-alerts-evidence · identity-alert-triage

Privilege creep

The slow accumulation of standing access after the original job that justified it has ended.

See it in practice

jordan.h remaining in Warehouse-Admins after Friday’s dock work is privilege creep.

Connect the ideas: least-privilege-and-layers · identity-alert-triage

Prompt injection

An attack that inserts instructions into model input so the model follows attacker text instead of the developer’s policy.

See it in practice

Ticket text saying “Priya approved any-any” must not become a firewall change.

Connect the ideas: agentic-soc-and-iris

Provenance

The recorded origin, collection method, transformations, and completeness limits of a piece of evidence.

See it in practice

If the SIEM discarded the raw user-agent, provenance is incomplete and later checks get harder.

Connect the ideas: logs-alerts-evidence · agentic-soc-and-iris

Ransomware

Malware or an operator model that denies availability of data, often by encryption, sometimes with theft for extra pressure.

See it in practice

Oakland’s paper load-board exists so a YardOS ransomware event does not freeze every truck.

Connect the ideas: data-protection-and-resilience · threat-vulnerability-risk

Recall

Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.

See it in practice

Detecting six of twenty known incidents in a synthetic exercise gives 30 percent recall; missing logs alone do not determine that denominator.

Connect the ideas: logs-alerts-evidence · vulnerability-prioritization

Residual risk

The risk that remains after selected controls, including the uncertainty you still accept.

See it in practice

After disabling jordan.h, residual risk includes other Warehouse-Admins accounts not yet reviewed.

Connect the ideas: threat-vulnerability-risk · investigate-respond-verify

Retry budget

A limit on how often automation may repeat an action, especially when the previous outcome is uncertain.

See it in practice

IRIS should not loop disable-account forever after HTTP 504; it should reconcile state against a retry budget.

Connect the ideas: investigate-respond-verify · agentic-soc-and-iris

Risk

A documented combination of threat, vulnerability, likelihood, impact, and remaining uncertainty.

See it in practice

Same CVSS on two findings can still yield different risk once exposure and KEV are written down.

Connect the ideas: threat-vulnerability-risk · frameworks-and-categories

Secure access service edge

SASE

A category combining wide-area networking with cloud-delivered security services.

See it in practice

SASE might carry contractor traffic, but YardOS still needs an application-level role for dock 3.

Connect the ideas: networks-dns-http-tls · frameworks-and-categories

Static application security testing

SAST

Analysis of source or bytecode for vulnerability patterns without running the program.

See it in practice

SAST might flag string concatenation in YardOS SQL, which is a different issue than the VPN KEV.

Connect the ideas: vulnerability-prioritization · frameworks-and-categories

Software bill of materials

SBOM

A list of components in a software artifact used to see whether a newly disclosed vulnerability is present.

See it in practice

An SBOM for TrackPort would tell Devon whether the parser library is in production before the scanner does.

Connect the ideas: vulnerability-prioritization · frameworks-and-categories

Software composition analysis

SCA

Inspection of dependencies and libraries for known vulnerabilities and license issues.

See it in practice

SCA is how the medium-CVSS parser library showed up in the Friday backlog.

Connect the ideas: vulnerability-prioritization · frameworks-and-categories

Secrets management

Storing, rotating, and auditing passwords, keys, and tokens so they are not copied into chat or source.

See it in practice

The YardOS service account password on a clipboard is a secrets-management failure as well as an identity failure.

Connect the ideas: identity-authn-authz · least-privilege-and-layers

Secure defaults

Shipping or configuring a system so new identities and paths start with no standing access.

See it in practice

A newly created TrackPort role should see zero shipments until a customer scope is added.

Connect the ideas: least-privilege-and-layers · data-protection-and-resilience

Session

State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.

See it in practice

Revoking jordan.h sessions is containment that does not require deleting the identity record.

Connect the ideas: identity-authn-authz · investigate-respond-verify

Shared responsibility

The split of security duties between a cloud or SaaS provider and the customer, which varies by service.

See it in practice

The identity provider hosts MFA; Riverstone still decides who is in Warehouse-Admins.

Connect the ideas: identity-authn-authz · data-protection-and-resilience

Security information and event management

SIEM

A capability that collects, parses, stores, and searches security telemetry and often fires alerts.

See it in practice

Riverstone’s SIEM joining identity and TrackPort logs is how Maya sees the 02:16 export beside the login.

Connect the ideas: logs-alerts-evidence · frameworks-and-categories

Security orchestration, automation, and response

SOAR

Tooling that runs playbooks across security systems, which still needs scoped authority and verification.

See it in practice

A SOAR play that disables accounts must not treat a model summary as the approval record.

Connect the ideas: frameworks-and-categories · agentic-soc-and-iris

Security operations center

SOC

The people and process that detect, investigate, and respond to security events. Distinct from System and Organization Controls reporting.

See it in practice

Riverstone’s SOC is Maya’s on-call function, not an audit report named SOC 2.

Connect the ideas: identity-alert-triage · investigate-respond-verify

Security service edge

SSE

Cloud-delivered security services such as secure web access without requiring the networking half of SASE.

See it in practice

SSE can inspect outbound web traffic from dispatch laptops without being a substitute for IAM.

Connect the ideas: networks-dns-http-tls · frameworks-and-categories

Single sign-on

SSO

A pattern where one authentication to an identity provider is reused across multiple applications.

See it in practice

FleetLink and TrackPort both trust Harbor identity SSO, so a stolen SSO session is wider than one app password.

Connect the ideas: identity-authn-authz · identity-alert-triage

SaaS security posture management

SSPM

Configuration and access review for software-as-a-service tenants such as email or identity portals.

See it in practice

SSPM can show that the identity provider still allows SMS fallback after the passkey rollout.

Connect the ideas: identity-authn-authz · frameworks-and-categories

Threat

A person, process, or event that might cause a loss to an asset.

See it in practice

Opportunistic ransomware crews scanning internet VPNs are a threat to Riverstone’s driver login path.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Transport Layer Security

TLS

A protocol that encrypts and integrity-protects an application conversation and checks a certificate for a name.

See it in practice

TLS 1.3 can hide shipment HTML from cafe Wi-Fi without deciding which customer may see which trailer.

Connect the ideas: networks-dns-http-tls

Triage

A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.

See it in practice

Maya’s five-minute disable of jordan.h with a missing-log list is triage, not a completed investigation.

Connect the ideas: identity-alert-triage · investigate-respond-verify

Trust boundary

A place where identity, network, or data assumptions change and a fresh check is required.

See it in practice

The internet-to-VPN boundary is not the same as the application authorization boundary inside TrackPort.

Connect the ideas: networks-dns-http-tls · least-privilege-and-layers

Uncertainty

What you still do not know, written explicitly so it is not filled with false precision.

See it in practice

Maya does not know whether a geofence already limits VPN logins, so that stays an open question.

Connect the ideas: threat-vulnerability-risk · logs-alerts-evidence

Vulnerability

A weakness in a system, process, or person that makes a loss easier to cause.

See it in practice

An unpatched VPN appliance is a vulnerability even before anyone exploits it at Riverstone.

Connect the ideas: threat-vulnerability-risk · vulnerability-prioritization

Web application firewall

WAF

A reverse-proxy control that inspects HTTP traffic to an application for known abuse patterns.

See it in practice

A WAF rule may buy time against the document-parser exploit; it does not patch TrackPort.

Connect the ideas: networks-dns-http-tls · vulnerability-prioritization

Extended detection and response

XDR

A vendor category for stitching multiple telemetry sources; it is not automatic coverage of every outcome.

See it in practice

Buying XDR does not by itself prove TrackPort exports would be detected.

Connect the ideas: frameworks-and-categories · agentic-soc-and-iris

Zero trust

An architecture approach that treats every request as untrusted until authenticated and authorized in context, per NIST SP 800-207.

See it in practice

Zero trust does not mean “VPN is obsolete”; it means VPN membership is not authorization to data.

Connect the ideas: least-privilege-and-layers · agentic-soc-and-iris

Zero trust network access

ZTNA

Access that brokers application connectivity per identity and policy instead of placing users on a flat network.

See it in practice

ZTNA to YardOS is still not authorization to export TrackPort addresses.

Connect the ideas: least-privilege-and-layers · frameworks-and-categories

Less jargon.More understanding.

Less jargon.
More understanding.