✳ 104 terms / The plain-English glossary
Start with a plain-English definition. Open any term for a realistic engineering scenario, concrete verification steps, and interactive flashcards.
FLASHCARD 1 / 104
104 terms
Account recovery
The process for restoring account access when required authenticators are unavailable, using an approved recovery method.
A chat-based photo reset can undo a passkey rollout if help desk treats it as a formality.
Connect the ideas: Identity, authentication, authorization, and recovery · Data protection and resilience: why encryption is not a backup plan
Alert
A notification that a rule or model wants a human to look at one or more records.
Impossible travel is an alert title; it is not the name of the incident.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Identity alert triage: reconstructing who, what, and how across logs
Attack surface management
The ongoing discovery, assessment, and reduction of ways an attacker could reach or affect an organization’s assets. Its scope may include external, internal, and cloud environments.
ASM is how Meridian might notice a forgotten staging Chronos Hub node still serving TLS on the internet.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Networks in one request: DNS, TCP, TLS, and HTTP
Asset
Anything whose disclosure, alteration, destruction, or downtime would harm a person or organization.
Meridian Space & Robotics treats Propulsion testbench calibration records as an asset because a wrong vector can ruin a launch window.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Data protection and resilience: why encryption is not a backup plan
Attestation
Evidence or a statement about a claimed device, workload, or control state that another party can evaluate against its requirements.
A device attestation that the telemetry client is running on a managed workstation can inform authorization without being authorization by itself.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, defense in depth, and Zero Trust boundaries
Audit trail
An append-oriented history of security-relevant actions that can be shown to a later reviewer.
Priya Nair’s approval to disable dax.mercer@chronos.orbital should live in an audit trail, not only in a disappearing chat.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Choose the control and its evidence: policies do not execute themselves · Privacy vs security: why an encrypted database can still violate privacy
Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
A password plus an MFA push that succeeds means the account proved itself, not that the assigned operator was present.
Connect the ideas: Identity, authentication, authorization, and recovery · Identity alert triage: reconstructing who, what, and how across logs · Threat modeling a service: data flows, trust boundaries, and STRIDE · Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) · Who holds the ticket: OAuth 2.0 roles and bearer token verification
Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
Even after MFA, dax.mercer@chronos.orbital should be denied a telemetry export for a satellite tenant assigned to someone else.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, defense in depth, and Zero Trust boundaries · Threat modeling a service: data flows, trust boundaries, and STRIDE · Who holds the ticket: OAuth 2.0 roles and bearer token verification
Availability
The property that authorized people can use a system or record when they need it.
Ransomware encrypting the Propulsion testbench database before an orbital pass is an availability failure.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Data protection and resilience: why encryption is not a backup plan
Backup
A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.
Nightly files on a share the Propulsion testbench account can encrypt are not a trustworthy backup until proven isolated.
Connect the ideas: Data protection and resilience: why encryption is not a backup plan · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
Blast radius
How much additional loss a failure or a response action can cause beyond the original asset.
Deleting every operator mailbox because one telemetry API timed out is a self-inflicted blast radius.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Federation failure modes: five ways SSO and token trust break
Cloud access security broker
A control point for observing or constraining use of cloud services, including unsanctioned ones.
CASB might have shown the contractor forwarding a Chronos Hub telemetry export to a personal inbox.
Connect the ideas: Data protection and resilience: why encryption is not a backup plan · Security product categories are capabilities, not outcomes
Confidentiality, Integrity, Availability
A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.
Vera Vance writes CIA in the incident note so a later engineering review still names the exact failed property.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together
Cloud-native application protection platform
A bundled category covering cloud posture, workload, and related application-risk features; boundaries vary by vendor.
A CNAPP purchase does not automatically include Chronos Hub’s in-app authorization tests.
Connect the ideas: Security product categories are capabilities, not outcomes · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Compensating control
An alternative safeguard used in place of a specified control, with evidence that it provides comparable protection for the intended security objective.
If a legacy application cannot enforce MFA, restricting it behind a gateway that requires MFA may be a compensating control if direct access is blocked and the coverage is verified.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Least privilege, defense in depth, and Zero Trust boundaries · SBOM evidence and priority: binding inventory to the running build · Choose the control and its evidence: policies do not execute themselves
Confidentiality
The property that information is available only to people or systems authorized to see it.
A contractor emailing Chronos Hub customer orbital coordinates to a personal inbox is a confidentiality failure.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Identity, authentication, authorization, and recovery · Privacy vs security: why an encrypted database can still violate privacy
Control
A process, configuration, or technology meant to reduce a named risk or detect a named failure.
Phishing-resistant MFA is a control for Chronos Hub account takeover, not a general luck charm.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together · Choose the control and its evidence: policies do not execute themselves
Coverage
An explicit statement of which sources, time windows, and rows were actually collected, including truncation.
“EDR not connected” is a coverage statement that belongs on CASE-8821, not a silent gap.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Agentic SOC architecture: autonomous triage vs human-gated containment
Cloud security posture management
Checks of cloud configuration against policy, such as public storage or open security groups.
Review backup-bucket delete and retention-bypass permissions alongside retention locks; a delete permission alone does not prove a protected object can be erased.
Connect the ideas: Data protection and resilience: why encryption is not a backup plan · Security product categories are capabilities, not outcomes
Continuous threat exposure management
A program for repeatedly finding, prioritizing, and reducing exposed attack surface rather than running a yearly scan.
CTEM would keep the VPN appliance in an owned queue instead of a quarterly PDF.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Security product categories are capabilities, not outcomes
Common Vulnerabilities and Exposures
A public identifier for a specific disclosed vulnerability record.
The VPN finding should be tracked by CVE identifier so KEV membership can be checked without relying on a scanner nickname.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Common Vulnerability Scoring System
FIRST’s method for describing characteristics and technical severity of a vulnerability, not a full remediation order.
Two CVSS-critical findings can still be queued differently once exposure and KEV are considered.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · SBOM evidence and priority: binding inventory to the running build
Dynamic application security testing
Testing a running application from the outside to find exploitable behavior.
DAST against Chronos Hub staging can show whether the parser proof-of-concept actually works.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Networks in one request: DNS, TCP, TLS, and HTTP
Data classification
Labeling records by the harm of disclosure, alteration, or loss so protection and retention can follow.
Customer addresses are confidential; public tracking FAQs are not in the same class.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Data protection and resilience: why encryption is not a backup plan · Privacy vs security: why an encrypted database can still violate privacy
Data minimization
Collecting, using, and keeping only the personal information a stated purpose needs, and no longer than that purpose requires.
HR keeps the medical-clearance flag for staffing the dock and leaves it out of the dispatch log.
Connect the ideas: Privacy vs security: why an encrypted database can still violate privacy · Data protection and resilience: why encryption is not a backup plan
Defense in depth
Layering independent controls so that one failure does not become a complete compromise.
MFA plus scoped tokens plus a contractor VLAN still matter if any one of them is mis-set.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together
DomainKeys Identified Mail
A signature that lets a domain claim responsibility for selected message content, checked with a public key in DNS. A valid signature ties that signing domain to the signed bytes. It does not prove a human wrote the display name.
A DKIM pass for chronos.orbital shows that domain’s key matches the signed content. It does not show that the display name Finance is an honest job title.
Connect the ideas: Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) · Networks in one request: DNS, TCP, TLS, and HTTP
Data loss prevention
Controls that detect or block sensitive data leaving a channel such as email, web, or endpoint.
DLP on email could have blocked the telemetry export, but only if Chronos Hub fields were classified.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Data protection and resilience: why encryption is not a backup plan
Domain-based Message Authentication, Reporting, and Conformance
A DNS policy that checks whether the visible From domain aligns with a domain SPF or DKIM authenticated, and that publishes a handling preference plus reporting. A pass is authorized use of that domain, not a safety verdict.
A DMARC pass on finance@chronos.orbital means chronos.orbital authorized that use. Sloane Sterling still confirms the wire on a channel that is not the message.
Connect the ideas: Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) · Identity alert triage: reconstructing who, what, and how across logs
Domain Name System
The lookup system that maps a name people type to an address a computer can contact.
If DNS for hub.chronos.orbital points at an unexpected IP, the tenant operator may never reach Meridian.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Email authentication: what SPF, DKIM, and DMARC prove (and what they do not)
Endpoint detection and response
Telemetry and response capability on laptops and servers for process, file, and similar host activity.
EDR showing no telemetry-client process contradicts a telemetry-client user-agent and becomes useful tension in the case.
Connect the ideas: Identity alert triage: reconstructing who, what, and how across logs · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
TLS encrypts the Chronos Hub session; it does not encrypt backups if those copies are stored in cleartext elsewhere.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Data protection and resilience: why encryption is not a backup plan · Privacy vs security: why an encrypted database can still violate privacy
Exploit Prediction Scoring System
FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.
A low EPSS on the testbench plugin is a forecast, not a promise it will never be used against Meridian.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
A raw Chronos Hub export log with collection time is evidence; a Slack rumor is not.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Choose the control and its evidence: policies do not execute themselves
Excessive agency
A model-using application can cause harm because its tools, credentials, or freedom to act are broader than the task, so unexpected or manipulated model output becomes a real change.
Chronos-Copilot was built to read one support inbox, but its billing tool uses a finance-admin credential that can issue refunds.
Connect the ideas: Excessive agency: why a model sentence is never an authorization decision · Least privilege, defense in depth, and Zero Trust boundaries · Human oversight gates and the NIST AI Risk Management Framework
Exploit
A method or code that uses a vulnerability to cause an unauthorized effect.
A public proof-of-concept against Chronos Hub’s telemetry parser is an exploit path, not yet proof of local use.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
An internal wiki plugin has less exposure than an internet-facing VPN even with a similar CVSS.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · SBOM evidence and priority: binding inventory to the running build
False positive
An alert that did not represent the harmful event the detector was meant to catch.
A VPN egress that looks like impossible travel can be a false positive for “stolen account” and still worth a look.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Identity alert triage: reconstructing who, what, and how across logs
Federation
Trusting authentication assertions from an external identity provider instead of storing every password locally.
The orbital telemetry edge federates to Meridian’s identity provider, so Chronos Hub should not keep a second password for Dax Mercer.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, defense in depth, and Zero Trust boundaries · Who holds the ticket: OAuth 2.0 roles and bearer token verification · OIDC and SAML assertions: signed identity claims are not admin permission · Federation failure modes: five ways SSO and token trust break
Governance, risk, and compliance
The organizational functions that set policy, track risk, and collect assurance evidence. Not a product that grants safety.
GRC can own the exception record when the VPN patch waits for a maintenance window.
Connect the ideas: Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Write the risk sentence: cause, asset, and business impact · Choose the control and its evidence: policies do not execute themselves · Governance as an operating cadence: NIST CSF 2.0 Govern in practice
Hashing
A one-way fingerprint of data used to detect change or store verifiers, not a reversible way to hide records you must later read.
Hashing bills of lading can detect tampering; it cannot restore the document after ransomware.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Data protection and resilience: why encryption is not a backup plan
Hypertext Transfer Protocol
The application protocol that names methods, paths, headers, and bodies for web requests.
GET /exports/telemetry with a session cookie is an HTTP request whose meaning Chronos Hub must authorize.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Identity, authentication, authorization, and recovery
Identity and access management
The capability for creating identities, authenticating them, authorizing actions, and managing their lifecycle.
IAM is how Meridian should issue contractor accounts with an expiry instead of sharing a clipboard password.
Connect the ideas: Identity, authentication, authorization, and recovery · Security product categories are capabilities, not outcomes
Idempotency
The property that repeating the same operation has the same intended effect on state as performing it once; separate audit records may still be created.
Disable-account should be idempotent; retrying a transfer of funds or a unique firewall rule may not be.
Connect the ideas: Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Agentic SOC architecture: autonomous triage vs human-gated containment
Identifier alignment
The DMARC check that the Author Domain in the visible From matches an SPF- or DKIM-authenticated domain. Relaxed alignment shares an organizational domain. Strict alignment requires the names to be identical.
Relaxed alignment can let mail.chronos.orbital align with chronos.orbital. A cousin name such as chronos-mail.orbital does not.
Connect the ideas: Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) · Networks in one request: DNS, TCP, TLS, and HTTP
Identity
The record an organization uses for a person, device, or workload that can be authenticated.
dax.mercer@chronos.orbital is an identity record; it is not automatically the human Dax Mercer.
Connect the ideas: Identity, authentication, authorization, and recovery · Identity alert triage: reconstructing who, what, and how across logs
Identity governance and administration
Processes and tools for reviewing who should have which access and removing what is no longer justified.
An IGA review should have caught dax.mercer@chronos.orbital still sitting in Propulsion-Admins after the Friday calibration job ended.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Security product categories are capabilities, not outcomes
Impact
How badly people or the business are hurt if the loss actually happens.
Taking the ground-station VPN down stalls orbital pass scheduling and telemetry ingestion.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Threat, vulnerability, and risk: the core equation
Incident
An event or set of events that actually or potentially causes a security loss requiring coordinated handling.
The unassigned telemetry export is an incident even if Dax Mercer later proves the travel was real.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
Indicator of compromise
An observable such as an address, hash, or account pattern that may indicate a compromise, with limited shelf life.
203.0.113.40 is an IOC candidate for this case, not a permanent blocklist of a whole country.
Connect the ideas: Identity alert triage: reconstructing who, what, and how across logs · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
Integrity
The property that data and processes remain complete and unaltered except by authorized action.
An unauthenticated script altering thruster telemetry calibration weights attacks integrity even if no data is stolen.
Connect the ideas: Assets and the CIA triad: what we protect and how it fails · Data protection and resilience: why encryption is not a backup plan
Internet Protocol address
A numeric locator used to deliver packets to a host on a network.
203.0.113.40 in the 02:14 log is an address, not proof of which human held the phone.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Identity alert triage: reconstructing who, what, and how across logs
Known Exploited Vulnerabilities
CISA’s catalog of vulnerabilities with evidence of exploitation in the wild.
The VPN’s KEV listing is observed evidence from somewhere; it is not a Meridian incident by itself.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · SBOM evidence and priority: binding inventory to the running build
Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
Contractor access to Testbay 3 on Friday is least privilege; Propulsion-Admins is not.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · CI/CD trust boundaries: writing code vs promoting to production · Federation failure modes: five ways SSO and token trust break
Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
Internet exposure plus a KEV listing raises likelihood for the VPN relative to an internal wiki plugin.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Log
A record emitted by a system that something happened, which may later be used as evidence.
The identity-provider line at 02:14 is a log, not a conclusion about Dax Mercer’s intent.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Identity alert triage: reconstructing who, what, and how across logs
Managed detection and response
A service that combines tooling with people who triage and investigate on a customer’s behalf.
MDR can watch Meridian overnight, but Meridian still owns authorization for destructive actions.
Connect the ideas: Security product categories are capabilities, not outcomes · Agentic SOC architecture: autonomous triage vs human-gated containment
Mean time to detect
An operational metric for how long events of a type remain unnoticed; it is only as honest as the clock and the catalog of events.
If export logs are delayed 40 minutes, MTTD for export abuse cannot be five minutes no matter the alert banner.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Identity alert triage: reconstructing who, what, and how across logs
Multifactor authentication
Authentication that requires more than one factor, such as something you know plus something you have.
Meridian’s phone prompt is MFA, and a two-second approval can still be social engineering.
Connect the ideas: Phishing and social engineering: how attackers exploit workflow urgency · Identity, authentication, authorization, and recovery · Identity alert triage: reconstructing who, what, and how across logs
Network detection and response
Detection and investigation based on network traffic or metadata rather than host agents alone.
NDR might show an unusual volume of encrypted outbound traffic even if a laptop’s EDR agent was tampered with; encrypted metadata alone does not reveal the request’s contents.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Security product categories are capabilities, not outcomes
Non-repudiation
Evidence supporting a claim that a particular party originated or approved something, so a later denial can be evaluated. Reliable identity binding and record integrity matter.
A digitally signed approval can support a later dispute about who authorized a shipment; a shared login and an editable log cannot provide the same assurance.
Connect the ideas: Identity, authentication, authorization, and recovery · Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
Open Authorization
A delegated-access framework: a client presents an access token so a resource server can allow a limited action. The token is not proof of who the human is, and it does not grant every action the API could perform.
Chronos Hub’s calendar connector gets a token to read orbital pass windows. That token is not permission to export every customer telemetry archive.
Connect the ideas: Identity, authentication, authorization, and recovery · Who holds the ticket: OAuth 2.0 roles and bearer token verification · Federation failure modes: five ways SSO and token trust break
OpenID Connect
An identity layer on OAuth. An identity provider issues an ID token that asserts a sign-in. The application still checks the audience and still decides what that account may do.
The orbital telemetry edge accepts an ID token that says an operator authenticated. It still refuses satellite 99 when that operator is not assigned.
Connect the ideas: Identity, authentication, authorization, and recovery · OIDC and SAML assertions: signed identity claims are not admin permission
Privileged access management
Controls that broker, record, and constrain powerful administrative identities and sessions.
Propulsion testbench admin should go through PAM so a vendor is not dropped into Propulsion-Admins for convenience.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Security product categories are capabilities, not outcomes
Patch
A vendor or internal change that removes or reduces a vulnerability in running software.
Patching the VPN is not verified until the version string and management exposure are checked.
Connect the ideas: Data protection and resilience: why encryption is not a backup plan · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Phishing
Social engineering that tricks a person into revealing authenticators or approving a transaction they did not intend.
A two-second MFA approval after a fake Chronos Hub prompt is phishing against the second factor.
Connect the ideas: Phishing and social engineering: how attackers exploit workflow urgency · Identity, authentication, authorization, and recovery · Identity alert triage: reconstructing who, what, and how across logs · Email authentication: what SPF, DKIM, and DMARC prove (and what they do not)
Port
A number on a host that distinguishes one listening service from another.
Chronos Hub’s HTTPS service listens on port 443; a management port left on the internet is a different exposure.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Postcondition
The independently checked state of the world that should be true after a response action.
A failed canary export after disabling dax.mercer@chronos.orbital is a postcondition; an API 200 is only a vendor response.
Connect the ideas: Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Agentic SOC architecture: autonomous triage vs human-gated containment
Precision
True positives divided by all positive alerts in a defined, labeled evaluation set: TP / (TP + FP).
Six confirmed true positives among ten alerts gives 60 percent precision; a single alert cannot establish a detector’s precision.
Connect the ideas: Identity alert triage: reconstructing who, what, and how across logs · Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
Privacy
Questions about appropriate collection, use, retention, and disclosure of personal information, including what the person can expect. Distinct from confidentiality.
An encrypted HR export can still be a privacy problem if a vendor uses home addresses for a flyer.
Connect the ideas: Privacy vs security: why an encrypted database can still violate privacy · Assets and the CIA triad: what we protect and how it fails
Privilege creep
The slow accumulation of standing access after the original job that justified it has ended.
dax.mercer@chronos.orbital remaining in Propulsion-Admins after Friday’s calibration work is privilege creep.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Identity alert triage: reconstructing who, what, and how across logs
Prompt injection
An attack that inserts instructions into model input so the model follows attacker text instead of the developer’s policy.
Ticket text saying “Priya Nair approved any-any” must not become a firewall change.
Connect the ideas: Agentic SOC architecture: autonomous triage vs human-gated containment · Prompt injection and untrusted retrieval (RAG): when data hijacks instructions
Provenance
The recorded origin, collection method, transformations, and completeness limits of a piece of evidence.
If the SIEM discarded the raw user-agent, provenance is incomplete and later checks get harder.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Agentic SOC architecture: autonomous triage vs human-gated containment · SBOM evidence and priority: binding inventory to the running build · Email authentication: what SPF, DKIM, and DMARC prove (and what they do not)
Ransomware
Malware or an operator model that denies availability of data, often by encryption, sometimes with theft for extra pressure.
Mission Control’s offline pass-schedule board exists so a Propulsion testbench ransomware event does not freeze every orbital pass.
Connect the ideas: Data protection and resilience: why encryption is not a backup plan · Threat, vulnerability, and risk: the core equation
Recall
Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.
Detecting six of twenty known incidents in a synthetic exercise gives 30 percent recall; missing logs alone do not determine that denominator.
Connect the ideas: Identity alert triage: reconstructing who, what, and how across logs · Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
Residual risk
The risk that remains after implemented safeguards, including uncertainty in its assessment.
After disabling dax.mercer@chronos.orbital, residual risk includes other Propulsion-Admins accounts not yet reviewed.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Write the risk sentence: cause, asset, and business impact
Retry budget
A limit on how often automation may repeat an action, especially when the previous outcome is uncertain.
Agentic SOC should not loop disable-account forever after HTTP 504; it should reconcile state against a retry budget.
Connect the ideas: Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · Agentic SOC architecture: autonomous triage vs human-gated containment
Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
Same CVSS on two findings can still yield different risk once exposure and KEV are written down.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together · Write the risk sentence: cause, asset, and business impact
Security Assertion Markup Language
An XML assertion from an identity provider to a relying application. A signed authentication statement says the provider authenticated the subject. It does not, by itself, authorize every function in the application.
The propulsion portal trusts a SAML response for Priya Nair, then applies the Propulsion role locally. The assertion is not a blank admin pass.
Connect the ideas: Identity, authentication, authorization, and recovery · OIDC and SAML assertions: signed identity claims are not admin permission
Secure access service edge
A category combining wide-area networking with cloud-delivered security services.
SASE might carry contractor traffic, but the Propulsion testbench still needs an application-level role for Testbay 3.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Security product categories are capabilities, not outcomes
Static application security testing
Analysis of source or bytecode for vulnerability patterns without running the program.
SAST might flag string concatenation in Propulsion testbench SQL, which is a different issue than the VPN KEV.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Security product categories are capabilities, not outcomes
Software bill of materials
An inventory of software components and their relationships, used to investigate exposure when vulnerabilities are disclosed.
An SBOM for Chronos Hub would tell Kael Cho whether the parser library is in production before the scanner does.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Direct and transitive dependencies: inherited code in your runtime · SBOM evidence and priority: binding inventory to the running build
Software composition analysis
Inspection of dependencies and libraries for known vulnerabilities and license issues.
SCA is how the medium-CVSS parser library showed up in the Friday backlog.
Connect the ideas: Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure · Security product categories are capabilities, not outcomes
Secrets management
Storing, rotating, and auditing passwords, keys, and tokens so they are not copied into chat or source.
The Propulsion testbench service account password on a clipboard is a secrets-management failure as well as an identity failure.
Connect the ideas: Identity, authentication, authorization, and recovery · Least privilege, defense in depth, and Zero Trust boundaries
Secure defaults
Initial settings that reduce avoidable exposure and protect users without requiring them to discover and enable essential safeguards.
A newly created Chronos Hub role should see zero satellite passes until a tenant scope is added.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Data protection and resilience: why encryption is not a backup plan
Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.
Revoking dax.mercer@chronos.orbital sessions is containment that does not require deleting the identity record.
Connect the ideas: Identity, authentication, authorization, and recovery · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof · OIDC and SAML assertions: signed identity claims are not admin permission
Shared responsibility
The split of security duties between a cloud or SaaS provider and the customer, which varies by service.
The identity provider hosts MFA; Meridian still decides who is in Propulsion-Admins.
Connect the ideas: Identity, authentication, authorization, and recovery · Data protection and resilience: why encryption is not a backup plan · Cloud shared responsibility: what you rent vs what you still own
Security information and event management
A capability that collects, parses, stores, and searches security telemetry and often fires alerts.
Meridian’s SIEM joining identity and Chronos Hub logs is how Vera Vance sees the 02:16 export beside the login.
Connect the ideas: Logs, alerts, and evidence: why an alert title is a hypothesis, not proof · Security product categories are capabilities, not outcomes
Security orchestration, automation, and response
Tooling that runs playbooks across security systems, which still needs scoped authority and verification.
A SOAR play that disables accounts must not treat a model summary as the approval record.
Connect the ideas: Security product categories are capabilities, not outcomes · Agentic SOC architecture: autonomous triage vs human-gated containment
Security operations center
The people and process that detect, investigate, and respond to security events. Distinct from System and Organization Controls reporting.
Meridian’s SOC is Vera Vance’s on-call security operations function, not an audit report named SOC 2.
Connect the ideas: Identity alert triage: reconstructing who, what, and how across logs · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
Sender Policy Framework
A DNS policy that says which hosts may use a domain in the MAIL FROM or HELO identity. A pass authorizes that host for that identity. It does not prove the visible From address or a person’s intent.
Meridian Mail’s SPF pass means the connecting host was listed for chronos.orbital’s envelope identity, not that Sloane Sterling typed the wire request.
Connect the ideas: Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) · Networks in one request: DNS, TCP, TLS, and HTTP
Security service edge
Cloud-delivered security services such as secure web access without requiring the networking half of SASE.
SSE can inspect outbound web traffic from mission-control laptops without being a substitute for IAM.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Security product categories are capabilities, not outcomes
Single sign-on
A pattern where one authentication to an identity provider is reused across multiple applications.
The orbital telemetry edge and Chronos Hub both trust Meridian SSO, so a stolen SSO session is wider than one app password.
Connect the ideas: Identity, authentication, authorization, and recovery · Identity alert triage: reconstructing who, what, and how across logs · OIDC and SAML assertions: signed identity claims are not admin permission
SaaS security posture management
Configuration and access review for software-as-a-service tenants such as email or identity portals.
SSPM can show that the identity provider still allows SMS fallback after the passkey rollout.
Connect the ideas: Identity, authentication, authorization, and recovery · Security product categories are capabilities, not outcomes
Threat
A person, process, or event that might cause a loss to an asset.
Opportunistic ransomware crews scanning internet VPNs are a threat to Meridian’s ground-station operator login path.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Transport Layer Security
A protocol that encrypts and integrity-protects an application conversation and checks a certificate for a name.
TLS 1.3 can hide orbital telemetry payloads from cafe Wi-Fi without deciding which tenant may see which satellite.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP
Triage
A short, time-boxed judgment of severity, uncertainty, and next action when an alert arrives.
Vera Vance’s five-minute disable of dax.mercer@chronos.orbital with a missing-log list is triage, not a completed investigation.
Connect the ideas: Identity alert triage: reconstructing who, what, and how across logs · Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof
Trust boundary
A place where identity, network, or data assumptions change and a fresh check is required.
The internet-to-VPN boundary is not the same as the application authorization boundary inside Chronos Hub.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Least privilege, defense in depth, and Zero Trust boundaries · Application trust boundaries: why the client UI is never a security gate · Threat modeling a service: data flows, trust boundaries, and STRIDE · Federation failure modes: five ways SSO and token trust break
Uncertainty
What you still do not know, written explicitly so it is not filled with false precision.
Vera Vance does not know whether a geofence already limits VPN logins, so that stays an open question.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
Vulnerability
A weakness in a system, process, or person that makes a loss easier to cause.
An unpatched VPN appliance is a vulnerability even before anyone exploits it at Meridian Space & Robotics.
Connect the ideas: Threat, vulnerability, and risk: the core equation · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Web application firewall
A control that inspects web application traffic and applies rules to detect or block unwanted requests, often including known attack patterns.
A WAF rule may buy time against the telemetry-parser exploit; it does not patch Chronos Hub.
Connect the ideas: Networks in one request: DNS, TCP, TLS, and HTTP · Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure
Extended detection and response
A vendor category for stitching multiple telemetry sources; it is not automatic coverage of every outcome.
Buying XDR does not by itself prove Chronos Hub telemetry exports would be detected.
Connect the ideas: Security product categories are capabilities, not outcomes · Agentic SOC architecture: autonomous triage vs human-gated containment
Zero trust
An architecture approach that grants no implicit trust from network location or asset ownership and evaluates access to resources using identity, device, and other context.
Zero trust does not mean “VPN is obsolete”; it means VPN membership is not authorization to data.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Agentic SOC architecture: autonomous triage vs human-gated containment
Zero trust network access
Access that brokers application connectivity per identity and policy instead of placing users on a flat network.
ZTNA to the Propulsion testbench is still not authorization to export Chronos Hub customer telemetry.
Connect the ideas: Least privilege, defense in depth, and Zero Trust boundaries · Security product categories are capabilities, not outcomes
No matches yet. Try a shorter word or the expanded acronym.
