Everything for Security Engineers
Security engineers write advisories and incident reports that must be precise under pressure — vague language in a CVE write-up or a breach notification has real consequences. This hub covers the vocabulary, grammar, and interview and blog resources for that register, plus a link into the full security vocabulary cluster.
Vocabulary sets
Grammar & writing
Interview prep
Related deep-dive hub
Blog articles (4)
- Compliance English: Audit, Remediation, and Certification Vocabulary
Learn the English vocabulary for IT compliance and audits — control, finding, remediation, attestation, and certification terms explained for IT professionals.
- DevSecOps English: Security Shift-Left and Threat Vocabulary
Learn the English vocabulary for DevSecOps — shift-left security, threat modelling, SAST/DAST, secrets management, and supply chain security terms explained.
- Security Architecture Vocabulary: Threat Modeling, STRIDE, Zero Trust, and Defense-in-Depth
Essential security architecture vocabulary for engineers and architects: threat modeling, STRIDE, PASTA, attack trees, trust boundaries, attack surface analysis, zero-trust design, and security design review language.
- SOC Analyst Vocabulary: SIEM, Threat Hunting, SOAR, IOC/IOA, and Alert Triage
Master SOC analyst vocabulary for IT security professionals: SIEM, alert triage, threat hunting, IOC, IOA, SOAR playbooks, threat intelligence, escalation language, and shift handoff communication.
Other role hubs
Explore more
Browse every exercise category, or search the full site.
Frequently Asked Questions
What is a Security Information and Event Management (SIEM) system, and how does it differ from an Intrusion Detection System (IDS)?
A SIEM collects and analyzes security logs from various sources – servers, firewalls, applications – to detect anomalies and potential threats. An IDS primarily monitors network traffic for malicious activity signatures and alerts on suspicious patterns. SIEMs provide a broader view of your environment by correlating events across different systems, while an IDS focuses on specific attack types.
Explain the concept of 'least privilege' access control – why is it important in securing applications?
'Least privilege' dictates that users and processes should only have the minimum level of access necessary to perform their tasks. This drastically reduces the potential damage from compromised accounts or vulnerabilities, limiting an attacker's ability to escalate privileges or access sensitive data beyond what's required for legitimate operations.
What are Web Application Firewalls (WAFs), and how do they protect against common web attacks like SQL injection?
A WAF is a security device that sits in front of a web server, inspecting incoming HTTP traffic for malicious patterns. It can detect and block attacks such as SQL Injection by analyzing the request's syntax and parameters, preventing attackers from manipulating database queries or injecting harmful code.
What is a vulnerability scan, and what are some common types of vulnerabilities it identifies?
A vulnerability scan automatically assesses systems for known weaknesses by comparing them against databases of identified vulnerabilities. Common findings include outdated software versions, misconfigured security settings, exposed services, and insecure coding practices like cross-site scripting (XSS).
Describe the purpose of a Security Orchestration, Automation and Response (SOAR) platform.
A SOAR platform automates many security tasks like incident response, threat intelligence enrichment, and workflow management. It streamlines processes by connecting various security tools and systems to reduce manual effort and improve the speed and efficiency of responding to security incidents.
What is 'zero-trust' security architecture, and how does it differ from traditional perimeter-based security?
Zero-trust operates on the principle of 'never trust, always verify,' assuming that no user or device can be inherently trusted, regardless of location. Unlike traditional models which focus on securing a defined network perimeter, zero-trust requires continuous authentication and authorization for every access request.
What is a Security Operations Center (SOC), and what are its key functions?
A SOC is a centralized team responsible for monitoring, detecting, analyzing, and responding to security threats. Its primary functions include threat intelligence gathering, incident management, vulnerability assessment, and continuous security improvement programs within an organization.
What's the difference between a penetration test and a red team exercise?
A penetration test simulates an attack against a system to identify vulnerabilities, typically performed by a single external security expert. A red team exercise involves a coordinated group simulating real-world attacks, often mimicking advanced persistent threats (APTs) with more complex tactics.
Explain the role of Hash-based Message Authentication Codes (HMACs) in securing data transmission.
HMACs are cryptographic algorithms that generate a unique fingerprint – a hash – of a message, along with a secret key. This allows the receiver to verify if the message was altered during transit and that it originated from a trusted source by recomputing the HMAC using the same key.
What is DevSecOps, and how does it integrate security into the software development lifecycle?
DevSecOps combines DevOps principles with security practices to automate security controls throughout the entire software development pipeline – from design to deployment. This proactive approach shifts security left, embedding security testing and monitoring early on instead of as an afterthought.