Security Architecture Glossary
A single reference for the acronyms and terms introduced across this section — link here instead of re-deriving a definition from an earlier page.
| Term | Meaning | Defined in |
|---|---|---|
| Authentication | Confirming who is making the request | Identity & Access Management (IAM) |
| Authorization | Confirming what an authenticated identity is allowed to do | Identity & Access Management (IAM) |
| MFA | Multi-factor authentication — a second proof of identity beyond a password | Identity & Access Management (IAM) |
| RBAC / ABAC | Role-based / attribute-based access control models | Identity & Access Management (IAM) |
| SSO | Single sign-on — one login trusted across multiple applications | Identity & Access Management (IAM) |
| Just-in-time access | Temporary, approved elevation of privilege for a specific task | Identity & Access Management (IAM) |
| Zero trust | Verify every request regardless of network location; never trust by default | Zero Trust & Network Segmentation |
| Segmentation | Dividing a network into zones with controlled traffic between them | Zero Trust & Network Segmentation |
| Default-deny | Blocking all traffic unless explicitly allowed | Zero Trust & Network Segmentation |
| Lateral movement | An attacker moving from an initial foothold to other systems on the same network | Zero Trust & Network Segmentation |
| mTLS | Mutual TLS — both client and server verify each other’s identity | Zero Trust & Network Segmentation |
| NIST SP 800-207 | The standard defining Zero Trust Architecture | Zero Trust & Network Segmentation |
| Threat model | A structured map of how a system could be attacked | Threat Modeling & Risk Assessment |
| STRIDE | Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege | Threat Modeling & Risk Assessment |
| Trust boundary | A point where data crosses from one trust level to another | Threat Modeling & Risk Assessment |
| Risk score | A ranking based on likelihood and impact, used to prioritize mitigation | Threat Modeling & Risk Assessment |
| KMS | Key Management Service — manages key generation, storage, rotation, and access | Encryption & Key Management |
| HSM | Hardware Security Module — dedicated hardware that protects key material | Encryption & Key Management |
| Key rotation | Periodically replacing keys/certificates so a compromised one has limited lifetime value | Encryption & Key Management |
| Envelope encryption | Encrypting a data key with a master key, rather than using the master key directly on data | Encryption & Key Management |
| Framework | A structured set of security practices/requirements (ISO 27001, NIST CSF, PCI-DSS, SOC 2) | Security Governance & Compliance Frameworks |
| Control | A specific, implemented requirement mapped to a framework (e.g. key rotation) | Security Governance & Compliance Frameworks |
| Attestation / certification | Formal, independently verified evidence of compliance | Security Governance & Compliance Frameworks |
| Control owner | The accountable person/team responsible for a specific control | Security Governance & Compliance Frameworks |
| SAST | Static Application Security Testing — scans source code without running it | DevSecOps & Secure SDLC |
| DAST | Dynamic Application Security Testing — tests a running application from the outside | DevSecOps & Secure SDLC |
| SCA | Software Composition Analysis — finds known-vulnerable third-party dependencies | DevSecOps & Secure SDLC |
| Secrets scanning | Detecting credentials/keys accidentally committed to source control | DevSecOps & Secure SDLC |
| SOC | Security Operations Center — the team monitoring and responding to security events | Incident Response & Security Operations |
| SIEM | Security Information and Event Management — aggregates logs and raises alerts | Incident Response & Security Operations |
| Playbook | A pre-written, rehearsed response procedure for a specific incident type | Incident Response & Security Operations |
| Containment | Isolating an affected system/account to stop an incident from spreading | Incident Response & Security Operations |
| Post-incident review | A blameless retrospective after an incident, producing concrete follow-up actions | Incident Response & Security Operations |
| CSPM | Cloud Security Posture Management — continuous scanning for cloud misconfigurations | Cloud Security Posture & Perimeter Defense |
| WAF | Web Application Firewall — filters malicious HTTP traffic at the edge | Cloud Security Posture & Perimeter Defense |
| DDoS protection | Defenses against distributed denial-of-service traffic floods | Cloud Security Posture & Perimeter Defense |
| Configuration drift | A resource’s settings changing over time away from its originally secure state | Cloud Security Posture & Perimeter Defense |
| Private endpoint | A network interface giving a resource a private IP inside a VNet, removing its public exposure | Zero Trust & Network Segmentation |
| Customer-managed key (CMK) | An encryption key held and rotated in the customer’s own Key Vault, rather than a provider-managed key | Encryption & Key Management |
| Log Analytics workspace | The data store underlying Azure Monitor and Microsoft Sentinel, where telemetry and logs are correlated | Incident Response & Security Operations |
| Microsoft Sentinel | Azure’s cloud-native SIEM, built on a Log Analytics workspace | Incident Response & Security Operations |
| Azure Front Door / WAF policy | Azure’s global entry point with an attachable Web Application Firewall policy for edge filtering | Cloud Security Posture & Perimeter Defense |
| Managed identity | An identity Azure automatically manages for a resource (e.g. a Function App), used instead of a stored credential | Identity & Access Management (IAM) |