SIEM (Security Information and Event Management) is a platform that aggregates security telemetry from across an organisation’s infrastructure, normalises it into a common schema, applies correlation rules and behavioural analytics to detect threats, and retains the data for investigation and compliance reporting. The name combines two earlier disciplines: SIM (Security Information Management) — long-term log retention, compliance reporting, and forensic search — and SEM (Security Event Management) — real-time alert correlation and incident detection. Modern SIEMs do both simultaneously, serving as the primary visibility layer for a Security Operations Centre (SOC). Leading platforms include Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel, Elastic Security, Exabeam, and LogRhythm; all share the same fundamental architecture despite differing in query language (SPL for Splunk, KQL for Sentinel, EQL/KQL for Elastic, AQL for QRadar), correlation engine design (search-based vs dedicated CEP engine), and deployment model (on-premises, SaaS, or hybrid).
SHA (Secure Hash Algorithm) is the name given to a series of cryptographic hash function families standardised by NIST under FIPS 180 and FIPS 202. Three generations exist with fundamentally different design lineages. SHA-1 (1995, FIPS 180-1) produces a 160-bit digest and is fully broken for collision resistance: the SHAttered attack (Google and CWI Amsterdam, 2017) produced a chosen-prefix collision — two different PDF files with identical SHA-1 hashes — using approximately 9.2 × 10^18 SHA-1 operations, within practical reach of well-resourced attackers. SHA-1 must not be used for any security purpose; it persists only in legacy Git object identifiers (SHA-1 is being phased out in Git’s object store in favour of SHA-256 under the sha256 object format) and in TOTP’s HMAC-SHA-1 inner construction (where collision resistance is not the relevant security property, but migration to SHA-256 variants is still recommended). SHA-2 (2001, FIPS 180-2 and subsequent revisions) is the Merkle-Damgård family that includes SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256. SHA-256 and SHA-512 are the two variants in universal production use; the others serve niche roles. SHA-3 (2015, FIPS 202) is the Keccak sponge construction — structurally independent of SHA-2 — providing algorithm diversity and including fixed-output variants (SHA3-256, SHA3-512) and extendable output functions (SHAKE128, SHAKE256).
SEV-SNP is AMD’s third-generation confidential computing technology for EPYC processors, and the generation in production use across major cloud providers (AWS, Google Cloud) and Linux distributions today. It builds on two predecessors: SEV (2016), which encrypted each VM’s memory with a per-VM AES key managed by the AMD Secure Processor, and SEV-ES (2017), which additionally encrypted CPU register state on VM exit to prevent the hypervisor from reading guest execution state. SEV-SNP’s defining addition is memory integrity: using Secure Nested Paging, the firmware enforces that if a guest can read an encrypted memory location, the value returned must be exactly what the guest last wrote there — closing the replay, remap, and memory aliasing attacks that made earlier generations insufficient for a fully untrusted hypervisor threat model.
SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) implementation developed by the NSA and released as open source in 2000, merged into the mainline Linux kernel in 2.6 via the LSM framework in 2003. Its defining characteristic is default deny: unlike the standard Linux Discretionary Access Control model (file permission bits), where anything not explicitly forbidden is permitted, SELinux refuses all access that is not explicitly allowed by policy. Every process and every object — every file, socket, pipe, device node, and IPC object — carries a security context (also called a label) of the form user:role:type:level. The policy is a compiled set of rules, loaded at boot, that defines precisely which combinations of process context and object context may interact and how. An Apache web server process running in the httpd_t domain can read files labelled httpd_sys_content_t but is denied access to files labelled user_home_t or shadow_t, regardless of what Unix file permission bits say. If the web server is compromised, the attacker is confined to what httpd_t permits — typically a narrow, well-defined set of files and network operations — rather than having the full access of the user account running Apache.
UEFI Secure Boot is a firmware-level mechanism that ensures each binary executed during the boot process — bootloader, kernel, UEFI drivers — is cryptographically signed by a key the firmware trusts, before it is allowed to run. It is defined in the UEFI specification and implemented by the firmware on virtually all modern x86 and ARM platforms. Its threat model is bootkits and rootkits that install themselves before the OS loads and therefore survive reboots, OS reinstalls, and cannot be detected by any software running after them.
Secrets Store CSI Driver (formally secrets-store.csi.k8s.io) is a Kubernetes SIG Auth project that uses the Container Storage Interface to mount secrets, certificates, and keys from external secret backends directly into pod filesystems as ephemeral tmpfs volumes, bypassing the Kubernetes Secret object and etcd entirely. The driver runs as a DaemonSet on every node; when a pod referencing a CSI volume of type secrets-store.csi.k8s.io is scheduled, the driver communicates with a provider plugin over gRPC to retrieve the secret content from the configured backend, writes it to a per-pod tmpfs mount, and makes it available inside the container at the specified path. When the pod terminates, the tmpfs is unmounted and the data is gone — secrets have no persistence beyond the lifetime of the pod that requested them.
seccomp (Secure Computing Mode) is a Linux kernel facility, activated by the seccomp(2) syscall, that restricts which system calls a process may subsequently invoke. In its original SECCOMP_SET_MODE_STRICT form (2005) it was a blunt instrument: the process could call only read, write, _exit, and sigreturn. The operationally useful form is SECCOMP_SET_MODE_FILTER, introduced in kernel 3.5 (2012), which accepts a BPF (classic BPF, predating eBPF) filter program that receives each syscall’s number and arguments and returns one of several verdicts: ALLOW (continue normally), ERRNO (return a specified error to the process), KILL_PROCESS or KILL_THREAD (terminate immediately without giving the process a chance to handle signals), TRAP (deliver SIGSYS), or TRACE (notify a ptracer). Once installed, a seccomp filter cannot be removed, and child processes created by fork() or threads created by clone() inherit it. Filters may only add restrictions, never loosen them — so a chain of filters is the intersection of all their allowlists. The filter runs entirely in the kernel, in BPF bytecode verified for safety, before the syscall implementation is entered, making it extremely low-overhead relative to the security it provides.
Sealed Secrets is a Kubernetes controller and companion CLI tool (kubeseal) created by Bitnami that solves a specific GitOps problem: how to store Kubernetes Secret manifests in a Git repository without exposing their contents. A standard Kubernetes Secret is base64-encoded, not encrypted — anyone who can read the manifest file or the Git history can decode the values instantly. Sealed Secrets resolves this by encrypting the secret values using asymmetric cryptography before they ever leave the developer’s machine, producing a SealedSecret custom resource that contains only ciphertext and is safe to commit to any repository, public or private. The corresponding plaintext Secret is materialised exclusively inside the cluster by the controller, which holds the only private key capable of decryption.
Security Context Constraints (SCCs) are OpenShift’s mechanism for controlling and enforcing the security posture of pods at admission time. They predate and are more expressive than Kubernetes PSA: where PSA validates a pod spec against a fixed profile and either admits or rejects it, an SCC acts as both a validator and a mutator — it can inject missing fields into the pod spec (a UID from the namespace’s allocated range, an SELinux context, capability drops) so that a pod that did not specify its full security context in its manifest is brought into compliance automatically rather than rejected. SCCs are cluster-scoped resources, and access to them is controlled via RBAC: a service account must be granted use of an SCC through a Role or ClusterRole binding before pods running under that service account can be admitted with the permissions that SCC grants.
A Software Bill of Materials (SBOM) is a structured, machine-readable list of the components that make up a software artifact: open-source libraries, proprietary packages, operating system packages, programming language dependencies, and the transitive dependencies of all of the above. It is the software analogue of the ingredient list on packaged food — the thing that tells a consumer (or an automated system) precisely what is inside. The term and concept predate current security mandates but became a regulatory requirement in the US through Executive Order 14028 (May 2021), which directed NIST and NTIA to define minimum SBOM elements for software sold to the federal government. The NTIA’s resulting guidance specifies seven minimum data fields per component: supplier name, component name, version, component identifier (CPE or PURL), dependency relationships, SBOM author, and timestamp. The practical use cases SBOMs enable are vulnerability management (correlating component versions against CVE databases to identify affected software), licence compliance (detecting GPL or other licence obligations across the dependency graph), and incident response (determining within minutes which systems in a fleet contain a newly-disclosed vulnerable component, as organisations that had SBOMs could do during the Log4Shell response and those without could not).
RHCOS (Red Hat Enterprise Linux CoreOS) is the operating system that runs on every OpenShift control plane and worker node. It is not a general-purpose Linux distribution — it is a purpose-built, immutable, container-optimised OS designed to run exclusively as a managed node in an OpenShift cluster. Its security posture is architecturally different from a hardened RHEL installation: rather than hardening a mutable system through configuration management, RHCOS makes the OS layer structurally resistant to modification by design. The root filesystem’s /usr tree is read-only (enforced at mount time by rpm-ostree and, in recent versions, by composefs over the OSTree object store), /etc and /var are writable but managed exclusively by the Machine Config Operator (MCO), and no package manager is available at runtime for ad-hoc software installation. An operator who wants to change any node-level configuration — kernel arguments, sysctl settings, systemd units, certificates, kubelet configuration — creates a MachineConfig object in the OpenShift API; the MCO renders it into an Ignition config, applies it to the target MachineConfigPool (master, worker, or custom), and drains and reboots the affected nodes in a rolling fashion. Direct SSH access to nodes for configuration changes is explicitly unsupported and actively discouraged — oc debug node/<name> is the supported emergency access path, dropping into a privileged container on the node’s host namespaces under audit.
Pod Security Admission (PSA) is the built-in Kubernetes admission controller that enforces the Pod Security Standards (PSS), a set of predefined security profiles that constrain what a pod is allowed to do. It became stable in Kubernetes 1.25, at which point its predecessor PodSecurityPolicy (PSP) was simultaneously removed. Where PSP was a complex, cluster-scoped object requiring deep RBAC wiring and prone to misconfiguration, PSA is deliberately simpler: it is always enabled, requires no CRDs or RBAC setup, and is configured entirely through namespace labels. The trade-off for that simplicity is that PSA is opinionated and coarse-grained — it enforces fixed profiles rather than arbitrary custom rules, and its granularity is the namespace rather than the individual workload or service account. Teams needing finer-grained policy beyond what PSA offers typically combine it with a policy engine such as Kyverno or OPA Gatekeeper.
Post-Quantum Cryptography (PQC) is the set of cryptographic algorithms designed to resist attacks from a Cryptographically Relevant Quantum Computer (CRQC) — a quantum computer large and stable enough to run Shor’s algorithm at scale. Shor’s algorithm can solve the integer factorisation and discrete logarithm problems that underpin RSA, ECDSA, and ECDH in polynomial time, meaning that every asymmetric algorithm in wide use today — TLS key exchange, X.509 certificate signatures, SSH host keys, code signing, and encrypted email — becomes trivially breakable by a CRQC. Symmetric algorithms (AES, SHA-256) are substantially less affected: Grover’s algorithm provides only a quadratic speedup against them, which is mitigated by doubling key lengths (AES-256 remains appropriate). PQC replaces the asymmetric primitives only, on hard mathematical problems for which no efficient quantum algorithm is known: structured lattices (the Learning With Errors and Module-LWE problems), hash functions (the security of SHA-3 family variants), and error-correcting codes.
IEEE 802.1X is a standard for Port-Based Network Access Control (PNAC) that prevents any device from sending or receiving traffic on a network port until it has successfully authenticated. Originally designed for wired Ethernet and ratified in 2001, it now equally underpins enterprise Wi-Fi (WPA-Enterprise/WPA3-Enterprise), where access points act as the port gatekeeper. The core premise is that physical access to a port — plugging in a cable or being in range of an access point — does not grant network access. The port is logically divided into two channels: the uncontrolled port, which passes only EAP authentication traffic (EAPOL frames), and the controlled port, which is fully blocked until authentication succeeds. Only after the authentication server approves the device does the switch or access point open the controlled port and allow normal traffic. This port-level gate is what separates 802.1X from higher-layer authentication: a device that fails 802.1X receives no IP address, cannot reach any network resource, and cannot even attempt an attack at layer 3.
Public Key Infrastructure (PKI) is the framework that makes asymmetric cryptography operationally useful at scale. Asymmetric cryptography provides a mathematical relationship between a public key and a private key, but by itself it cannot answer the question a relying party cares about: whose public key is this? PKI answers that question by introducing a trusted third party — the Certificate Authority (CA) — that cryptographically binds a public key to an identity (a hostname, an organisation name, an email address, a SPIFFE ID) by signing a certificate. A relying party that trusts the CA can therefore trust any certificate the CA signs, without needing to know the subject directly. The chain of trust extends recursively: a Root CA signs Intermediate CA certificates, which sign end-entity certificates (also called leaf certificates). Root CA private keys are kept offline in HSMs and used rarely; intermediate CAs handle day-to-day issuance and can be revoked without rotating the root. The set of root CA certificates a system trusts is its trust store — browsers and operating systems ship with a pre-populated trust store of publicly-trusted roots, while private PKIs use custom roots distributed by administrators.
Privileged Access Management (PAM) is the security discipline concerned with controlling, auditing, and minimising the use of privileged accounts: root access, domain administrator rights, cloud IAM roles with wide permissions, database superuser credentials, service account tokens, and any other identity that can cause systemic damage if misused. The threat PAM addresses is specific: an attacker who obtains a regular user credential can typically access that user’s data; an attacker who obtains a privileged credential can move laterally, disable security controls, exfiltrate everything, and deploy ransomware. PAM is therefore not a generalisation of identity and access management (IAM) but a specialisation of it — the same concepts of authentication and authorisation, applied with far higher friction to the accounts that most need it.
OpenPGP is an open standard for encryption and digital signatures of arbitrary data, defined in RFC 4880 (2007) and substantially revised in RFC 9580 (2024, adding Ed25519, X25519, and modern AEAD encryption). GnuPG (GPG) is the dominant open-source implementation, maintained by Werner Koch and the GnuPG project, and the tool most users interact with. OpenPGP predates the PKI/CA model and takes a fundamentally different approach to trust: rather than a hierarchy of certificate authorities that users must trust transitively, OpenPGP uses a Web of Trust in which individual users sign each other’s public keys, and trust is established through chains of personal endorsements. In the Web of Trust model, Alice trusts Bob’s key because she verified it in person and signed it; Carol trusts Bob’s key because Alice (whom Carol trusts) signed it. This decentralised, peer-to-peer trust model made sense for email encryption between individuals who could meet at key-signing parties, but does not scale to automated infrastructure verification, which is why OpenPGP’s role in modern infrastructure is primarily supply chain signing — package repositories, Git commits, and release artifacts — rather than interactive authentication.
OpenID Connect (OIDC) is an authentication protocol built as a thin layer on top of OAuth 2.0, published by the OpenID Foundation in 2014. Where OAuth 2.0 defines how to delegate authorisation (granting access to resources), OIDC adds the missing authentication semantics: a standard ID token that proves who the user is, a UserInfo endpoint that returns standardised identity claims, and a discovery document that allows clients to configure themselves automatically from a single well-known URL. The separation is precise: OAuth 2.0 access tokens prove that a client is authorised to call an API; OIDC ID tokens prove that a specific user authenticated with a specific identity provider at a specific time. OIDC is the protocol behind virtually every “Sign in with Google / GitHub / Microsoft” flow, every SAML-to-modern-stack migration, and every Kubernetes service account token issued today — making it the dominant authentication federation standard in cloud-native infrastructure.
OCSP (Online Certificate Status Protocol), standardised in RFC 6960, is a request-response protocol that allows a verifier to query an OCSP responder — a service operated by the CA or a delegated party — for the current revocation status of a specific X.509 certificate. Where a CRL requires downloading an entire list and searching it locally, an OCSP query asks about exactly one certificate and receives a signed response: good (the certificate is currently valid and not revoked), revoked (revoked, with the revocation time and reason), or unknown (the responder does not know this certificate). The OCSP response is signed by the CA’s OCSP signing key (or a dedicated OCSP responder key with the id-pkix-ocsp-nocheck extension, exempt from its own revocation checking to prevent circularity) and carries a thisUpdate and nextUpdate timestamp defining its freshness window. Verifiers in strict mode reject responses outside the freshness window; in practice, OCSP responses are valid for 24 hours to 7 days depending on the CA’s policy, meaning OCSP shares CRL’s staleness problem, albeit with a smaller window.
OCI Referrers is a mechanism introduced in the OCI Image and Distribution Specification v1.1 (finalised 2024) that allows arbitrary artifacts — signatures, SBOMs, vulnerability scan reports, attestations, provenance documents — to be attached to an existing image in a registry without modifying the image itself and without requiring out-of-band storage or tag conventions. The attachment is expressed through a subject field added to any OCI manifest: a descriptor pointing to the digest of the target image. The registry then indexes these relationships, and the referrers API makes them discoverable.
