✳ 94 terms / The plain-English glossary
Start with a definition. Open any term for a practical example, first steps, and a way to check your work—or test yourself with flashcards.
FLASHCARD 1 / 94
94 terms
Account recovery
The process that restores access when authenticators are lost, which can become the weakest authenticator.
A chat-based photo reset can undo a passkey rollout if help desk treats it as a formality.
Connect the ideas: Identity, authentication, authorization, and recovery · Data protection, updates, backups, and resilience
Alert
A notification that a rule or model wants a human to look at one or more records.
Impossible travel is an alert title; it is not the name of the incident.
Connect the ideas: Logs, alerts, and evidence · Triage a synthetic identity alert
Attack surface management
The ongoing discovery, assessment, and reduction of ways an attacker could reach or affect an organization’s assets. Its scope may include external, internal, and cloud environments.
ASM is how Riverstone might notice a forgotten staging TrackPort still serving TLS on the internet.
Connect the ideas: Prioritize vulnerabilities and exposures · How systems communicate: network, DNS, HTTP, and TLS
Asset
Anything whose disclosure, alteration, destruction, or downtime would harm a person or organization.
Riverstone treats YardOS pallet records as an asset because a wrong location can hide theft.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Data protection, updates, backups, and resilience
Attestation
Evidence or a statement about a claimed device, workload, or control state that another party can evaluate against its requirements.
A device attestation that FleetLink is running on a managed phone can inform authorization without being authorization by itself.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, secure defaults, trust boundaries, and layered controls
Audit trail
An append-oriented history of security-relevant actions that can be shown to a later reviewer.
Priya’s approval to disable jordan.h should live in an audit trail, not only in a disappearing chat.
Connect the ideas: Logs, alerts, and evidence · Investigate, respond, and verify recovery
Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
A password plus an MFA push that succeeds means the account proved itself, not that the assigned driver was present.
Connect the ideas: Identity, authentication, authorization, and recovery · Triage a synthetic identity alert
Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
Even after MFA, jordan.h should be denied an address export for a trailer assigned to someone else.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, secure defaults, trust boundaries, and layered controls
Availability
The property that authorized people can use a system or record when they need it.
Ransomware encrypting YardOS before the morning load is an availability failure.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Data protection, updates, backups, and resilience
Backup
A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.
Nightly files on a share the YardOS account can encrypt are not a trustworthy backup until proven isolated.
Connect the ideas: Data protection, updates, backups, and resilience · Investigate, respond, and verify recovery
Blast radius
How much additional loss a failure or a response action can cause beyond the original asset.
Deleting every FleetLink mailbox because one API timed out is a self-inflicted blast radius.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · Investigate, respond, and verify recovery
Cloud access security broker
A control point for observing or constraining use of cloud services, including unsanctioned ones.
CASB might have shown the contractor forwarding a TrackPort export to a personal inbox.
Connect the ideas: Data protection, updates, backups, and resilience · From principles to frameworks and product categories
Confidentiality, Integrity, Availability
A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.
Maya writes CIA in the incident note so a later product discussion still names the failed property.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · From principles to frameworks and product categories
Cloud-native application protection platform
A bundled category covering cloud posture, workload, and related application-risk features; boundaries vary by vendor.
A CNAPP purchase does not automatically include TrackPort’s in-app authorization tests.
Connect the ideas: From principles to frameworks and product categories · Prioritize vulnerabilities and exposures
Compensating control
An alternative safeguard used in place of a specified control, with evidence that it provides comparable protection for the intended security objective.
If a legacy application cannot enforce MFA, restricting it behind a gateway that requires MFA may be a compensating control if direct access is blocked and the coverage is verified.
Connect the ideas: Prioritize vulnerabilities and exposures · Least privilege, secure defaults, trust boundaries, and layered controls
Confidentiality
The property that information is available only to people or systems authorized to see it.
A contractor emailing TrackPort addresses to a personal inbox is a confidentiality failure.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Identity, authentication, authorization, and recovery
Control
A process, configuration, or technology meant to reduce a named risk or detect a named failure.
Phishing-resistant MFA is a control for TrackPort account takeover, not a general luck charm.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · From principles to frameworks and product categories
Coverage
An explicit statement of which sources, time windows, and rows were actually collected, including truncation.
“EDR not connected” is a coverage statement that belongs on CASE-8821, not a silent gap.
Connect the ideas: Logs, alerts, and evidence · Understand and build toward an Agentic SOC
Cloud security posture management
Checks of cloud configuration against policy, such as public storage or open security groups.
Review backup-bucket delete and retention-bypass permissions alongside retention locks; a delete permission alone does not prove a protected object can be erased.
Connect the ideas: Data protection, updates, backups, and resilience · From principles to frameworks and product categories
Continuous threat exposure management
A program for repeatedly finding, prioritizing, and reducing exposed attack surface rather than running a yearly scan.
CTEM would keep the VPN appliance in an owned queue instead of a quarterly PDF.
Connect the ideas: Prioritize vulnerabilities and exposures · From principles to frameworks and product categories
Common Vulnerabilities and Exposures
A public identifier for a specific disclosed vulnerability record.
The VPN finding should be tracked by CVE identifier so KEV membership can be checked without relying on a scanner nickname.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Common Vulnerability Scoring System
FIRST’s method for describing characteristics and technical severity of a vulnerability, not a full remediation order.
Two CVSS-critical findings can still be queued differently once exposure and KEV are considered.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Dynamic application security testing
Testing a running application from the outside to find exploitable behavior.
DAST against TrackPort staging can show whether the parser proof-of-concept actually works.
Connect the ideas: Prioritize vulnerabilities and exposures · How systems communicate: network, DNS, HTTP, and TLS
Data classification
Labeling records by the harm of disclosure, alteration, or loss so protection and retention can follow.
Customer addresses are confidential; public tracking FAQs are not in the same class.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Data protection, updates, backups, and resilience
Defense in depth
Layering independent controls so that one failure does not become a complete compromise.
MFA plus scoped tokens plus a contractor VLAN still matter if any one of them is mis-set.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · From principles to frameworks and product categories
Data loss prevention
Controls that detect or block sensitive data leaving a channel such as email, web, or endpoint.
DLP on email could have blocked the address export, but only if TrackPort fields were classified.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Data protection, updates, backups, and resilience
Domain Name System
The lookup system that maps a name people type to an address a computer can contact.
If DNS for track.riverstone.example points at an unexpected IP, the customer may never reach Riverstone.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS
Endpoint detection and response
Telemetry and response capability on laptops and servers for process, file, and similar host activity.
EDR showing no FleetLink process contradicts a FleetLink user-agent and becomes useful tension in the case.
Connect the ideas: Triage a synthetic identity alert · Investigate, respond, and verify recovery
Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
TLS encrypts the TrackPort session; it does not encrypt backups if those copies are stored in cleartext elsewhere.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · Data protection, updates, backups, and resilience
Exploit Prediction Scoring System
FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.
A low EPSS on the wiki plugin is a forecast, not a promise it will never be used against Riverstone.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
A raw TrackPort export log with collection time is evidence; a Slack rumor is not.
Connect the ideas: Logs, alerts, and evidence · Investigate, respond, and verify recovery
Exploit
A method or code that uses a vulnerability to cause an unauthorized effect.
A public proof-of-concept against TrackPort’s document parser is an exploit path, not yet proof of local use.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
An internal wiki plugin has less exposure than an internet-facing VPN even with a similar CVSS.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
False positive
An alert that did not represent the harmful event the detector was meant to catch.
A VPN egress that looks like impossible travel can be a false positive for “stolen account” and still worth a look.
Connect the ideas: Logs, alerts, and evidence · Triage a synthetic identity alert
Federation
Trusting authentication assertions from an external identity provider instead of storing every password locally.
FleetLink federates to Riverstone’s identity provider, so TrackPort should not keep a second password for Jordan.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, secure defaults, trust boundaries, and layered controls
Governance, risk, and compliance
The organizational functions that set policy, track risk, and collect assurance evidence. Not a product that grants safety.
GRC can own the exception record when the VPN patch waits for a maintenance window.
Connect the ideas: From principles to frameworks and product categories · Prioritize vulnerabilities and exposures
Hashing
A one-way fingerprint of data used to detect change or store verifiers, not a reversible way to hide records you must later read.
Hashing bills of lading can detect tampering; it cannot restore the document after ransomware.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Data protection, updates, backups, and resilience
Hypertext Transfer Protocol
The application protocol that names methods, paths, headers, and bodies for web requests.
GET /exports/addresses with a session cookie is an HTTP request whose meaning TrackPort must authorize.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · Identity, authentication, authorization, and recovery
Identity and access management
The capability for creating identities, authenticating them, authorizing actions, and managing their lifecycle.
IAM is how Riverstone should issue contractor accounts with an expiry instead of sharing a clipboard password.
Connect the ideas: Identity, authentication, authorization, and recovery · From principles to frameworks and product categories
Idempotency
The property that repeating the same operation has the same intended effect on state as performing it once; separate audit records may still be created.
Disable-account should be idempotent; retrying a transfer of funds or a unique firewall rule may not be.
Connect the ideas: Investigate, respond, and verify recovery · Understand and build toward an Agentic SOC
Identity
The record an organization uses for a person, device, or workload that can be authenticated.
jordan.h is an identity record; it is not automatically the human Jordan Hale.
Connect the ideas: Identity, authentication, authorization, and recovery · Triage a synthetic identity alert
Identity governance and administration
Processes and tools for reviewing who should have which access and removing what is no longer justified.
An IGA review should have caught jordan.h still sitting in Warehouse-Admins after the Friday job ended.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · From principles to frameworks and product categories
Impact
How badly people or the business are hurt if the loss actually happens.
Taking the driver VPN down stalls FleetLink assignments and the Oakland dock wave.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Threat, vulnerability, likelihood, impact, and uncertainty
Incident
An event or set of events that actually or potentially causes a security loss requiring coordinated handling.
The unassigned address export is an incident even if Jordan later proves the travel was real.
Connect the ideas: Logs, alerts, and evidence · Investigate, respond, and verify recovery
Indicator of compromise
An observable such as an address, hash, or account pattern that may indicate a compromise, with limited shelf life.
203.0.113.40 is an IOC candidate for this case, not a permanent blocklist of a whole country.
Connect the ideas: Triage a synthetic identity alert · Investigate, respond, and verify recovery
Integrity
The property that data and processes remain complete and unaltered except by authorized action.
A dock scanner marking a full pallet empty attacks integrity so the goods can be stolen.
Connect the ideas: What we protect: assets, confidentiality, integrity, and availability · Data protection, updates, backups, and resilience
Internet Protocol address
A numeric locator used to deliver packets to a host on a network.
203.0.113.40 in the 02:14 log is an address, not proof of which human held the phone.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · Triage a synthetic identity alert
Known Exploited Vulnerabilities
CISA’s catalog of vulnerabilities with evidence of exploitation in the wild.
The VPN’s KEV listing is observed evidence from somewhere; it is not a Riverstone incident by itself.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
Contractor access to dock 3 on Friday is least privilege; Warehouse-Admins is not.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · Investigate, respond, and verify recovery
Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
Internet exposure plus a KEV listing raises likelihood for the VPN relative to an internal wiki plugin.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Log
A record emitted by a system that something happened, which may later be used as evidence.
The identity-provider line at 02:14 is a log, not a conclusion about Jordan’s intent.
Connect the ideas: Logs, alerts, and evidence · Triage a synthetic identity alert
Managed detection and response
A service that combines tooling with people who triage and investigate on a customer’s behalf.
MDR can watch Riverstone overnight, but Riverstone still owns authorization for destructive actions.
Connect the ideas: From principles to frameworks and product categories · Understand and build toward an Agentic SOC
Mean time to detect
An operational metric for how long events of a type remain unnoticed; it is only as honest as the clock and the catalog of events.
If export logs are delayed 40 minutes, MTTD for export abuse cannot be five minutes no matter the alert banner.
Connect the ideas: Logs, alerts, and evidence · Triage a synthetic identity alert
Multifactor authentication
Authentication that requires more than one factor, such as something you know plus something you have.
Riverstone’s phone prompt is MFA, and a two-second approval can still be social engineering.
Connect the ideas: Identity, authentication, authorization, and recovery · Triage a synthetic identity alert
Network detection and response
Detection and investigation based on network traffic or metadata rather than host agents alone.
NDR might show an unusual volume of encrypted outbound traffic even if a laptop’s EDR agent was tampered with; encrypted metadata alone does not reveal the request’s contents.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · From principles to frameworks and product categories
Non-repudiation
Evidence supporting a claim that a particular party originated or approved something, so a later denial can be evaluated. Reliable identity binding and record integrity matter.
A digitally signed approval can support a later dispute about who authorized a shipment; a shared login and an editable log cannot provide the same assurance.
Connect the ideas: Identity, authentication, authorization, and recovery · Logs, alerts, and evidence
Privileged access management
Controls that broker, record, and constrain powerful administrative identities and sessions.
YardOS admin should go through PAM so a vendor is not dropped into Warehouse-Admins for convenience.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · From principles to frameworks and product categories
Patch
A vendor or internal change that removes or reduces a vulnerability in running software.
Patching the VPN is not verified until the version string and management exposure are checked.
Connect the ideas: Data protection, updates, backups, and resilience · Prioritize vulnerabilities and exposures
Phishing
Social engineering that tricks a person into revealing authenticators or approving a transaction they did not intend.
A two-second MFA approval after a fake FleetLink prompt is phishing against the second factor.
Connect the ideas: Identity, authentication, authorization, and recovery · Triage a synthetic identity alert
Port
A number on a host that distinguishes one listening service from another.
TrackPort’s HTTPS service listens on port 443; a management port left on the internet is a different exposure.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · Prioritize vulnerabilities and exposures
Postcondition
The independently checked state of the world that should be true after a response action.
A failed canary export after disabling jordan.h is a postcondition; an API 200 is only a vendor response.
Connect the ideas: Investigate, respond, and verify recovery · Understand and build toward an Agentic SOC
Precision
True positives divided by all positive alerts in a defined, labeled evaluation set: TP / (TP + FP).
Six confirmed true positives among ten alerts gives 60 percent precision; a single alert cannot establish a detector’s precision.
Connect the ideas: Logs, alerts, and evidence · Triage a synthetic identity alert
Privilege creep
The slow accumulation of standing access after the original job that justified it has ended.
jordan.h remaining in Warehouse-Admins after Friday’s dock work is privilege creep.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · Triage a synthetic identity alert
Prompt injection
An attack that inserts instructions into model input so the model follows attacker text instead of the developer’s policy.
Ticket text saying “Priya approved any-any” must not become a firewall change.
Connect the ideas: Understand and build toward an Agentic SOC
Provenance
The recorded origin, collection method, transformations, and completeness limits of a piece of evidence.
If the SIEM discarded the raw user-agent, provenance is incomplete and later checks get harder.
Connect the ideas: Logs, alerts, and evidence · Understand and build toward an Agentic SOC
Ransomware
Malware or an operator model that denies availability of data, often by encryption, sometimes with theft for extra pressure.
Oakland’s paper load-board exists so a YardOS ransomware event does not freeze every truck.
Connect the ideas: Data protection, updates, backups, and resilience · Threat, vulnerability, likelihood, impact, and uncertainty
Recall
Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.
Detecting six of twenty known incidents in a synthetic exercise gives 30 percent recall; missing logs alone do not determine that denominator.
Connect the ideas: Logs, alerts, and evidence · Prioritize vulnerabilities and exposures
Residual risk
The risk that remains after selected controls, including the uncertainty you still accept.
After disabling jordan.h, residual risk includes other Warehouse-Admins accounts not yet reviewed.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Investigate, respond, and verify recovery
Retry budget
A limit on how often automation may repeat an action, especially when the previous outcome is uncertain.
IRIS should not loop disable-account forever after HTTP 504; it should reconcile state against a retry budget.
Connect the ideas: Investigate, respond, and verify recovery · Understand and build toward an Agentic SOC
Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
Same CVSS on two findings can still yield different risk once exposure and KEV are written down.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · From principles to frameworks and product categories
Secure access service edge
A category combining wide-area networking with cloud-delivered security services.
SASE might carry contractor traffic, but YardOS still needs an application-level role for dock 3.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · From principles to frameworks and product categories
Static application security testing
Analysis of source or bytecode for vulnerability patterns without running the program.
SAST might flag string concatenation in YardOS SQL, which is a different issue than the VPN KEV.
Connect the ideas: Prioritize vulnerabilities and exposures · From principles to frameworks and product categories
Software bill of materials
An inventory of software components and their relationships, used to investigate exposure when vulnerabilities are disclosed.
An SBOM for TrackPort would tell Devon whether the parser library is in production before the scanner does.
Connect the ideas: Prioritize vulnerabilities and exposures · From principles to frameworks and product categories
Software composition analysis
Inspection of dependencies and libraries for known vulnerabilities and license issues.
SCA is how the medium-CVSS parser library showed up in the Friday backlog.
Connect the ideas: Prioritize vulnerabilities and exposures · From principles to frameworks and product categories
Secrets management
Storing, rotating, and auditing passwords, keys, and tokens so they are not copied into chat or source.
The YardOS service account password on a clipboard is a secrets-management failure as well as an identity failure.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, secure defaults, trust boundaries, and layered controls
Secure defaults
Initial settings that reduce avoidable exposure and protect users without requiring them to discover and enable essential safeguards.
A newly created TrackPort role should see zero shipments until a customer scope is added.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · Data protection, updates, backups, and resilience
Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.
Revoking jordan.h sessions is containment that does not require deleting the identity record.
Connect the ideas: Identity, authentication, authorization, and recovery · Investigate, respond, and verify recovery
Shared responsibility
The split of security duties between a cloud or SaaS provider and the customer, which varies by service.
The identity provider hosts MFA; Riverstone still decides who is in Warehouse-Admins.
Connect the ideas: Identity, authentication, authorization, and recovery · Data protection, updates, backups, and resilience
Security information and event management
A capability that collects, parses, stores, and searches security telemetry and often fires alerts.
Riverstone’s SIEM joining identity and TrackPort logs is how Maya sees the 02:16 export beside the login.
Connect the ideas: Logs, alerts, and evidence · From principles to frameworks and product categories
Security orchestration, automation, and response
Tooling that runs playbooks across security systems, which still needs scoped authority and verification.
A SOAR play that disables accounts must not treat a model summary as the approval record.
Connect the ideas: From principles to frameworks and product categories · Understand and build toward an Agentic SOC
Security operations center
The people and process that detect, investigate, and respond to security events. Distinct from System and Organization Controls reporting.
Riverstone’s SOC is Maya’s on-call function, not an audit report named SOC 2.
Connect the ideas: Triage a synthetic identity alert · Investigate, respond, and verify recovery
Security service edge
Cloud-delivered security services such as secure web access without requiring the networking half of SASE.
SSE can inspect outbound web traffic from dispatch laptops without being a substitute for IAM.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · From principles to frameworks and product categories
Single sign-on
A pattern where one authentication to an identity provider is reused across multiple applications.
FleetLink and TrackPort both trust Harbor identity SSO, so a stolen SSO session is wider than one app password.
Connect the ideas: Identity, authentication, authorization, and recovery · Triage a synthetic identity alert
SaaS security posture management
Configuration and access review for software-as-a-service tenants such as email or identity portals.
SSPM can show that the identity provider still allows SMS fallback after the passkey rollout.
Connect the ideas: Identity, authentication, authorization, and recovery · From principles to frameworks and product categories
Threat
A person, process, or event that might cause a loss to an asset.
Opportunistic ransomware crews scanning internet VPNs are a threat to Riverstone’s driver login path.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Transport Layer Security
A protocol that encrypts and integrity-protects an application conversation and checks a certificate for a name.
TLS 1.3 can hide shipment HTML from cafe Wi-Fi without deciding which customer may see which trailer.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS
Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.
Maya’s five-minute disable of jordan.h with a missing-log list is triage, not a completed investigation.
Connect the ideas: Triage a synthetic identity alert · Investigate, respond, and verify recovery
Trust boundary
A place where identity, network, or data assumptions change and a fresh check is required.
The internet-to-VPN boundary is not the same as the application authorization boundary inside TrackPort.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · Least privilege, secure defaults, trust boundaries, and layered controls
Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.
Maya does not know whether a geofence already limits VPN logins, so that stays an open question.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Logs, alerts, and evidence
Vulnerability
A weakness in a system, process, or person that makes a loss easier to cause.
An unpatched VPN appliance is a vulnerability even before anyone exploits it at Riverstone.
Connect the ideas: Threat, vulnerability, likelihood, impact, and uncertainty · Prioritize vulnerabilities and exposures
Web application firewall
A control that inspects web application traffic and applies rules to detect or block unwanted requests, often including known attack patterns.
A WAF rule may buy time against the document-parser exploit; it does not patch TrackPort.
Connect the ideas: How systems communicate: network, DNS, HTTP, and TLS · Prioritize vulnerabilities and exposures
Extended detection and response
A vendor category for stitching multiple telemetry sources; it is not automatic coverage of every outcome.
Buying XDR does not by itself prove TrackPort exports would be detected.
Connect the ideas: From principles to frameworks and product categories · Understand and build toward an Agentic SOC
Zero trust
An architecture approach that grants no implicit trust from network location or asset ownership and evaluates access to resources using identity, device, and other context.
Zero trust does not mean “VPN is obsolete”; it means VPN membership is not authorization to data.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · Understand and build toward an Agentic SOC
Zero trust network access
Access that brokers application connectivity per identity and policy instead of placing users on a flat network.
ZTNA to YardOS is still not authorization to export TrackPort addresses.
Connect the ideas: Least privilege, secure defaults, trust boundaries, and layered controls · From principles to frameworks and product categories
No matches yet. Try a shorter word or the expanded acronym.
