Microsoft's enterprise directory and identity platform, combining LDAP as its directory protocol with Kerberos for authentication, DNS for service location, Group Policy for machine configuration, and certificate services for PKI — the dominant identity provider in enterprise environments and a primary integration target for Linux infrastructure via SSSD and realmd.

The universal symmetric block cipher, standardised by NIST in 2001, that underpins virtually all data-at-rest and data-in-motion encryption in modern infrastructure — from TLS record encryption and LUKS disk encryption to hardware memory protection in TDX and SEV-SNP.

A host-based file integrity monitoring tool that builds a cryptographic baseline database of filesystem attributes at a known-good state and reports any deviation on subsequent checks — providing offline, scheduled detection of unauthorised file modifications, additions, and deletions.

A path-based mandatory access control LSM, the default on Ubuntu and Debian, that confines programs via per-application profiles specifying which filesystem paths, capabilities, and network operations they are allowed — trading SELinux's label precision for significantly simpler profile authoring.

A hardened, minimally-exposed host placed at the network perimeter that acts as the sole authorised ingress point for administrative access to an otherwise private network segment, funnelling all privileged connections through a single logged and controlled gateway.

A tool and specification for treating an OCI container image as the full operating system: the same image that runs in CI is deployed, updated, and rolled back on physical and virtual machines using standard container registry infrastructure.

A pre-provisioned account with elevated privileges held outside the normal access control and PAM workflow, reserved exclusively for genuine emergencies when standard access mechanisms are unavailable, designed so that its use is always immediately detectable, attributable, and reviewable.

A CNCF project that automates the full lifecycle of X.509 certificates in Kubernetes — issuance, renewal, and revocation — by expressing certificates as native Kubernetes resources and integrating with ACME, Vault, private CAs, and other backends through a pluggable issuer model.

A Linux kernel mechanism that organises processes into a tree of named groups and applies resource controllers to each group — limiting CPU, memory, I/O, and process count — forming the resource accounting and enforcement substrate beneath every container runtime and systemd service on modern Linux.

A Linux filesystem layer that composes a read-only, content-addressed, fs-verity-verified directory tree from a compact EROFS metadata image and a shared object store, giving container images and OS trees the integrity guarantees of dm-verity without sacrificing file-level sharing.

A Kubernetes cluster in which every node — including control plane nodes — runs inside a Confidential VM, and where node admission, network traffic, persistent storage, and cluster state are all encrypted and attestation-gated, so that the infrastructure operator is fully excluded from the trusted computing base.

A CNCF project that brings hardware-backed confidential computing to Kubernetes, wrapping each pod in a TEE and treating the Kubernetes control plane itself as untrusted.

A hardware capability of NVIDIA Hopper (H100) and later GPUs that extends the Trusted Execution Environment boundary to GPU memory and computation, providing hardware-encrypted AI/ML processing with GPU-level attestation — protecting model IP and training data from the infrastructure operator during GPU workloads.

A virtual machine whose memory, CPU state, and execution are cryptographically protected from the host hypervisor, the cloud operator, and co-tenants at the hardware level, using TEE technology such as TDX or SEV-SNP.

A signed, periodically published list of X.509 certificate serial numbers that a Certificate Authority has revoked before their natural expiry — the original revocation mechanism in PKI, providing offline-capable revocation checking at the cost of staleness and size.

An open framework maintained by FIRST for communicating the severity characteristics of software vulnerabilities through a numerical score from 0 to 10 — widely used by vulnerability databases, scanners, and compliance frameworks, but consistently misused when its Base score is treated as a risk score rather than the severity-only measurement it is designed to be.

A key exchange protocol family that allows two parties to establish a shared secret over a public channel without prior key material — the foundational primitive for forward secrecy in TLS, IPsec IKEv2, SSH, and WireGuard, being replaced by ML-KEM in post-quantum deployments.

A Linux device mapper target that provides transparent, read-only integrity verification for block devices by computing and verifying a Merkle tree of block-level hashes on every read — the integrity mechanism behind Android Verified Boot, Chrome OS, and immutable OS image deployments.

A kernel subsystem that allows sandboxed, JIT-compiled programs to run inside the Linux kernel at hook points covering networking, tracing, and security — enabling high-performance observability, network policy enforcement, and custom security policy without kernel module development or kernel patches.

A family of asymmetric cryptographic algorithms whose security rests on the elliptic curve discrete logarithm problem, offering equivalent security to RSA at dramatically smaller key sizes — the dominant basis for key exchange and signatures in TLS, SSH, and code signing today.

The dominant digital signature algorithm in TLS certificates, code signing, and blockchain applications, built on elliptic curve cryptography — providing smaller signatures than RSA at equivalent security, but requiring careful implementation and a cryptographically strong random nonce per signature.

A Kubernetes operator that synchronises secrets from external secret management systems — Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and others — into native Kubernetes Secret objects, keeping them continuously up to date without application changes.

A Linux application allowlisting daemon, shipped with RHEL and Fedora, that uses the kernel's fanotify API to intercept every file execution and access event and permit or deny it based on a trust database seeded from the RPM package database and evaluated against a configurable rule set.

A family of open authentication standards from the FIDO Alliance and W3C that replaces passwords with hardware-bound public-key credentials — eliminating phishing, credential stuffing, and replay attacks by binding each credential cryptographically to the specific origin it was registered with.

The dynamic firewall daemon on RHEL, Fedora, and related distributions that manages nftables (formerly iptables) rules through a D-Bus API and a zone-based policy model, providing runtime rule changes without connection disruption and a consistent interface across NetworkManager, Kubernetes, and container runtimes.

A Linux kernel filesystem feature that makes individual files immutable and content-addressable by building a Merkle tree of their content at enable time and verifying reads against it — providing per-file integrity guarantees used by composefs, IMA, and Android's APK verification without requiring a separate block device.

The dominant bootloader on x86 Linux systems, responsible for locating and loading the kernel and initrd from a variety of filesystems and storage configurations, with optional support for measured boot via TPM.

A deterministic function that maps arbitrary-length input to a fixed-length digest with three security properties — preimage resistance, second preimage resistance, and collision resistance — forming the foundational primitive beneath signatures, MACs, key derivation, integrity verification, and content-addressed storage.

A construction that combines a cryptographic hash function with a secret key to produce a message authentication code — providing both integrity and authenticity guarantees that a plain hash cannot, used in TLS finished messages, JWT signatures, TOTP, API request signing, and key derivation.

A tamper-resistant hardware device that generates, stores, and performs cryptographic operations with keys that never leave the device boundary in plaintext, providing a hardware root of trust for PKI, signing infrastructure, payment systems, and regulated key management.

A Linux kernel subsystem that hashes files at access time, records those measurements in a TPM-anchored log, and optionally enforces that only files with known-good hashes can be read or executed — extending the static measured boot chain into runtime.

A compressed cpio archive loaded into memory by the Linux kernel before the real root filesystem is mounted, providing early userspace with the drivers, crypto, and tooling needed to unlock encrypted storage, assemble RAID/LVM, fetch network roots, and pivot into the installed OS.

A suite of IETF protocols that provide cryptographic authentication and confidentiality at the IP layer, operating transparently to applications — used for VPN tunnels, host-to-host encryption, and as the data plane for service mesh encryption in Kubernetes via Cilium and similar tools.

The classic Linux firewall and packet filtering framework, built on the Netfilter kernel subsystem, that uses tables of chains and rules to match and action IP packets — the dominant packet filtering tool on Linux from 2001 through the mid-2010s, now largely superseded by nftables but still universally present as a compatibility layer.

A compact, URL-safe token format (RFC 7519) consisting of a base64url-encoded header, payload, and signature — the universal bearer token format for OAuth 2.0 access tokens, OIDC ID tokens, Kubernetes service account tokens, and SPIFFE JWT-SVIDs.

A CNCF project that implements the OCI container runtime interface using lightweight virtual machines rather than Linux namespaces, giving each pod a dedicated kernel and hardware isolation boundary while remaining transparent to Kubernetes and container tooling.

A continuously updated, authoritative list maintained by CISA of CVEs for which there is reliable evidence of active exploitation in the wild — the highest-signal vulnerability prioritisation source available, and a mandatory remediation requirement for US federal civilian agencies under BOD 22-01.

A CNCF project that makes TPM-based remote attestation operationally practical, providing continuous boot and runtime integrity verification of remote nodes with automated revocation and secret delivery.

The stable Kubernetes mechanism (GA since 1.29) for encrypting etcd data at rest using an external key management service — applying envelope encryption with per-object DEKs derived via a KDF from a single seed, requiring only one KMS round-trip at startup rather than per-object, dramatically improving performance over KMS v1.

A CNCF project that extends Kubernetes with custom resources and controllers to schedule, run, and manage KVM-based virtual machines as first-class workloads alongside containers, using the same API, networking, storage, and RBAC infrastructure the cluster already provides.

The standard Linux virtualization stack — KVM accelerates CPU and memory in the kernel, QEMU emulates devices in userspace and drives KVM via ioctl on /dev/kvm; together with libvirt they underpin RHEL, KubeVirt, and OpenShift Sandboxed Containers.

A hierarchical, attribute-based directory access protocol (RFC 4511) for storing and querying identity data — users, groups, hosts, certificates, and policies — the foundational data model beneath Active Directory, FreeIPA, and OpenLDAP, and the query protocol that SSSD, PAM, and most enterprise applications use to resolve identities.

An open-source virtualisation management library and daemon that provides a stable, hypervisor-agnostic API for creating, configuring, and managing virtual machines, storage pools, and virtual networks — the foundational abstraction layer beneath KVM, QEMU, KubeVirt, and OpenStack Nova.

A hook-based kernel framework, merged in Linux 2.6, that allows security policy engines to intercept and make access control decisions at well-defined points in kernel execution paths — without modifying the core kernel — providing the substrate on which SELinux, AppArmor, and BPF LSM are built.

The standard on-disk format for block device encryption on Linux, providing a header-based key management layer on top of dm-crypt that supports multiple unlock methods including passphrases, TPM2, and FIDO2 tokens.

An IEEE standard for hop-by-hop encryption and authentication of Ethernet frames at layer 2, providing wire-speed confidentiality and integrity for all traffic on a LAN segment — including ARP and DHCP that IPsec and TLS cannot protect — using GCM-AES and the MKA key agreement protocol.

A boot process in which each stage cryptographically hashes the next stage and records that measurement into a TPM PCR register before executing it — building a tamper-evident, hardware-anchored log of everything that ran from firmware to userspace, enabling local attestation and remote verification of system integrity.

NIST FIPS 204 (2024) — the primary post-quantum standard for digital signatures, replacing ECDSA and RSA signatures in X.509 certificates, code signing, and authentication protocols, derived from CRYSTALS-Dilithium and based on the Module Learning With Errors and Module Short Integer Solution problems.

NIST FIPS 203 (2024) — the primary post-quantum standard for key encapsulation, replacing ECDH and RSA key transport in TLS and other protocols, derived from the CRYSTALS-Kyber submission and based on the hardness of the Module Learning With Errors problem.

An extension of TLS in which both the client and server present X.509 certificates, giving each side cryptographic proof of the other's identity — the foundational transport-layer mechanism for zero-trust service-to-service authentication.

A network-based automatic LUKS unlock architecture in which a LUKS volume key is cryptographically bound to the reachability of a Tang server — the disk unlocks automatically when the machine is on a trusted network, and is inaccessible when the network is absent — using the McCallum-Relyea zero-knowledge exchange and the Clevis pin framework.

The modern Linux packet classification and firewall framework that replaces iptables, ip6tables, arptables, and ebtables with a single unified subsystem — offering a cleaner rule syntax, atomic ruleset updates, set-based matching, and better performance at scale.

An authorisation delegation framework, standardised in RFC 6749, that allows a resource owner to grant a third-party application limited access to their resources on a server without sharing their credentials — the foundational protocol beneath API authorisation, social login, and machine-to-machine access in modern cloud infrastructure.

A Linux Foundation project that maintains the open standards for container image format, container runtime behaviour, and registry distribution — the three specifications that make containers portable across tools and platforms.

A registry API endpoint, standardised in OCI Distribution Spec v1.1, that returns all artifacts associated with a given image digest via the manifest subject field — enabling supply chain metadata like signatures, SBOMs, and attestations to be attached to and discovered alongside images without mutating the image itself.

A real-time certificate revocation checking protocol (RFC 6960) in which a client queries an OCSP responder for the current status of a specific certificate — and its stapling variant, where the server pre-fetches and caches the signed response to serve it alongside its certificate, eliminating the client's privacy exposure and latency cost.

An identity layer built on top of OAuth 2.0 that adds a standardised ID token, a UserInfo endpoint, and a discovery document — turning OAuth 2.0's authorisation framework into a proper authentication protocol used for SSO, federated identity, and workload identity across Kubernetes, cloud providers, and enterprise identity platforms.

An open standard (OpenPGP, RFC 4880 / RFC 9580) and its dominant implementation (GnuPG / GPG) for end-to-end encryption and signing of arbitrary data — the basis for Linux package signing, Git commit signing, encrypted email, and Sigstore's keyless signing model.

The dominant open-source cryptographic library and toolkit, providing implementations of TLS, X.509 PKI, symmetric and asymmetric cryptography, and a command-line interface for certificate management — the cryptographic substrate beneath the majority of Linux server software.

A CNCF project that defines how to push and pull arbitrary artifacts — Helm charts, SBOMs, attestations, firmware, ML models, any file — to and from standard OCI registries, along with a CLI and a set of language SDKs implementing that capability.

A discipline and category of tooling that applies heightened controls — credential vaulting, session recording, just-in-time access, and mandatory approval workflows — specifically to the accounts and credentials that carry enough privilege to cause systemic damage if misused or stolen.

A CoCo deployment mode in which the pod's confidential micro-VM is created on a remote bare-metal server via cloud provider APIs, rather than inside the Kubernetes worker node via a local hypervisor — allowing CoCo to run on cloud infrastructure where the worker nodes themselves are ordinary VMs without nested virtualisation support.

The system of policies, processes, hardware, software, and roles that manages the full lifecycle of digital certificates — issuance, distribution, validation, renewal, and revocation — binding public keys to verified identities through a chain of cryptographic trust.

An IEEE standard for port-based Network Access Control that requires devices to authenticate before being granted any network access, using EAP carried over EAPOL to a RADIUS server — the foundational wired and wireless network admission control mechanism in enterprise environments.

A family of cryptographic algorithms designed to remain secure against attacks from both classical computers and cryptographically relevant quantum computers, standardised by NIST in 2024 as the planned replacement for RSA and elliptic-curve cryptography.

The built-in Kubernetes admission controller, introduced in 1.22 and stable in 1.25 as the replacement for PodSecurityPolicy, that enforces the three Pod Security Standards profiles — Privileged, Baseline, and Restricted — at the namespace level using labels.

The immutable, container-optimised operating system that runs OpenShift nodes — managed exclusively through the Machine Config Operator, provisioned via Ignition, with SELinux enforcing mandatory, LUKS2 disk encryption via TPM2 or Tang, and a read-only /usr enforced by rpm-ostree and composefs, forming the hardened host layer beneath every OpenShift workload.

The first practical public-key cryptosystem, whose security rests on the hardness of integer factorisation — used for key encapsulation and digital signatures in TLS, X.509 certificates, SSH, and PGP, but scheduled for deprecation after 2030 due to the threat from quantum computers.

A machine-readable inventory of every component in a software artifact — packages, libraries, operating system layers, and their dependencies — providing the foundation for vulnerability management, licence compliance, and supply chain transparency.

OpenShift's pod admission and mutation mechanism, predating and more expressive than Kubernetes PSA, that defines what a pod is permitted to do — and can actively inject missing security context fields into a pod spec — with access controlled via RBAC bound to service accounts.

A Bitnami-originated Kubernetes controller and CLI that encrypts Kubernetes Secret manifests into a SealedSecret CRD using asymmetric cryptography, making them safe to commit to Git while ensuring only the in-cluster controller can decrypt them.

A Linux kernel facility that restricts which system calls a process may invoke, providing a syscall-level allowlist or denylist that limits the kernel attack surface available to a compromised process or container — independent of and complementary to LSM-based MAC.

A Kubernetes SIG Auth subproject that mounts secrets from external secret backends directly into pod filesystems as ephemeral volumes via the Container Storage Interface, without materialising them as native Kubernetes Secret objects or storing them in etcd.

A UEFI firmware feature that enforces cryptographic signature verification of every executable in the boot chain, preventing untrusted bootloaders, kernels, and drivers from running before the OS takes control.

A mandatory access control system implemented as a Linux Security Module, originally developed by the NSA, that assigns security labels to every process and object on the system and enforces a policy defining the exact operations each label combination may perform — with default-deny, so anything not explicitly permitted is refused.

AMD's third-generation confidential VM technology, adding memory integrity and remote attestation on top of per-VM memory encryption to protect guests from an untrusted hypervisor.

The NIST-standardised family of cryptographic hash functions — covering SHA-1 (broken), SHA-2 (SHA-256/384/512, universally deployed), and SHA-3/SHAKE (Keccak-based, structurally independent alternative) — forming the foundational one-way function beneath signatures, MACs, key derivation, and content addressing throughout the infrastructure stack.

A platform that centralises, normalises, correlates, and retains security telemetry from across an infrastructure — producing alerts, dashboards, and compliance reports from a continuous stream of logs and events — the primary detection and visibility layer in a security operations centre, with no direct actuation capability on the monitored platform.

An OpenSSF project that provides free, open-source infrastructure for keyless code signing and transparency — eliminating long-lived private keys by binding ephemeral signing keys to OIDC identities and recording every signing event in an append-only, publicly auditable transparency log.

NIST FIPS 205 (2024) — the conservative, hash-based post-quantum signature standard whose security depends only on the properties of a cryptographic hash function, providing algorithm diversity alongside ML-DSA in case lattice-based cryptography is weakened.

An OpenSSF security framework (pronounced 'salsa') that defines incrementally adoptable build integrity levels, a machine-readable provenance attestation format, and a verification model — giving software consumers cryptographic evidence of where an artifact came from, how it was built, and whether the build environment could have been tampered with.

A platform that receives alerts from a SIEM and other security tools, enriches them with additional context, executes automated or human-approved response playbooks, and — critically — actuates changes on connected systems including Kubernetes clusters: applying NetworkPolicies, revoking RBAC, quarantining nodes, and triggering incident workflows.

The organisational function — people, processes, and technology — responsible for continuously monitoring an infrastructure, triaging and investigating security alerts, coordinating incident response, and maintaining the detect-analyse-respond loop that connects SIEM visibility to SOAR actuation.

An open standard (SPIFFE) and its reference implementation (SPIRE) for issuing cryptographic workload identities to services in heterogeneous, dynamic environments — replacing static credentials with short-lived, automatically rotated X.509 certificates whose issuance is gated on platform attestation.

A cryptographic network protocol for secure remote login, command execution, and tunnelling over an untrusted network — the universal administrative access protocol for Linux servers, with a rich authentication model spanning passwords, public keys, certificates, and hardware tokens.

A Linux daemon that provides a unified, cached, offline-capable interface between local PAM/NSS consumers and remote identity providers — LDAP, Active Directory, Kerberos, FreeIPA, and OIDC — without requiring local user accounts, and with a pluggable provider architecture that makes it the standard identity integration layer across RHEL, Fedora, Ubuntu, and Debian.

A layered security domain covering four distinct encryption planes in a storage stack — OSD/disk-at-rest, cluster-internal wire encryption, PV/volume-level per-workload encryption, and object storage server-side encryption — each with its own threat model, key management requirements, and tooling.

The controlled mechanism by which a user-space process requests a privileged service from the Linux kernel — the sole legitimate crossing point between user space and kernel space, and therefore the primary surface on which process-level security controls operate.

The set of hardware, firmware, and software that must behave correctly for a system's security policy to hold — the foundational concept behind TCB minimisation, attestation, and confidential computing on Linux and Kubernetes.

A CPU-level confidential computing technology that hardware-isolates virtual machines from the hypervisor, host OS, and physical attackers using memory encryption and a dedicated secure arbitration mode.

A hardware-isolated execution environment that provides confidentiality and integrity guarantees for code and data running within it, even against a privileged adversary controlling the host operating system or hypervisor — the foundational abstraction beneath TDX, SEV-SNP, SGX, and Arm CCA.

The cryptographic protocol that provides confidentiality, integrity, and server authentication for network connections, underpinning HTTPS, gRPC, database connections, and virtually every other encrypted channel in modern infrastructure.

A dedicated hardware or firmware chip that provides a root of trust for cryptographic operations, secure key storage, and platform integrity measurements.

The server-side attestation and secret delivery stack for Confidential Containers, implementing the IETF RATS relying-party role: it verifies TEE hardware evidence, evaluates it against policy and reference values, and releases secrets only to workloads that pass.

A single portable binary bundling the Linux kernel, initrd, and boot parameters for verified and reproducible boot.

A Linux security framework that enforces a policy-based allowlist for USB device authorisation, using the kernel's native USB authorisation mechanism to block unauthorised devices — including BadUSB attacks — before they can interact with the operating system.

A secrets management system that provides a unified API for storing static secrets, generating dynamic credentials on demand, issuing X.509 certificates, and encrypting data — with every operation authenticated, authorised, audited, and time-bounded.

A machine-readable security advisory format in which a software supplier asserts whether a known vulnerability in a component is actually exploitable in a specific product, reducing the alert noise generated when an SBOM is matched against a CVE database.

A modern, minimal VPN protocol and Linux kernel module that establishes encrypted peer-to-peer tunnels using a fixed, opinionated cryptographic suite — offering a dramatically simpler codebase than IPsec or OpenVPN while providing equivalent security and significantly better performance.

The ITU-T standard defining the format of digital certificates — the signed data structures that bind a public key to an identity within a PKI — used universally in TLS, code signing, S/MIME, SPIFFE SVIDs, and virtually every other PKI-based system.