A
- ACME
Automatic Certificate Management Environment (RFC 8555): a protocol for requesting, validating, renewing and revoking certificates automatically.
Automated issuance turns certificate replacement from a project into a routine change, which matters more as maximum certificate lifetimes shorten.
Used inCryptographic Infrastructure
- AD CS
Active Directory Certificate Services: the Windows certificate authority role that issues certificates used to authenticate users and machines in a domain.
Misconfigured certificate templates and enrolment rights are catalogued as ESC1 onwards; several let an ordinary account obtain a certificate that authenticates as someone else.
Used inOffensive Security
- Anycast
Announcing the same IP address from several locations so that each client reaches a nearby one through normal routing.
Anycast spreads load and absorbs failures, but a routing change can move a client to a different location mid-session.
Used inEdge Infrastructure
B
- BGP
Border Gateway Protocol: the routing protocol networks use to announce which IP address ranges they can deliver traffic to.
BGP accepts announcements by default, so a mistaken or malicious route can redirect traffic until other networks filter it.
Used inEdge Infrastructure
C
- CBOM
Cryptographic bill of materials: an inventory of the algorithms, keys, certificates and libraries a system uses, and where each is used.
A migration plan starts from this inventory. Code, configuration, HSMs and third-party services each hide cryptography that a network scan cannot see.
Used inCryptographic InfrastructureStandards and regulatory dates
- Certificate authority (CA)
An entity that issues certificates binding a public key to an identity.
Browsers and operating systems ship the roots of public CAs; a private CA's root is accepted only where you install it. Each needs its own controls.
- Certificate Transparency
Public, append-only logs of issued certificates, specified in RFC 6962 and RFC 9162, that let domain owners see every certificate issued for their names.
Major browsers expect publicly trusted certificates to be logged, so monitoring the logs for your domains is a simple way to spot mis-issuance.
- Coordinated vulnerability disclosure
A process in which a vulnerability is reported privately to the vendor and published once a fix is available or an agreed deadline passes.
ISO/IEC 29147 describes disclosure from the vendor's side. A published policy tells researchers what to expect before they report.
- CP/CPS
Certificate policy and certification practice statement: documents that set and describe how a CA issues and manages certificates.
Auditors and relying parties read the CPS to learn what the CA actually does, so it has to match practice rather than intention.
- CRL
Certificate revocation list: a signed list, published by a certificate authority, of the certificates it has revoked before they expire.
Relying systems must fetch and cache CRLs; when they cannot, they have to decide whether to accept or reject the certificate.
Used inEdge Infrastructure
- Crypto-agility
The ability to replace algorithms, keys and certificates through a tested process without redesigning the system.
Agility is shown by a rehearsed replacement, not by a configuration option. A current inventory and automated issuance come first.
Used inHop mapStandards and regulatory datesYou are not migrating to post-quantum. Your CDN is.
- CVSS
Common Vulnerability Scoring System: a FIRST standard that rates the technical severity of a vulnerability on a scale from 0 to 10.
A CVSS score describes severity, not the risk to your organisation; exposure and business impact still decide what to fix first.
Used inOffensive Security
- CWE
Common Weakness Enumeration: a community catalogue of software and hardware weakness types, maintained by MITRE.
Mapping a finding to a CWE names the underlying mistake, so the same class of flaw can be looked for and prevented elsewhere.
Used inOffensive Security
D
- Detection rule
Logic that matches telemetry against a behaviour and raises an alert.
A rule is validated only when it has fired on the behaviour it targets in your environment. A rule that has never been tested is an assumption.
E
- EDR
Endpoint detection and response: software on servers and workstations that records activity and can detect and contain threats on the device.
What EDR records depends on the product and its policy, so the same technique can be visible on one host and invisible on another.
Used inDefensive Operations
- Entra ID application consent
Permission that a user or administrator grants an application in Microsoft Entra ID (formerly Azure AD) to read data or act on their behalf.
Broad consent, or consent to a malicious application, gives lasting access without a password; limiting who may consent and reviewing grants closes that path.
Used inOffensive Security
H
- Harvest now, decrypt later
Recording encrypted traffic today in the expectation of decrypting it once a sufficiently capable quantum computer exists.
It is why key establishment is usually migrated before signatures: a recorded session cannot be re-protected after the fact.
- Heartbeat
A periodic signal showing that a process or person is still active; a missed heartbeat starts expiry.
The interval and the grace period before expiry are design decisions. Both should be written down and tested.
Used inCheck-in timer
- HSM
Hardware security module: a dedicated device that protects keys and performs cryptographic operations without exposing key material.
An HSM protects keys only as well as the procedures around it: who can authorise use, how backups are made and how the device is recovered.
- HSTS
HTTP Strict Transport Security: a response header telling browsers to use only HTTPS for a site.
HSTS takes effect only after a browser has seen the header once, unless the domain is on the browsers' preload list.
Used inTLS observation
- Hybrid key exchange
Key agreement that combines a classical method with a post-quantum one, so the session stays protected while either remains secure.
Hybrid key exchange addresses recorded traffic being decrypted later. It does not change how the server's certificate is authenticated.
Used inTLS observationHop mapYou are not migrating to post-quantum. Your CDN is.
K
- KEM
Key encapsulation mechanism: a method for two parties to establish a shared secret during key agreement.
In TLS, a post-quantum KEM can be combined with the classical Diffie–Hellman exchange or, eventually, take its place.
Used inHop mapYou are not migrating to post-quantum. Your CDN is.
- Kerberos delegation
A Windows domain feature that lets a service act on a user's behalf when it calls another service, in unconstrained, constrained or resource-based form.
Delegation that is broader than needed lets a compromised service impersonate users to other systems, which is why it appears in many domain attack paths.
Used inOffensive Security
- Key ceremony
A scripted, witnessed procedure for generating or using a high-value key, often requiring several of a set of custodians (M of N) to be present.
The script, attendance and recorded evidence are what allow an auditor or relying party to trust the result later.
M
- MITRE ATT&CK
A public knowledge base of adversary tactics and techniques, based on observed intrusions and organised by stage.
Mapping assessment steps and detections to ATT&CK technique IDs gives offensive and defensive teams a shared vocabulary for coverage.
Used inOffensive SecurityDefensive OperationsDetection worksheet
- ML-DSA
Module-Lattice-Based Digital Signature Algorithm, standardised by NIST in FIPS 204 for post-quantum signatures.
ML-DSA keys and signatures are considerably larger than RSA or ECDSA equivalents, which affects certificate chains, handshake size and constrained devices.
- ML-KEM
Module-Lattice-Based Key-Encapsulation Mechanism, standardised by NIST in FIPS 203 for post-quantum key establishment.
ML-KEM protects key establishment only. Certificates and other signatures need a post-quantum signature scheme such as ML-DSA or SLH-DSA.
O
- OCSP stapling
A TLS server attaches a recent, CA-signed revocation response to the handshake, so clients do not have to ask the CA themselves.
Some public CAs have stopped operating OCSP and publish revocation lists instead, so check what your CA supports before depending on it.
- Offline root
A root CA whose key is kept on a device with no network connection and used only to sign subordinate CAs or revocation lists.
Keeping the root offline limits its exposure, but it makes ceremonies, custody records and recovery rehearsals essential.
P
- PKCS#11
A standard programming interface that applications use to ask a hardware security module or token to perform key operations without exposing the key.
Integration through PKCS#11 keeps private keys inside the HSM; its configuration decides which applications may use which keys.
Used inCryptographic Infrastructure
- PKI
Public key infrastructure: the policies, systems and roles that issue, manage and revoke digital certificates.
Most PKI failures are operational: an expired certificate, an untested renewal or an owner nobody can name. The mathematics is rarely the weak point.
Used inCryptographic InfrastructureReference PKIInfrastructure walkthrough
- Provenance
Records of how, where and from what an artifact was built.
Provenance is useful when it is signed and the consumer can verify it, so that a missing or altered record is detected.
Used inBinary and Supply ChainThe agents can attack. They cannot yet vouch for what they found.
R
- Relying party
A system or person that accepts a certificate and must check it before trusting the identity it asserts.
Relying parties decide whether name, expiry and revocation checks happen at all. A well-run CA does not help a client that skips them.
Used inCryptographic diagramsReference PKIYou are not migrating to post-quantum. Your CDN is.
- Reproducible build
A build that produces bit-for-bit identical output from the same source, so anyone can rebuild an artifact and compare it.
Comparing a release with an independent rebuild, or a release archive with the tagged source, exposes changes that never went through review.
Used inBinary and Supply Chain
- RPKI
Resource Public Key Infrastructure: signed records stating which network may originate routes for an IP address range, so others can reject invalid announcements.
Route origin validation stops some hijacks, but only where networks publish records and enforce them.
Used inEdge Infrastructure
- Rules of engagement
The written agreement that sets an assessment's scope, boundaries, timing and stopping conditions.
Rules of engagement protect both sides: they record what is authorised, who can stop the work and how an emergency is escalated.
Used inOffensive SecurityScope plannerThe agents can attack. They cannot yet vouch for what they found.
S
- SBOM
Software bill of materials: an inventory of the components in a piece of software.
An SBOM generated from source lists what was declared; one recovered from the shipped artifact shows what was delivered. The two can differ.
Used inBinary and Supply Chain
- Sequential work
Computation where each step needs the previous result, so extra processors cannot finish it much faster.
Time-lock constructions rely on sequential work, but the elapsed time still depends on the fastest hardware an attacker can use.
Used inTime-lock demonstration
- SIEM
Security information and event management: a system that collects logs and events from many sources and runs detections over them.
A detection can only see the data the SIEM actually receives; a missing or delayed source looks like a quiet period.
Used inDefensive Operations
- Sigma
An open, vendor-neutral format for detection rules that can be converted into the query languages of different SIEM platforms.
Keeping rules in a portable format, in version control with tests, is the basis of detection-as-code.
- SLH-DSA
Stateless Hash-Based Digital Signature Algorithm, standardised by NIST in FIPS 205 for post-quantum signatures.
Its security rests on hash functions rather than lattices, which makes it a conservative alternative to ML-DSA at the cost of larger signatures and slower signing.
- SLSA
Supply-chain Levels for Software Artifacts: an OpenSSF framework that defines increasing levels of build integrity and provenance.
A SLSA level describes how an artifact was built. It says nothing about whether the code itself is secure.
Used inBinary and Supply Chain
- SOC
Security operations centre: the people and process that monitor alerts, investigate them and coordinate the response.
Alert quality and runbooks decide how much a SOC can act on; more alerts without context slow it down.
Used inDefensive Operations
T
- Telemetry
Logs and events collected from systems, which detections and investigations depend on.
A detection cannot fire on data that is never collected. Coverage reviews start with which sources reach the platform and how long they are kept.
- Threat emulation
Reproducing the techniques of a specific adversary, or class of adversary, to test whether defences prevent, detect and respond to them.
Run with the defending team as a purple-team exercise, each step can be checked against the telemetry and alerts it should produce.
- TLPT
Threat-led penetration testing: intelligence-driven testing of critical live production systems, defined for EU financial entities in DORA and the TIBER-EU framework.
Whether TLPT is required, and how often, depends on the entity and its supervisor; DORA and its technical standards set out the criteria.
- TLS
Transport Layer Security: the protocol that authenticates servers and encrypts traffic for HTTPS and many other services.
TLS 1.3 removed many legacy options, but older versions and cipher suites often remain on internal services long after the public edge is upgraded.
Used inTLS observationHop mapInfrastructure walkthroughYou are not migrating to post-quantum. Your CDN is.
- Triage
The first assessment of an alert, deciding whether and how to respond.
Clear triage criteria decide whether an alert reaches an investigator at all. Vague criteria become queues nobody works.
V
- VEX
Vulnerability Exploitability eXchange: a statement of whether a known vulnerability in a component affects a product, such as not affected, affected, fixed or under investigation.
A VEX statement lets a vulnerability in a bundled library be recorded as not affecting the product when the vulnerable code cannot be reached, with the reason stated.
Used inBinary and Supply Chain