Glossary
Purpose
This page defines key terms used throughout the Scheol Security Lab documentation.
The objective is to:
- ensure consistent terminology
- avoid ambiguity or misinterpretation
- support readability for external reviewers
Only project-relevant terms are included.
Scope
This glossary includes:
- project-specific terms (Heaven, Hell, etc.)
- security concepts used with a specific meaning
- internal naming conventions
It does not include:
- generic IT definitions (unless ambiguity exists)
- overly detailed explanations
Terms
Heaven
Public-facing environment hosted on external infrastructure (VPS).
- Contains exposed services (web, repositories, applications)
- Considered low trust / high exposure
- Primary attack surface of the lab
Hell
Internal environment hosted on local infrastructure (Proxmox).
- Contains core systems, monitoring, and future security controls
- Considered high trust but not inherently secure
- Intended to centralize control and visibility
Trust Zone
Logical grouping of systems based on:
- exposure level
- sensitivity
- required security controls
Used to enforce segmentation and reduce implicit trust.
Bastion
Controlled entry point used for administrative access to systems.
- centralizes authentication
- enables logging and traceability
- reduces direct exposure of internal systems
Currently planned but not fully implemented.
Reverse Proxy
Public-facing component routing incoming HTTP/HTTPS traffic to backend services.
- acts as a controlled entry point
- critical for exposure management
- misconfiguration is directly linked to R-001
Control
A measure that reduces the likelihood or impact of a risk.
Controls can be:
- preventive
- detective
- corrective
Defined and tracked in the Control Framework.
Risk (R-XXX)
An identified scenario where a threat may impact the system.
Examples:
- R-001 → exposure via misconfiguration
- R-002 → application compromise
- R-003 → credential compromise
Control (C-XXX)
A defined security measure addressing one or more risks.
- documented individually
- linked to risks and validation methods
- tracked in Control Status
Verification Scenario (V-XXX)
A structured test used to validate control effectiveness.
- simulates a threat or misuse case
- produces observable results
- supports validation and detection assessment
Evidence (E-XXX)
A verifiable artifact demonstrating:
- control implementation
- validation activity
- monitoring output
Used to support auditability.
Detection Gap
A situation where:
- a threat is not detected
- visibility is incomplete
- detection mechanisms are missing or unvalidated
Tracked in Known Detection Gaps.
Residual Gap
A remaining security weakness after considering existing controls.
- may be accepted temporarily
- must be documented and tracked
Defined in Residual Gaps.
Transitional State
A condition where:
- a component or control is partially implemented
- the target architecture is not yet fully reached
This reflects the iterative nature of the lab.
Naming Conventions
| Prefix | Meaning |
|---|---|
| R-XXX | Risk |
| C-XXX | Control |
| V-XXX | Verification Scenario |
| E-XXX | Evidence |
| DG-XXX | Detection Gap |
Governance Rule
Any new term used across multiple documents must be defined here.
Avoid:
- duplicate definitions
- inconsistent terminology
- undocumented acronyms
Current Maturity
At the current stage, terminology management is considered established but evolving.
Established
- core project-specific terms defined
- consistent naming conventions
- alignment across major sections
In Progress
- refinement of definitions
- removal of ambiguities
- alignment with evolving architecture and controls
Planned / Next Phase
- extension as new concepts are introduced
- improved consistency across all documentation
- support for external readability and audit use cases
This glossary ensures a shared and unambiguous understanding of key concepts used in the Scheol Security Lab.