Glossary

Definitions as they are used here. Configuration security has a vocabulary that looks settled and is not: several of these words mean materially different things depending on whether the speaker is an auditor, an engineer or a vendor. Where that is true, the entry says so rather than quietly choosing a side.

Attack surface

Everything on a machine that can accept input from somewhere else: listening sockets, local interfaces, files other processes can write, hardware ports, scheduled jobs, installed interpreters. Used inconsistently — some people mean only network-reachable entry points, others include every locally exploitable path. The difference matters most on hosts where the realistic adversary is already a low-privileged local account.

Attestation

A machine producing evidence about its own state that a remote party can check, typically anchored in hardware so the evidence is hard to forge from software. Distinct from a configuration scan, which asks the machine a question and believes the answer.

Baseline

The configuration a machine is supposed to be in. Ambiguous between two very different senses: the reference baseline (the standard the organisation has written down) and the as-built baseline (the state a particular host was actually in when it was accepted into service). Auditors usually mean the first and engineers usually mean the second, and comparisons between them fail silently.

Benchmark

A published catalogue of specific configuration checks for a specific platform, usually maintained by a standards body or the platform vendor. A benchmark is not a baseline: it is a menu from which an organisation selects, because the full set typically contains items no real workload can tolerate.

Bits of entropy

A measure of how many equally likely possibilities a secret was drawn from, expressed as a base-two logarithm. A property of the generation procedure, not of the string — the same characters can carry high entropy if produced by a random generator and almost none if chosen by a person.

Compensating control

A different control put in place because the intended one cannot be applied. The term has been degraded almost to meaninglessness through use as a synonym for “we did not do it and wrote a sentence explaining why”. A genuine compensating control is one somebody could demonstrate working; if nobody has tested it, it is a note, not a control.

Configuration drift

The divergence over time between a machine’s actual state and its intended one. Sometimes used to mean any difference at all, including differences that were never converged in the first place — worth separating, since a host that changed and a host that was always different call for different remedies.

Configuration item

An individually addressable piece of a machine’s state: a file, a setting, an installed package, a user account, a service’s enabled status. The unit that a check evaluates and a configuration system enforces.

Convergence

Repeatedly applying a desired state until the machine matches it, then continuing to reapply on a schedule so that any divergence has a bounded lifetime. The structural alternative to detecting drift and fixing it by hand.

Desired state

A machine-readable description of what a host should look like, written so that a tool can compare it against reality and act on the difference. The distinguishing feature is that it describes an end state rather than the steps to reach one.

Deviation

A single configuration item that does not match the baseline. Called a finding by auditors, a diff by engineers and a violation by compliance tooling; these are the same object viewed from three positions with different consequences attached.

Exception

A deviation that has been examined and accepted, ideally with a named owner, a stated reason and a date for review. The difference between an exception and an unnoticed deviation is entirely organisational — the machine cannot tell them apart.

Firmware

Software that runs beneath or alongside the operating system: platform firmware, device controllers, management processors. Frequently outside the reach of the tools that manage everything else on the host, which is why it tends to be the oldest code on any given machine.

Golden image

A machine image built once and used as the origin for many hosts. Two incompatible uses: some organisations mean a fully configured image that hosts boot into unchanged, others mean a minimal starting point that provisioning then customises heavily. The security properties are quite different, since only the first makes the image the actual source of a host’s configuration.

Hardening

Reducing what a machine can do, so that less of it is available to an attacker. Used loosely to mean anything that improves a host’s security, including installing additional software — which is close to the opposite of the original sense, since hardening in the strict reading is subtractive.

Idempotence

The property that applying an operation twice leaves the same result as applying it once. The requirement that makes continuous convergence safe; without it, reapplying a desired state accumulates changes rather than maintaining one.

Immutable infrastructure

The practice of never modifying a running host: changes are made by building a new instance from a new image and replacing the old one. Eliminates drift by construction, and is unavailable to most of the machines that need it most, because physical, embedded and licensed hosts cannot be replaced on that cadence.

Least functionality

The principle that a machine should have installed and enabled only what its role requires. Easy to state, hard to audit, because determining what a role “requires” is a question about the workload rather than about the host.

Managed appliance

A machine sold as a sealed product, where the vendor retains control of the underlying operating system and exposes only a defined management surface. The practical consequence is that the owner can neither modify nor fully enumerate what is running.

Measured boot

A boot sequence in which each stage records a measurement of the next before handing control to it, producing a chain of values that can later be checked. Distinct from secure boot, which refuses to load components that fail a signature check. Measured boot observes; secure boot enforces.

Out-of-band management

A separate controller on the same physical machine, with its own processor, network interface and account database, able to power and configure the host independently of its operating system. Effectively a second computer inside the first, and often the only part of an otherwise untouchable host that can be hardened.

Passphrase

A secret made of several words rather than a string of characters. Its entropy comes from the number of words and the size of the list they were drawn from, and only if the drawing was actually random — a phrase a person composed is not a passphrase in this sense.

Profile

A named subset of a benchmark, usually distinguishing a conservative set of checks suitable for general systems from a stricter set that assumes a restricted-purpose host. Profile names are not comparable between benchmarks; a “level one” in one catalogue implies nothing about a “level one” in another.

Remediation mode

A configuration tool applying fixes rather than only reporting differences. The distinction from audit mode is the whole risk profile of the tool: in audit mode its worst failure is a wrong report, in remediation mode its worst failure is an identical wrong change on every host at once.

Secure default

A setting whose value is restrictive in the absence of any decision, inherited by every machine built from the same origin. Contrasted with documented guidance, which achieves the same end state only when somebody performs an action.

Snowflake

A host whose configuration exists nowhere except on the host itself, usually because it was built or modified by hand and never brought under management. The population of snowflakes in an estate is a better predictor of incident difficulty than most measurable properties of the estate.

Supported configuration

The set of configurations a vendor will honour a support contract for. The boundary of what a hardening programme is contractually permitted to change, and — in most organisations — a document nobody has read recently, so the restriction actually being observed is broader than the one that was agreed.

Unmanaged host

A machine no configuration system reaches, whether because it was excluded, the agent was removed, or it never supported one. Distinct from a non-compliant host, which is known and wrong; an unmanaged host is simply unknown, and the two are frequently counted together in reporting that should separate them.