DevSecOps & hardening glossary

An ACL (Access Control List) is a list of rules that precisely defines who can access a resource and which actions are allowed (read, write, execute, delete). In networking: ACLs filter traffic, allowing or blocking packets based on source IP, destination or port. In storage: they define file permissions (who can read/modify a given file). Examples: network ACL (firewall), Linux file ACL, AWS Network ACL (subnet-level filtering), Kubernetes ACL (access control to resources).

ANSSI BP-028 prescribes concrete configuration recommendations, each referenced R<n> (e.g. R33 for SSH root) and graded by level (minimal, intermediary, reinforced, high). Pavois carries the bp28: tag on each relevant control.

A direct mapping like CIS/STIG, as opposed to NIST's abstract families.

An API key is an authentication token (a unique string) that identifies and authorizes a client to access an API. It is passed via an HTTP header (Authorization: Bearer <KEY>) or a query parameter.

Advantages: simple (no OAuth flow), stateless, per-client traceability.

Limitations: weak security (full access if stolen), no automatic expiration, no granular scope.

Best practices: never commit it to Git, rotate regularly, apply rate limiting, scope it (limited permissions). Alternatives: OAuth 2.0, JWT, mTLS.

AppArmor attaches a profile to an executable listing the allowed files, capabilities and networks; everything else is denied by the kernel. A profile is in enforce mode (blocks) or complain (logs only).

aa-status gives the real state: a profile in complain or not loaded does not protect. It is the Debian equivalent of SELinux.

Artifact scanning automatically scans artifacts (Docker images, packages, binaries) to detect vulnerabilities before deployment. The scanner compares components against CVE databases, checks for malware, analyzes dependencies and detects exposed secrets. Integration: CI/CD pipeline (block on critical findings), repository (scan on upload), regular production scans. Tools: Trivy, Grype, Snyk, Clair.

ASLR places the stack, heap and libraries at unpredictable addresses, so an attacker cannot predict where to jump after an overflow. Controlled by kernel.randomize_va_space (value 2 = full).

It is a sysctl value to verify effectively: a file that sets it but is never applied does not protect.

The attack surface represents all the entry vectors an attacker can exploit to compromise a system.

Components: API endpoints, open ports, web forms, admin interfaces, third-party dependencies, user accounts, internet-facing services, unauthenticated APIs, public S3 buckets.

Reduction: minimize exposure, close unnecessary ports, strong authentication, disable unused services, network segmentation, WAF, API gateway. Mapping: infrastructure scan (nmap), asset inventory, pentest.

An attestation is a cryptographic proof that certifies the origin, integrity and metadata of a software artifact (who built it, when, with which tools, which tests it passed). In practice, it is a digitally signed file that accompanies the artifact. It makes it possible to verify that the artifact has not been modified and genuinely comes from a trusted source. Standards: SLSA (Supply Chain Levels for Software Artifacts), in-toto, Sigstore. Essential for supply chain security: verifying that a Docker image truly comes from your CI/CD and not from a compromised source.

ABAC (Attribute-Based Access Control) is an access control model that grants or denies actions based on the attributes of the user, the resource and the context.

Unlike RBAC (fixed roles), ABAC evaluates dynamic policies:

User attributes: department, level Resource attributes: classification, owner Context attributes: time, IP, device

Example: "Allow IF department='Finance' AND classification='Confidential'"

Tools: OPA, AWS IAM, XACML.

Attributes are metadata attached to a resource (user, file, service) to describe it, categorize it or control its permissions.

Contexts: IAM/ABAC (dynamic access policies), Kubernetes (labels/annotations), cloud tagging (organization, billing), HTML/XML, OOP.

Advantages: flexibility (dynamic policies), granularity (fine-grained control), organization (categorization), automation (actions driven by attributes), cost allocation.

Best practices: standardized naming, mandatory tags, automatic tagging via IaC.

An audit is the systematic recording and review of the actions performed on a system to ensure compliance, detect anomalies and guarantee traceability. Audit logs capture who did what, when and from where: logins, configuration changes, access to sensitive data, permission changes. These logs are immutable and stored securely. In the cloud, audit services (AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs) record every API action. Essential for security, regulatory compliance (GDPR, SOC2) and post-incident investigations.

auditd keeps a tamper-resistant audit trail of privileged actions (access to /etc/shadow, identity changes, mounts). Rules are loaded into the kernel (auditctl -l), ideally in immutable mode (-e 2) so an attacker cannot disable them without a reboot.

The effective state is read via auditctl -l/-s, not just audit.rules on disk.

Authentication is the process of verifying the identity of a user or system before granting access to resources. Methods: password, multi-factor authentication (MFA), certificates, biometrics, tokens. In DevOps: SSH keys for servers, tokens for APIs, service accounts for applications. Standards: OIDC (OpenID Connect), SAML, OAuth 2.0. Important: authentication verifies "who you are", while authorization verifies "what you can do".

Authorization is the process that determines which actions an authenticated user is allowed to perform on resources. Once the identity has been verified (authentication), the system checks permissions: can the user read this file? Modify this configuration? Delete this resource? Models: RBAC (roles), ABAC (attributes), ACL (lists). In Kubernetes: RBAC defines who can do what on which resources (pods, services, secrets). In the cloud: IAM policies define permissions.

A bastion host (jump box) is a hardened and monitored server acting as a single access point to administer resources in a private network.

Security: minimal OS, mandatory MFA, IP whitelist, session recording, full logging.

Modern alternatives: AWS Session Manager (no bastion), Teleport, BeyondCorp/Zero Trust, Tailscale.

In DevOps: it is an administration SPOF, plan for robust high availability and monitoring. Apply the principle of least privilege.

A bearer token is an authentication token sent in HTTP headers (Authorization: Bearer xxx) to prove identity without resending the credentials.

How it works: after authentication, the server generates a token (JWT, OAuth) that the client stores and includes in every request. The server validates the token.

Security: limited lifetime, HTTPS only, secure storage, revocable if compromised.

A breach is a security incident where confidential data is accessed, stolen or exposed without authorization.

Types: data breach (data leak), credential breach (compromised credentials), network breach (network intrusion).

Causes: unpatched vulnerabilities, phishing, weak credentials, misconfiguration, insider threat.

Response: rapid detection (SIEM), containment, notification (GDPR: 72h), forensics, remediation. Prevention: defense in depth, monitoring, security testing.

A buffer overflow occurs when a program writes more data than a buffer can hold, corrupting adjacent memory.

Risks: application crash, arbitrary code execution (RCE), privilege escalation. Exploited to take control of a system.

Types: stack overflow, heap overflow, integer overflow.

Prevention: memory-safe languages (Rust, Go), bounds checking, ASLR, stack canaries, compiling with protections (-fstack-protector), static analysis.

A bypass is the circumvention of a security mechanism, a validation or a rule, allowing access to normally protected resources or the execution of forbidden actions.

Examples: authentication bypass (access without login), WAF (Web Application Firewall) bypass via request crafting, validation bypass (SQL/XSS injection), rate limiting bypass (API abuse).

Causes: logic errors, incorrect configurations, unpatched vulnerabilities, lack of defense in depth. Prevention: security testing (penetration testing), code review, principle of least privilege, defense in depth.

An SSL/TLS certificate is issued by a CA (Certificate Authority) to attest the identity of a server and enable encryption via a public key.

HTTPS: server presents certificate -> browser verifies CA, domain, expiration -> encrypted TLS communication. Types: SSL/TLS (HTTPS), client (mTLS), wildcard (*.example.com), Let's Encrypt (free). Management: auto-renewal (cert-manager), secure storage of private keys, expiration monitoring.

cgroups (control groups, v2 today) cap what a service consumes, containing a denial of service (memory/CPU exhaustion) to one service. systemd backs MemoryMax=, CPUQuota= on them.

Hardening: ProtectControlGroups= stops a service from tampering with the cgroup hierarchy.

A checksum is a fingerprint computed from data used to verify its integrity after transmission or storage.

Algorithms: MD5 (obsolete, collisions), SHA-256 (recommended), SHA-512, CRC32 (error detection).

Use: verify downloads (sha256sum file), detect corruption, validate backup integrity.

Principle: recompute the checksum after reception and compare it with the original. If different = corrupted or tampered data.

chrony keeps the clock accurate; drift breaks forensic correlation, certificate validity and Kerberos tickets. Prefer an authenticated source via NTS (Network Time Security, RFC 8915) so a spoofed source cannot slew the clock.

Exactly one daemon should discipline the clock (mask competing systemd-timesyncd/ntp).

CINC Auditor is the free, trademark-free distribution of Chef InSpec. An InSpec control describes, in readable language, the expected state of a resource:

describe command('sshd -T') do
  its('stdout') { should match(/^permitrootlogin no$/i) }
end

Pavois relies 100% on CINC: it runs these controls against the effective configuration, natively (local://, ssh://) or via a container, and turns the result into a per-standard graded report. The exit code stays usable in CI.

The CIS Benchmarks are security configuration guides published by the Center for Internet Security to harden systems and applications.

Coverage: OS (Linux, Windows), cloud (AWS, Azure, GCP), Kubernetes, Docker, databases, browsers.

Structure: numbered recommendations, levels (L1 = baseline, L2 = hardened), automated audit scripts.

Tools: CIS-CAT (audit), InSpec, OpenSCAP, Trivy (containers). A reference for compliance audits and hardening.

A CIS control is filed under L1 or L2. L1 targets safe hardening for most hosts; L2 adds strict measures for high-security environments. Pavois tags each control level_cis: '1'|'2', and the report recomposes the per-level view client-side.

See the CIS Benchmark.

Code analysis examines source code to detect bugs, vulnerabilities, code smells and standard violations.

Types: static (SAST - without execution), dynamic (DAST - runtime), composition (SCA - dependencies).

SAST: SonarQube, ESLint, Pylint, Semgrep, CodeQL. Detects bugs, vulnerabilities, code smells before execution.

Metrics: cyclomatic complexity, duplication, technical debt, coverage, vulnerabilities.

Integration: pre-commit hooks, CI pipeline (quality gates), IDE plugins (immediate feedback).

Best practices: progressive rules, managed false positives, baseline for legacy code, metrics tracked over time.

Injection is a critical vulnerability (OWASP Top 10 #1) allowing an attacker to insert malicious code into an application, leading to the execution of unauthorized commands.

Types: SQL injection (manipulating database queries: ' OR '1'='1), Command injection (OS command execution), LDAP injection, XPath injection, NoSQL injection.

SQL example: vulnerable query SELECT * FROM users WHERE name='$input', malicious input grants access to all users. Prevention: prepared statements, strict validation, principle of least privilege, ORM, WAF.

CWE (Common Weakness Enumeration) is a community catalog maintained by MITRE, listing the types of software weakness (bugs, design flaws) that can lead to vulnerabilities.

CVE vs CWE difference : CVE = a specific vulnerability in a product (e.g. CVE-2021-44228 Log4Shell). CWE = a generic weakness category (e.g. CWE-89 SQL Injection).

Structure : identifier (CWE-79), name, description, vulnerable code examples, recommended mitigations. Hierarchy: classes → bases → variants.

CWE Top 25 : the most dangerous weaknesses (injection, XSS, buffer overflow). Usage : SAST/DAST classification, developer training, OWASP Top 10 reference.

Compliance is adherence to the regulatory requirements, standards and internal policies that apply to an organization.

Regulations : GDPR (personal data), PCI-DSS (payments), HIPAA (healthcare), SOC2 (SaaS), ISO 27001.

DevOps : compliance as code, automated audits, traceability (immutable logs), access controls, encryption.

Consequences of non-compliance : fines, sanctions, loss of trust, being barred from operating. Automate the checks in CI/CD.

UTC is the global reference time standard, with no time offset, used to synchronize distributed systems.

Characteristics: no DST, universal reference, ISO 8601 notation (2024-01-15T10:30:00Z).

Vs timezones: UTC = reference. Paris = UTC+1 (+2 in summer), New York = UTC-5.

Best practices: store/log in UTC, convert to local time at display only, synchronize servers via NTP. Mistakes: mixing timezones, forgetting DST.

Credentials are the information used to prove the identity of a user or service in order to access a system.

Types : username/password, SSH keys, API tokens, client certificates, cloud access keys (AWS access keys).

Secure management : never in cleartext in the code, regular rotation, principle of least privilege, vault (HashiCorp Vault, AWS Secrets Manager).

Risks : a leak means system compromise. Scan repositories to detect exposed credentials (git-secrets, truffleHog).

CORS (Cross-Origin Resource Sharing) controls HTTP requests between different domains to protect against CSRF and XSS.

How it works : by default the browser blocks cross-domain requests (same-origin policy). CORS lets the server explicitly allow specific domains through HTTP headers (Access-Control-Allow-Origin, etc.). Configuration : define the allowed domains, HTTP methods and permitted headers. CORS errors : common during development (localhost:3000 → localhost:8000). Fix: CORS headers or a dev proxy.

Cross-Site Scripting (XSS) is a vulnerability that allows malicious JavaScript code to be injected into web pages viewed by other users.

XSS types:

• Reflected: code injected via the URL, executed immediately
• Stored: code persisted in a database, executed on every render
• DOM-based: client-side manipulation of the DOM

Impacts: cookie/session theft, keylogging, defacement, phishing, malware propagation.

Protections:

• Output encoding: escape HTML/JS/URL depending on context
• CSP (Content Security Policy): restrict script sources
• HttpOnly cookies: prevent JS access to sensitive cookies
• Input validation: filter user input

Detection tools: OWASP ZAP, Burp Suite, DOM Invader. Listed in the OWASP Top 10.

Cryptography is the science of protecting information through mathematical algorithms for encryption and authentication.

Primitives : encryption (confidentiality), hashing (integrity), signatures (authenticity/non-repudiation).

Algorithms : AES (symmetric), RSA/ECDSA (asymmetric), SHA-256 (hash), HMAC (MAC).

DevSecOps applications : TLS/HTTPS, encryption at rest, commit/image signing, secrets management, PKI/certificates.

CVE (Common Vulnerabilities and Exposures) is a standardized unique identifier (CVE-YEAR-NUMBER) for each security vulnerability discovered.

Information : description, affected versions, CVSS score (severity 0-10), available fixes.

Scanning tools : Trivy, Grype, Snyk, Clair. CI/CD integration to block vulnerable images.

Process : scan → detection → impact assessment → prioritization → patching. The MITRE/NVD database is the global reference.

CVSS (Common Vulnerability Scoring System) is a standardized system for scoring vulnerability severity from 0 to 10.

Scale : None (0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0).

Factors : attack vector (network/local), complexity, privileges required, impact (confidentiality/integrity/availability).

Usage : prioritize patching (Critical first), define CI/CD thresholds (block if CVSS > 7), security reporting.

Cybersecurity protects IT systems, networks and data against cyberattacks and unauthorized access.

CIA pillars : Confidentiality, Integrity, Availability. Defense in depth: multiple layers of protection.

Domains : network security, application security, IAM, encryption, vulnerability management, incident response.

See the "Cybersecurity" (detailed) term for complete information on the practices and methodologies.

Data protection covers the practices that secure data against loss, corruption, theft or unauthorized access.

Pillars : confidentiality (encryption), integrity (checksums), availability (backups, replication).

Regulations : GDPR (Europe), CCPA (California), HIPAA (US healthcare), PCI-DSS (payments).

Measures : encryption at rest/in transit, access control (RBAC), audit logs, DLP (Data Loss Prevention), tested backups.

Defense in depth is a security strategy that stacks multiple layers of independent protection.

Layers: perimeter (firewall, WAF), network (segmentation, IDS), host (antivirus, hardening), application (auth, validation), data (encryption).

Principle: if one layer is compromised, the others keep protecting. No single point of failure in security.

Complementary: Zero Trust (trust no one), least privilege (minimum necessary access).

DevSecOps extends DevOps by building security in as a shared responsibility across the software lifecycle, rather than a final validation step.

Shift-Left: security controls early in the pipeline (code analysis, dependency scanning, secrets, tests) to reduce remediation costs.

Practices: automated SAST/DAST, secrets management, image scanning, policy as code, threat modeling. Goal: ship fast AND secure.

Diffie-Hellman is a protocol that lets two parties establish a shared secret key over an insecure channel.

Principle: exchange of public values grounded in mathematics (the discrete logarithm problem) without ever revealing the final key.

Usage: key negotiation for TLS/HTTPS, VPN, SSH. A foundation of modern cryptography for establishing secure channels.

Variants: ECDH (Elliptic Curve Diffie-Hellman) is more efficient, DHE/ECDHE (ephemeral) provide forward secrecy.

Under DAC, a root process can touch everything: powerful but fragile, since a compromised account inherits its full reach. Permission bits, ACLs and file ownership are DAC.

MAC backstops it: even if a DAC permission is too open, the kernel policy can still deny the access.

A DDoS attack overwhelms a service with massive volumes of requests from multiple sources (botnet) to make it unavailable.

Types: volumetric (bandwidth saturation), application-layer (resource exhaustion), protocol (TCP/IP weaknesses).

Protections: anti-DDoS services (Cloudflare, AWS Shield), rate limiting, geo-filtering, CDN, auto-scaling. Early detection is essential.

A distribution refers to a software bundle packaged for a specific use (Linux distributions) or to the software delivery process itself.

Linux: Ubuntu, Debian, RHEL, CentOS, Alpine. Each has its own package manager (apt, yum, apk) and philosophy.

Containers: base images (alpine:3.18, ubuntu:22.04). Alpine is popular for its small footprint (~5MB).

Delivery: distribution mechanism (npm registry, Docker Hub, Maven Central). Channels: stable, beta, nightly.

A DMZ (Demilitarized Zone) is an isolated subnet between the internal network and the Internet, exposing public services while protecting the LAN.

Architecture: external firewall → DMZ → internal firewall → LAN. A double security barrier.

Services in the DMZ: web servers, reverse proxies, bastion hosts, load balancers. Never databases or secrets.

Cloud: public subnets (the DMZ equivalent), security groups, NACLs. Defense in depth through network segmentation.

A drop-in is a configuration fragment placed in a dedicated directory (*.d/), read in addition to the main file, usually in lexicographic order of filenames. systemd, sshd, sysctl, sudo, logind... all rely on this mechanism to allow clean overrides without touching the original file.

Consequence for auditing: a scanner that reads only the main file misses the drop-ins → false negative. Pavois queries the effective state, which already incorporates them.

DAST analyzes a running application (black box) by simulating real attacks to identify exploitable vulnerabilities.

Unlike SAST, it does not require access to the code: it tests like an attacker.

Detects : SQL/XSS injections, weak auth, CORS/headers, CSRF. Tools : OWASP ZAP, Burp Suite, Nuclei. Complementary to SAST.

Effective configuration is what a service truly applies once started, not what a file declares.

For example, sshd loads /etc/ssh/sshd_config, its Include directives, then the drop-ins under /etc/ssh/sshd_config.d/. Only sshd -T reveals the resolved value of each option.

This is Pavois's angle: audit the effective state (sshd -T, sysctl -a, systemctl show, auditctl -l) instead of reading files, as OVAL/oscap file probes do, which can miss the resolved value as soon as an Include or a drop-in is involved.

Encryption mathematically transforms data into a format that is unreadable without the appropriate cryptographic key.

Types: symmetric (single key: AES), asymmetric (public/private key pair: RSA), hybrid (combines both: TLS).

Contexts: at rest (stored data), in transit (transmitted data: TLS), end-to-end (only sender and recipient can decrypt).

Key management: KMS (AWS KMS, Azure Key Vault), regular rotation. Mandatory under GDPR, HIPAA, PCI-DSS.

Encryption at rest protects stored data (databases, files, backups) with encryption, making it unreadable in the event of unauthorized physical access.

How it works: encrypt before writing, decrypt on read. Transparent to the application. Key stored separately (KMS).

Technologies: full disk (LUKS, BitLocker), database (TDE on Oracle/SQL Server), object storage (S3 SSE). Defense: at rest + in transit (TLS) + IAM. Regulations: mandatory under GDPR, HIPAA, PCI-DSS.

Encryption in transit protects data while it is being transmitted by encrypting it, preventing interception/tampering (man-in-the-middle).

Protocols: TLS/SSL (HTTPS), SSH (remote administration), IPsec (VPN), WireGuard (modern VPN). TLS 1.3 is current (1.0/1.1 are obsolete).

Implementation: SSL/TLS certificates (Let's Encrypt), auto-renewal (cert-manager), enforced HTTPS (301, HSTS), mTLS in service meshes. mTLS: bidirectional auth, critical for microservices. Validation: SSL Labs, testssl.sh.

An exploit is a piece of code, script or technique that takes advantage of a specific vulnerability to compromise a system.

Types: remote (remote execution), local (privilege escalation), zero-day (unpatched/unknown vulnerability).

Lifecycle: vulnerability discovered → PoC (Proof of Concept) → weaponized exploit → fix released → patch applied.

Defense: fast patching, EPSS/CVE monitoring, WAF, EDR, network segmentation.

The EPSS (Exploit Prediction Scoring System) predicts the probability (0-100%) that a CVE will be exploited within the next 30 days, using machine learning.

Vs CVSS: CVSS measures technical severity, EPSS measures the real-world exploitation risk based on attacker behavior. A CVSS 9.8 CVE may have an EPSS of 2% if it is complex to exploit.

Prioritization: CVSS 7.0 + EPSS 85% = critical. CVSS 9.5 + EPSS 0.5% = medium. Sources: exploitation attempts, forums, PoC, dark web. Updated daily by FIRST.org.

XDR (Extended Detection and Response) is a security platform integrating threat detection, analysis and response across multiple layers: endpoints (EDR), network, cloud, email, identities.

Evolution: EDR (endpoints only) → XDR (holistic view correlating data from multiple sources).

Capabilities: unified telemetry collection, automatic correlation (full kill chain), advanced threat hunting, orchestrated response (endpoint isolation, IP blocking, session revocation).

Benefits: reduces detection (MTTD) and response (MTTR) times, eliminates silos, detects sophisticated attacks (lateral movement).

vs SIEM: XDR is focused on automated response and native correlation, whereas SIEM = log aggregation + manual analytics.

Vendors: Palo Alto Cortex XDR, Microsoft Defender XDR, CrowdStrike Falcon, SentinelOne.

External Secrets Operator (ESO) automatically synchronizes secrets from external managers (Vault, AWS Secrets Manager) into native K8s Secrets.

Problem solved: avoid secrets in YAML/etcd, centralize management with audit/rotation/access control. Dynamic injection without Git.

How it works: an ExternalSecret resource references a Vault secret. The operator fetches it and creates/updates the K8s Secret. Auto-resync on change. Benefits: single source of truth, automatic rotation, audit, never stored in Git. Alternative: Sealed Secrets.

faillock counts failures and temporarily blocks the account (deny, unlock_time), making SSH or console brute-force impractical. It is configured in the PAM stack and/or faillock.conf.

Tune it: too aggressive a lockout becomes a denial of service against your own users.

A fingerprint is a short, unique identifier generated from the complete characteristics of an entity, making it easier to verify and identify.

Use cases:

SSH keys: hash of the public key to verify the server's identity TLS certificates: signature to validate the certificate Browser fingerprinting: user tracking via browser/OS configuration Container images: SHA256 digest to verify integrity

Typically generated via a cryptographic hash (SHA256, MD5). Allows two entities to be compared quickly.

Fingerprinting identifies a system/device/browser by combining distinctive technical characteristics, without cookies.

Browser: user-agent, resolution, plugins, fonts, canvas → unique hash. Used for: tracking, fraud detection.

Network: service identification by analyzing responses (nmap, p0f). TLS: ClientHello analysis.

Defense: response normalization, VPN/Tor, anti-fingerprinting browsers (Brave, Tor Browser).

A firewall is a network security device that filters inbound and outbound traffic according to predefined rules. It is the first line of defense.

Firewall types:

Network firewall: filtering by IP/port (iptables, nftables) Application firewall (WAF): HTTP analysis, protection against the OWASP Top 10 Host firewall: system-level protection (firewalld, ufw) Next-Gen Firewall (NGFW): application-aware inspection, IDS/IPS

Inspects each packet and applies allow/deny rules based on IP, ports and protocols.

FSS does not prevent a local root from editing logs, but makes it visible: journalctl --verify reports the first altered entry. Keys are generated via journalctl --setup-keys, sealing enabled with Seal=yes.

Pair it with off-box log shipping: FSS detects, remote export preserves an untampered copy.

Fuzz testing (fuzzing) consists of feeding random, malformed or unexpected data to an application in order to uncover bugs, crashes and vulnerabilities.

Types of fuzzing:

Mutation-based: mutate valid inputs Generation-based: generate inputs from a grammar Coverage-guided: use code coverage to target untested areas

Popular tools: AFL, libFuzzer, OSS-Fuzz (Google), Peach Fuzzer. Uncovers critical vulnerabilities (buffer overflow, injection, crash) that conventional tests miss.

The GDPR (General Data Protection Regulation) is the European regulation governing the collection, processing and storage of EU citizens' personal data.

Principles: explicit consent, right of access/rectification/erasure, data minimization, breach notification within 72h.

Penalties: up to 4% of global revenue or €20M.

In DevOps: data encryption, anonymized logs, consent management, audit trail, data retention policies.

GRUB precedes every OS defense: whoever can edit a boot entry can append init=/bin/bash and get an unauthenticated root. Hardening: a superuser password (password_pbkdf2) with --unrestricted, grub.cfg at 0600, hardening flags on the kernel command line.

Pavois reads the generated grub.cfg and /proc/cmdline, not just /etc/default/grub.

Guardrails are automated constraints that steer toward best practices while blocking dangerous actions.

Examples: Policy as Code (OPA blocks pods without limits), pre-commit hooks (prevent committing secrets), CI gates (coverage tests), branch protection.

Philosophy: make the right choice easy and the wrong one hard. They educate with clear messages.

A key element of Platform Engineering and shift-left security.

Hardening reduces the attack surface by disabling unnecessary services, applying security patches, configuring minimal permissions and removing superfluous components.

Actions: disable unneeded services, remove default accounts, least-privilege principle, strong passwords, audit logs, encryption, firewall.

Frameworks: CIS Benchmarks, ANSSI-BP-028, STIG. Tools: Lynis, OpenSCAP, InSpec.

An HSM is a dedicated hardware device for generating, securely storing and managing cryptographic keys, offering maximum protection against key extraction.

Characteristics: tamper resistance, key isolation (keys never leave the device), crypto operations performed inside the HSM, certifications (FIPS 140-2 Level 3/4).

Uses: SSL/TLS certificate signing, database encryption, financial transactions, master-key protection. Cloud: AWS CloudHSM, Azure Dedicated HSM, GCP Cloud HSM. Difference from a KMS: an HSM provides hardware-based protection, whereas a KMS is software-based.

A hash turns variable-length data into a fixed-size digital fingerprint (digest), in a deterministic and one-way fashion.

Properties: deterministic, fast, one-way (the input cannot be recovered), collision resistance, avalanche effect (a small change → a completely different hash).

Algorithms: SHA-256 (secure standard), SHA-3 (next generation), MD5/SHA-1 (deprecated). Uses: integrity verification, password storage (with a salt), digital signatures, blockchain.

A honeypot is a decoy system deliberately deployed to attract attackers, observe their techniques and gather threat intelligence.

Types: low-interaction (emulates basic services, easy to run, lower risk), high-interaction (a full, realistic system, rich data collection but riskier).

Goals: early warning, threat intelligence, diverting attackers, forensic analysis (malware, exploits). Deployment: isolated from the production network, fully monitored, holding no sensitive data. Tools: Honeyd, Cowrie (SSH), Dionaea. Cloud: AWS GuardDuty includes decoys.

HTTPS is the secure version of HTTP, using SSL/TLS to encrypt client-server communications, ensuring confidentiality, integrity and authentication.

How it works: TLS establishment (handshake, certificate verification), data encryption, integrity verification (HMAC).

Protection: confidentiality, integrity, server authentication. Configuration: an SSL/TLS certificate (Let's Encrypt), web server setup, HTTP-to-HTTPS redirection, HSTS. Port 443 (vs 80 for HTTP). Mandatory for authentication, payments and SEO.

HSTS forces browsers to communicate with a domain over HTTPS only, preventing downgrade attacks to unencrypted HTTP.

Header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Parameters: max-age (duration), includeSubDomains (subdomains), preload (browser preload list).

How it works: first HTTPS visit → server sends HSTS → browser remembers it → subsequent visits automatically use HTTPS. Protects against man-in-the-middle and SSL stripping attacks.

Idempotence is the property of an operation that produces the same result whether it is run once or several times, with no additional side effects.

Idempotent examples: HTTP PUT/DELETE, Ansible/Terraform (applied N times = the same result), SET x=5. Non-idempotent examples: HTTP POST (creates a new resource), x++ (increment).

Why it matters in DevOps: safe automation (re-running without risk), automatic retries, convergence (self-healing systems). REST API: GET, PUT and DELETE are idempotent; POST is not.

An identifier is a unique string used to reference a specific resource or entity within a system.

Common types: numeric ID (database auto-increment), UUID (128-bit universal identifier), slug (human-readable identifier), ARN, URI/URL.

Properties: uniqueness, persistence (it does not change), no recycling (a deleted ID is never reused). Uses: database primary key, API URLs (/users/{id}), log traceability, correlation across distributed systems.

An identity is the set of attributes that uniquely defines an entity (user, service, application) within a computer system.

Components: identifiers (username, email), attributes (name, role), credentials (password, certificate, API key) and the associated permissions.

Types: human user, service account (applications), workload identity (Kubernetes pods), machine identity (server certificates). Management: IAM, provisioning/deprovisioning, federation, SSO.

IAM (Identity and Access Management) manages digital identities and controls access to resources.

Components: identity (user, service account), authentication (MFA, certificates), authorization (RBAC, policies), audit.

Cloud: AWS IAM, Azure AD, GCP IAM. Patterns: service accounts, federated identities, temporary credentials.

Best practices: mandatory MFA, least privilege, credential rotation, audit logs, centralized IAM.

An Identity Provider (IdP) is a centralized service that manages user identities and authentication for multiple applications, enabling Single Sign-On (SSO).

SSO flow: the user authenticates with the IdP (once), the IdP issues a token, and applications consume that token to authorize access.

Protocols: SAML 2.0, OAuth 2.0, OpenID Connect, LDAP/Active Directory. Examples: Okta, Azure AD, Keycloak, Auth0. Benefits: streamlined user experience, centralized security, unified MFA.

Immutability is the property of an object that cannot be modified after its creation. Any change creates a new version.

Applications: container images (read-only), immutable infrastructure (servers replaced, never modified), immutable data structures, WORM backups.

Benefits: predictability, security (no malicious modification), simpler debugging, concurrency (no race conditions). In infrastructure: eliminates drift, simplifies rollback, guarantees reproducibility.

Incident response refers to the coordinated actions taken to detect, contain, eradicate, and recover from a security incident (intrusion, data breach, ransomware).

NIST phases: preparation (plans, tools, team), detection and analysis, containment (limit spread), eradication (remove the threat), recovery (restore services), lessons learned (improvement).

Team: CSIRT/CERT, SOC, forensics, legal. Tools: SIEM (detection), EDR (containment), forensics (Volatility, FTK), secure communications.

An Include directive tells a service to load other files: Include /etc/ssh/sshd_config.d/*.conf for sshd, @includedir /etc/sudoers.d for sudo, and so on.

The real configuration is therefore spread across several files, sometimes with subtle precedence rules. Reading only the root file gives a false picture, which is exactly why auditing the effective configuration beats reading files.

Input validation consists of checking and sanitizing all data coming from users or external sources before processing it, in order to prevent injections, errors, and unexpected behavior.

Validation types: syntactic (correct format: email, date), semantic (sensible value: age > 0), whitelist (allowed values only), blacklist (forbidden values, less safe).

Techniques: server-side validation (mandatory), sanitization (escaping special characters), encoding (HTML entities), parameterized queries. Golden rule: never trust incoming data.

IAST (Interactive Application Security Testing) combines the SAST (static analysis) and DAST (dynamic analysis) approaches by instrumenting the application while it runs.

How it works: an agent embedded in the application observes runtime behavior in real time (requests, data flows, system calls) and correlates it with the source code to detect vulnerabilities.

Advantages: fewer false positives than SAST, precise location in the code, detection in a real-world context, immediate feedback to developers.

Limits: requires the application to be running, performance overhead, coverage depends on the tests that are exercised.

Tools: Contrast Security, Synopsys Seeker, Checkmarx IAST. Usage: test/QA environments, complementary to SAST and DAST in a DevSecOps pipeline.

An IDS (Intrusion Detection System) monitors network traffic or system activity to detect suspicious behavior and intrusion attempts.

Types: NIDS (Network - monitors network traffic), HIDS (Host - monitors a specific server).

Methods: signature-based (known attacks, fast), anomaly-based (behavioral deviations, detects zero-days but produces false positives).

IDS vs IPS: IDS = passive detection/alerting. IPS = active blocking. Tools: Snort, Suricata, OSSEC, Wazuh, AWS GuardDuty.

An IPS (Intrusion Prevention System) automatically detects AND blocks intrusions and malicious traffic in real time (vs IDS: passive detection).

Placement: inline on the network, real-time analysis. Types: NIPS (network), HIPS (host), WIPS (Wi-Fi).

Actions: drop packets, reset connection, IP blocking. Methods: signature-based, anomaly-based, protocol analysis.

IPS vs IDS: IPS = proactive/blocking, IDS = passive/alerting. Tools: Suricata, Snort inline, next-gen firewalls.

An ISMS (Information Security Management System) is a framework for systematically managing information security.

Components: security policy, risk analysis, technical/organizational controls, incident management, continuous improvement (PDCA).

Standards: ISO 27001 (certifiable), ISO 27002 (guidance), NIST CSF, SOC 2.

Benefits: structured approach, GDPR/NIS2 compliance, risk reduction, stakeholder trust.

ISO 27001 defines the requirements for establishing and maintaining an Information Security Management System (ISMS).

Structure: risk-based approach, PDCA cycle, 114 controls across 14 domains (policy, access, crypto, physical security...).

Certification: define the ISMS scope, perform risk analysis, implement controls, undergo external audit, valid for 3 years.

Benefits: GDPR/NIS2 compliance, customer trust, risk reduction, continuous improvement.

Isolation is the separation between components to limit the impact of failures or vulnerabilities.

Levels: physical (separate servers), virtualization (VMs), containers (namespaces, cgroups), network (VLANs, VPCs).

Kubernetes: namespaces, network policies, resource quotas, Pod Security Standards.

Benefits: limited "blast radius", defense in depth, breach containment.

journald should write to /var/log/journal (Storage=persistent) to survive reboots, cap its size (anti-fill), and ideally seal its journals (FSS). Pavois reads the effective config (base + drop-ins merged).

Shipping to a remote collector puts the evidence beyond the local root's reach.

JWT (JSON Web Token) is a standardized (RFC 7519) compact token format for transmitting secured information, typically for authentication.

Structure: header.payload.signature (Base64). Header (alg HS256), Payload (claims: sub, exp, iat), Signature (HMAC of header+payload).

Workflow: authentication → signed JWT → client stores it → Authorization Bearer → server verifies the signature. Benefits: stateless, scalable, self-contained. Security: payload is visible, HTTPS mandatory, short expiration, refresh tokens.

A jumphost (bastion) is a secure server that acts as a single access point to a private network not reachable from the Internet.

Architecture: Internet -> Bastion (DMZ) -> private network. Security: hardening, MFA, SSH keys, auditing, IP whitelisting.

Connection: ssh -J user@bastion user@private-server or SSH config ProxyJump.

Cloud alternatives: AWS Session Manager, Azure Bastion, GCP IAP. Modern: zero-trust (Tailscale, Cloudflare Tunnel).

A module runs with full kernel privilege; a bug in a never-used driver is still exploitable. Truly disabling it needs install <mod> /bin/false and blacklist in /etc/modprobe.d/, not blacklist alone.

Pavois reads the effective state (loaded? lsmod; disabled? modprobe --showconfig), not a single .conf file.

KMS (Key Management Service) is a service for centralized management of cryptographic keys to create, store, rotate and audit encryption keys.

Functions: secure creation/storage, automatic rotation, IAM access control, full auditing.

Architecture: Master Key (root), Data Encryption Key (DEK), envelope encryption (the DEK encrypts data, the Master Key encrypts the DEK).

Providers: AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault.

Use cases: encryption of data at rest, application secrets, GDPR/PCI-DSS compliance.

A key pair is a set of two linked cryptographic keys: a public key (shareable) and a private key (secret).

Uses: encryption, digital signature, passwordless SSH authentication.

SSH: generated with ssh-keygen, public key on the server (~/.ssh/authorized_keys), automatic login with the private key.

Algorithms: RSA (2048-4096 bits), Ed25519 (modern, recommended), ECDSA.

Best practices: protect the private key (permissions 600), passphrase, regular rotation.

The Kill Chain is a model describing the sequential stages of a targeted cyberattack.

Classic phases (Lockheed Martin): 1) Reconnaissance (identify targets), 2) Weaponization (build an exploit), 3) Delivery (deliver the malware), 4) Exploitation (execute code), 5) Installation (plant a backdoor), 6) Command & Control (C2 - communicate with the attacker), 7) Actions on Objectives (exfiltrate data, sabotage).

Defense: break the chain as early as possible. Each phase = an opportunity to detect/block.

Variants: MITRE ATT&CK (tactical/technical details), Unified Kill Chain (extended).

DevSecOps practice: shift-left security (preventing reconnaissance), EDR (detecting exploitation), network segmentation (blocking C2).

Lateral movement is a post-intrusion technique where an adversary moves to other machines on the network to expand their access.

Methods: credential theft (pass-the-hash), service exploitation (RDP, SSH, SMB), abuse of domain trust, living-off-the-land tools (PsExec, PowerShell).

Objectives: privilege escalation, persistence, access to sensitive data, preparing the final attack.

Detection: monitoring abnormal authentications, UEBA, network segmentation, honeypots.

Prevention: strict segmentation, least privilege, MFA, PAM, Zero Trust.

The principle of least privilege consists of granting only the minimal permissions needed to accomplish a task.

Application: users (read access unless writing is required), processes (not root), services (minimal IAM), containers (limited capabilities), APIs (restricted scopes).

Benefits: reduced attack surface, contained damage, compliance, easier auditing.

Implementation: RBAC (roles), ABAC (context), JIT (temporary elevation), PAM (elevated access).

Example: a web app running as non-root, a read-only database, restricted CI/CD permissions.

The lifecycle is the set of phases an entity goes through from its creation to its deletion.

Application: development, build, deployment, operation, decommissioning.

Container: creation, start, pause, stop, deletion. Lifecycle hooks (postStart, preStop).

Management: IaC/CI/CD automation, retention policies, hooks, monitoring.

LDAP is a protocol for accessing distributed directory services that hold hierarchical information, used for centralized authentication.

Structure: hierarchical tree (DIT), entries (unique DN: cn=alice,ou=users,dc=example,dc=com), attributes (cn, ou, dc).

Uses: centralized authentication (enterprise SSO), employee directory, access management (groups), configuration.

Operations: bind (auth), search, add/modify/delete, compare.

Evolution: superseded by OAuth/OIDC and SAML, but still present in legacy systems.

Capabilities enable least privilege: a service that only needs to bind port 80 gets CAP_NET_BIND_SERVICE, not UID 0. systemd bounds them with CapabilityBoundingSet=.

Dropping a daemon's unneeded capabilities shrinks what an attacker gains by compromising it.

The Man-in-the-Middle (MitM) attack secretly intercepts communications between two parties to steal or modify data.

Techniques : ARP/DNS spoofing, rogue Wi-Fi, SSL stripping (HTTPS downgrade).

Impact : credential/data theft, malicious injection, identity spoofing.

Protections : HTTPS/TLS, HSTS, certificate pinning, VPN, mTLS. Detection : invalid certificate alerts, anomalous network monitoring.

Under MAC, authorization does not depend on the file owner (unlike DAC) but on a central, kernel-enforced policy. SELinux and AppArmor are the Linux implementations.

The point: a compromised service stays confined to its domain even running as root, capping the blast radius.

Metadata describes other data, providing context and structured information about resources.

Types: descriptive (title, author), structural (format, size), administrative (creation, permissions), technical (resolution, checksums).

Uses: tagging (env=prod for filtering), labels (Kubernetes selection), annotations (documentation, non-identifying), cloud attributes (cost center, owner).

Formats: key-value, JSON, YAML, HTTP headers.

Best practices: naming conventions, mandatory tags (owner, env), immutability, indexing. Examples: container labels, S3 metadata, photo EXIF.

Micro-segmentation divides the network into fine-grained segments (workload/pod level) with granular controls.

Vs traditional : broad VLANs vs per-workload policies, internal zero-trust, lateral movement blocked.

Implementations : Kubernetes Network Policies, VMware NSX, service mesh (mTLS), distributed firewalls.

Benefits : limited blast radius, compliance. Challenges : rule complexity, troubleshooting.

On /tmp, /dev/shm, /var..., these cut classic abuses: noexec removes a dropped payload's launch pad, nosuid neutralises a planted setuid, nodev blocks a rogue disk node.

Pavois reads the effective mount (/proc/self/mountinfo, findmnt), not /etc/fstab: an option never remounted is not effective.

mTLS (mutual TLS) authenticates BOTH client and server via certificates, unlike classic TLS (server only).

How it works : TLS connection → server presents certificate → server requests client certificate → bilateral verification.

Benefits : strong bidirectional auth, zero-trust foundation, E2E encryption, no passwords.

Use cases : service mesh (Istio, Linkerd), machine-to-machine APIs, microservices. Complexity : PKI management, certificate rotation.

MFA (Multi-Factor Authentication) requires several distinct proofs of identity, drastically reducing unauthorized access.

Factors: knowledge (password), possession (smartphone, token), inherence (biometrics).

Types: authenticator app (TOTP), hardware token (YubiKey), push notification, SMS (deprecated as it is vulnerable to SIM swap).

Implementation: mandatory MFA for admins and sensitive access, conditional access policies, backup codes.

Blocks >99% of attacks using stolen credentials. A pillar of Zero Trust.

A mutable tag is a version reference (v1, latest) that can be moved to a different commit/artifact, unlike immutable SHAs.

Security risks : an attacker can redirect a mutable tag to malicious code, affecting every user referencing that tag.

Examples : GitHub Actions @v4 (mutable) vs @sha, Docker nginx:latest vs nginx@sha256:..., npm ^1.0.0 vs lockfile.

Best practices : pin by SHA/digest for critical dependencies, lockfiles, Dependabot for controlled updates.

Namespaces give a group of processes their own view of a resource: a user namespace can make a root inside it map to nobody outside. systemd uses them for sandboxing (PrivateTmp, RestrictNamespaces).

They isolate but do not replace MAC: a misconfigured namespace is still attack surface.

The NIST (National Institute of Standards and Technology) is the US federal agency that establishes technology norms and standards.

Key domains : Cybersecurity (NIST Cybersecurity Framework, SP 800-53), cryptography, cloud computing (the official definition of the 5 cloud characteristics).

DevSecOps reference : NIST SP 800-190 (container security), NIST CSF (cyber risk management), NIST 800-61 (incident response).

Impact : standards adopted worldwide, the basis for certifications (FedRAMP, ISO 27001). Free and public, unlike the paid ISO standards.

The NVD (National Vulnerability Database) is the NIST (USA) database referencing all published vulnerabilities with their CVE identifiers.

Content : CVEs enriched with CVSS scores, CWE (weakness type), CPE (affected products), references, fixes.

DevSecOps usage : data source for scanners (Trivy, Grype), SCA tools, security alert enrichment.

API : NVD API 2.0 enables programmatic queries. Complementary : CVE (identifiers), CVSS (scoring), CWE (classification).

Network policies are network filtering rules defining which communications are allowed between pods/services.

How it works : pod selection (labels), ingress/egress rules, deny by default.

Use cases : namespace isolation, tier segmentation, compliance, zero-trust.

Implementation : the CNI must support them (Calico, Cilium), iptables/eBPF. Limitations : Layer 4 only, difficult troubleshooting.

Network security encompasses the policies, practices and technologies protecting network infrastructure against unauthorized access and attacks.

Defense layers : perimeter (firewall, WAF), transport (TLS/SSL, VPN), network (segmentation, VLANs), endpoint (EDR agents).

Technologies : firewall, IDS/IPS (intrusion detection), VPN (encrypted tunnels), NAC (device authentication).

Practices : defense in depth, zero-trust, least privilege, segmentation, monitoring.

Threats : DDoS, man-in-the-middle, port scanning, lateral movement.

Compliance : PCI-DSS, SOC2, ISO 27001 require network controls.

Network segmentation divides a network into isolated subnets to limit attack propagation and control data flows.

Types : physical (VLANs, dedicated switches), logical (subnets, firewall rules), micro-segmentation (workload level).

Classic architecture : DMZ (exposed services), application tier, data tier, isolated management network.

Benefits : limited blast radius, lateral movement made difficult for attackers, compliance (PCI-DSS, HIPAA).

Cloud : VPC subnets (public/private/isolated), security groups, NACLs, PrivateLink.

Evolution : micro-segmentation (Cilium, Calico) + Zero Trust = segmentation at the application level, not just the network.

OAuth 2.0 is an authorization protocol allowing applications to access user resources without exposing their credentials.

Flows : authorization code (web apps), PKCE (SPAs, mobile), client credentials (M2M), refresh token.

Actors : resource owner, client, authorization server, resource server.

Scopes : granular permissions (read:profile). Security : PKCE, state parameter, HTTPS. OAuth = authorization, OIDC = authentication.

OPA is an open source policy engine for defining and enforcing access control and compliance rules through the Rego language.

Principle: policy as code (versioned, tested), decoupled (logic separated from application code), unified (the same policies for infra, apps, APIs).

Use cases: Kubernetes admission control, API authorization, infrastructure compliance (Terraform), data filtering.

Integration: webhooks, sidecars, gateways, CI/CD. Workflow: request → OPA evaluates (policy + data + Rego) → allow/deny decision.

OpenID Connect (OIDC) is an authentication layer on top of OAuth 2.0 enabling verification of user identity via standardized tokens.

Difference from OAuth : OAuth = authorization, OIDC = authentication + authorization.

Tokens : ID token (JWT with sub, email, name), access token, refresh token.

Use cases : SSO, federation (Google, Azure AD), identity management. Security : JWT validation, PKCE, nonce (replay protection).

OSCAL standardizes compliance-as-data: a GRC tool can import a control catalog and profiles without bespoke parsing. Pavois publishes its baseline as an OSCAL catalog + per-OS profiles; the assessment-results package (a scan as OSCAL) is roadmap.

It is the structured successor to SCAP/XCCDF datastreams.

Overhead refers to the additional resources (CPU, RAM, network) consumed by infrastructure or abstractions, beyond the useful work itself.

Types: performance (network latency), memory (runtime, GC), operational (management complexity), network (headers, TLS).

Examples: containers (~MB RAM), service mesh (sidecar proxy), observability, encryption.

Tradeoff: overhead is acceptable when benefits > cost. Optimization: right-sizing, simplification, caching, profiling. Architecture decision: weigh overhead against benefits.

OWASP (Open Web Application Security Project) is an organization providing resources and standards for web application security.

Resources: Top 10 (critical vulnerabilities), ASVS (Application Security Verification Standard), Testing Guide.

Tools: ZAP (scanner), Dependency-Check, Cheat Sheets.

Top 10 2021: Broken Access Control, Injection, Security Misconfiguration, Vulnerable Components... A reference for security audits.

PAM separates how you authenticate from which service asks: one module enforces password quality (pwquality), another lockout after failures (faillock). The order of modules in the stack matters.

Stacks differ between Debian (common-*) and RHEL (system-auth/authselect).

Parameters are configurable values passed to functions, scripts or templates to customize their behavior without modifying the code.

Contexts: functions, CLI (flags: --verbose), IaC (Terraform variables), CI/CD, templates.

Types: required, optional (with defaults), positional, named (key=value).

Best practices: sensible default values, validation, documentation, secrets kept separate. Difference from variables: parameters = external inputs, variables = internal.

Penetration testing is an authorized attack simulation to identify exploitable vulnerabilities before a real attacker discovers them.

Types: black box (no information), white box (full access), grey box (partial information).

Phases: reconnaissance, scanning, exploitation, post-exploitation, reporting.

Targets: web apps (OWASP Top 10), infrastructure, APIs, cloud. Tools: Burp Suite, Metasploit, Nmap, OWASP ZAP.

Perfect Forward Secrecy (PFS) guarantees that compromise of a long-term private key does not allow past communications to be decrypted.

Principle: each session uses a unique ephemeral key, destroyed after use.

Mechanism: ephemeral Diffie-Hellman exchange (DHE, ECDHE) for each session.

Without PFS: a compromised key means historical traffic is decryptable. With PFS: past traffic remains protected. TLS config: DHE/ECDHE cipher suites.

Permissions are granular authorizations defining which actions (read, write, delete) an identity can perform on specific resources. Models: DAC (owner defines), MAC (centralized), RBAC (role-based), ABAC (attribute-based). Principles: least privilege, separation of duties, deny by default, time-bound. Cloud IAM: policies (JSON allow/deny), principals, actions, resources, conditions. Issues: permission creep, over-permissive grants. Audit: periodic reviews.

Persistence is the ability to retain data beyond the lifetime of a process or container.

Types: ephemeral (RAM, emptyDir), persistent (disks, databases, object storage).

Container solutions: Docker volumes, Kubernetes PersistentVolumes, NFS/EBS mounts.

Patterns: externalized state, shared storage. Considerations: backup, replication, performance, cost. Stateless vs Stateful: stateless = easily scalable.

A PKI is a system managing the lifecycle of digital certificates: creation, distribution, revocation.

Components: CA (Certificate Authority), RA (Registration Authority), certificates, CRL/OCSP.

Hierarchy: Root CA (offline), Intermediate CA, end-entity certificates.

Uses: TLS/HTTPS, mTLS, code signing, email (S/MIME), VPN. Management: rotation, revocation, monitoring, automation (Let's Encrypt).

A policy is a formal rule defining the authorized, forbidden or required behaviors for resources, access or configurations.

Types: security policies, network policies, resource policies, compliance policies.

Implementations: IAM policies (cloud), NetworkPolicies (K8s), OPA/Gatekeeper, Sentinel.

Policy-as-Code: Rego, Sentinel, Git-versioned, automatically tested. Best practices: least privilege, deny by default, regular audits.

Policy as code is a governance approach that codifies security and compliance rules in versioned files, which are testable and automatically enforced. Principle: policies in a declarative language (Rego, Sentinel), Git-versioned, tested, automatically enforced. Use cases: infrastructure compliance, K8s admission control, API authorization, data governance. Tools: OPA (Open Policy Agent), Sentinel (HashiCorp), Kyverno, Cloud Custodian. Lifecycle: define, test, deploy, enforce, audit.

A prefix is the common beginning of a string, path or identifier, used for organization, filtering or routing. Use cases: object storage (s3://bucket/env/prod/), logging, tagging (cost-center-), networking (CIDR 10.0.0.0/16). Patterns: hierarchical organization, date-based (logs/2026/01/), namespacing. Benefits: filtering, granular IAM, lifecycle policies, cost allocation. Network prefix: CIDR notation, subnetting, route aggregation.

A principal is an identifiable entity that can perform actions and receive permissions: user, service account, role or group. Types: user principals (humans), service principals (apps), group principals, role principals. IAM context: principal = who, policies = what, resources = where, conditions = when/how. Service accounts: non-human principals, credentials (tokens), least privilege. Audit: tracking actions per principal, CloudTrail/logs.

Privacy is the protection of personal data against unauthorized access and the respect of individuals' right to control their information.

Regulations: GDPR (Europe), CCPA (California), LGPD (Brazil), PIPEDA (Canada).

GDPR principles: minimization, purpose limitation, accuracy, storage limitation, integrity.

Techniques: anonymization, pseudonymization, encryption, access controls, data masking. Privacy by Design: build protection in from the design stage.

Provenance refers to the metadata documenting the origin and complete history of a software artifact: who built it, when, how, and from which source code.

Contents: source commit, builder identity, build parameters, timestamps, environment, cryptographic signatures.

Standards: SLSA provenance (levels 1-4), in-toto attestations, Sigstore.

DevSecOps usage: supply chain security, audit compliance, integrity verification, tampering detection. Essential for trust in deployed artifacts.

pwquality rejects weak passwords at passwd time: minimum length, character diversity, dictionary-word refusal. Configured via /etc/security/pwquality.conf and the PAM stack.

Paired with faillock, it makes password access markedly costlier to force.

Quarantine is the temporary isolation of a suspect resource for security analysis without risk to production.

Use cases: compromised server, detected malware, suspect code, compliance violations.

Process: detection → automatic isolation → forensic analysis → remediation → validation → reintegration or destruction.

Network: VLAN isolation, firewall rules, EDR auto-quarantine. CI/CD: suspect commits, failed security scans, flaky tests.

A quarantine zone is an isolated network segment for analyzing suspect resources without contaminating the production environment.

Architecture: separate VLAN, restricted access (security analysts), egress blocked, enhanced logging.

Workflow: detection → automatic isolation → forensic analysis → remediation → restoration or destruction.

Automation: SOAR, EDR, SIEM triggers. Best practices: outbound zero trust, forensic snapshots, documented playbooks.

A runtime read proves the current value; it does not prove persistence. Pavois separates the two axes: a runtime-only PASS caps the grade (a clean A needs proven persistence). harden apply --reboot --scan re-scans after a real reboot, making a PASS reboot-proven.

See also effective configuration.

A regex (regular expression) is a textual pattern describing a set of strings that match a pattern.

Syntax : . (any), * (0+), + (1+), ? (0-1), ^$ (start/end), [] (class), () (group), | (or), \d\w.

DevOps uses : log parsing, input validation, grep/sed/awk, routing, alerting rules.

Tools : regex101.com, grep -E, sed, awk. Caution : complex regexes are slow, prefer dedicated parsers for JSON/XML.

Rego is the query and policy language of Open Policy Agent. Declarative and data-oriented, it describes what must be true; OPA handles the evaluation.

Principle : a rule is written once and applies everywhere OPA is present, CI/CD pipeline (Conftest), Kubernetes cluster (Gatekeeper), API authorization engine (OPA server).

Use cases : validating Kubernetes manifests and Terraform plans pre-deploy, K8s admission control, unified policy as code, policy unit tests with opa test.

Alternatives : Kyverno (native K8s YAML), CEL (inline expressions in CRDs), Sentinel (HashiCorp).

Remote access is the ability to connect to and control systems remotely over a network.

Methods : SSH (Linux), RDP (Windows), VPN, bastion host.

Security : strong auth (SSH keys, MFA), encryption, least privilege, audit logs, IP allowlisting.

Zero Trust : verify identity on every access. Tools : Teleport, Boundary, AWS SSM, Tailscale. Best practices : bastion, session recording, timeout.

RBAC (Role-Based Access Control) is a model that assigns permissions to users based on their organizational roles.

Components: users, roles (admin, developer, viewer), permissions (read, write, delete), resources.

Advantages: scalability, separation of duties, simplified onboarding, easier auditing.

Implementation: cloud IAM, Kubernetes RBAC, databases. Limitations: granularity, role explosion, limited context (ABAC is better).

RASP (Runtime Application Self-Protection) is a security technology embedded directly into the application to detect and block attacks in real time during execution.

How it works: an agent integrates into the runtime (JVM, .NET, Node.js) and intercepts critical calls (HTTP requests, database access, file system) to analyze and block malicious behavior.

Advantages vs WAF: full application context (not just network traffic), fewer false positives, protection against zero-day attacks, works even if the WAF is bypassed.

Capabilities: blocking SQL/XSS injections, path traversal detection, protection against deserialization, behavioral monitoring.

Tools: Contrast Protect, Imperva RASP, Sqreen. Usage: complementary to WAF and IAST in defense in depth.

SCAP (Security Content Automation Protocol) and its OVAL language describe compliance tests that tools like OpenSCAP (oscap) run. Most tests inspect files (textfilecontent54) and system attributes.

Limitation: reading /etc/ssh/sshd_config sees neither the Includes, nor the drop-ins, nor the configuration actually applied → misleading results. Pavois keeps the oscap report layout as a visual reference, but never its engine: it audits the effective configuration via CINC/InSpec.

A schema defines the organization, types and constraints in a data system.

Database : tables, columns, types, constraints (PK, FK). DDL to create/modify.

API : OpenAPI (REST), GraphQL schema, JSON Schema.

Patterns : schema-on-write (SQL) vs schema-on-read (NoSQL).

Evolution : migrations, backward/forward compatibility. Validation : JSON Schema, Avro/Protobuf.

seccomp (secure computing) filters syscalls via an allow/deny list (seccomp-bpf): a confined process can only call what it needs. systemd exposes it via SystemCallFilter=@system-service.

Fewer reachable syscalls means fewer kernel bugs exploitable from a compromised service.

A secret is sensitive information (password, API key, token, certificate) requiring strict protection against unauthorized access.

Types : credentials, API keys, tokens, certificates, encryption keys, connection strings.

Principles : confidentiality, encryption, regular rotation, least privilege, audit.

Storage : secrets managers (Vault, AWS SM), encrypted volumes. Anti-patterns : hardcoded, committed to Git, plaintext. Injection : env vars, mounted volumes, API fetch.

Secrets are sensitive data (passwords, API keys, certificates) requiring special protection.

Types : API keys, DB credentials, SSH keys, TLS certs, OAuth tokens.

Risks : committed to Git, logs, visible env vars, unencrypted backups.

Rules : never in cleartext in code, regular rotation, least privilege.

Detection : git-secrets, truffleHog, GitLeaks. See "Secrets Management".

Secrets management covers the practices and tools to securely store, distribute and rotate secrets.

Tools : HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Kubernetes Secrets, SOPS.

Features : encrypted storage, RBAC, audit logs, automatic rotation, dynamic secrets.

Patterns : env vars, mounted files, sidecar agent, CSI driver.

Best practices : centralize, least privilege, audit access, zero trust.

Secure Boot establishes a chain of trust from the firmware up: each link verifies the next one's signature. It counters bootkits and modified kernels, upstream of GRUB and the OS.

It complements OS hardening without replacing it: an active Secure Boot does not prevent a bad config once the system is running.

SHA-256 is a hash algorithm producing a fixed 256-bit digest to verify integrity.

Properties: deterministic, one-way, collision-resistant.

Uses: file integrity, signatures, Git commits, image digests.

Comparison: MD5 (broken), SHA-1 (deprecated), SHA-256 (standard).

Tools: sha256sum, openssl. Note: for passwords, use bcrypt/argon2.

SSL (Secure Sockets Layer) was a cryptographic protocol for HTTPS, superseded by TLS but the term is still used.

History: SSL 2.0/3.0 (broken by POODLE), replaced by TLS 1.0→1.3.

Today: "SSL" is a misnomer for TLS. SSLv2/v3 are disabled everywhere.

Migration: TLS 1.2+ minimum, prefer TLS 1.3, modern cipher suites (AEAD).

Tools: Let's Encrypt, OpenSSL, cert-manager. Terminology: say "TLS certificate", not "SSL certificate".

SSL/TLS are cryptographic protocols securing network communications through encryption and authentication.

Evolution: SSL deprecated, TLS 1.2 standard, TLS 1.3 latest (better performance).

Handshake: client hello → server hello (certificate) → key exchange → encrypted communication.

Use cases: HTTPS, encrypted email, VPN, mTLS for APIs.

Certificates: issuance by CA, renewal (Let's Encrypt), revocation if compromised.

Best practices: TLS 1.2+ only, HSTS, forward secrecy (ECDHE), automated renewal.

Security is the set of practices and measures that protect systems and data against unauthorized access and attacks.

CIA Triad: confidentiality, integrity, availability.

Layers: network, application (OWASP), infrastructure, data, identity security.

DevSecOps: shift-left, SAST/DAST, vulnerability scanning, security as code. Principles: defense in depth, least privilege, zero trust, fail secure.

SAML (Security Assertion Markup Language) is an XML standard for the secure exchange of authentication between an Identity Provider (IdP) and a Service Provider (SP).

Components : IdP (Okta, Azure AD), SP (application), Assertion (XML token).

SSO flow : access SP → redirect to IdP → auth → signed assertion → access granted.

SAML vs OAuth/OIDC : SAML = enterprise SSO (XML), OAuth/OIDC = modern (JSON, APIs). Security : signed and encrypted assertions, timestamps.

Security controls are the technical, administrative and physical measures protecting systems and data.

Types : preventive (firewall, MFA), detective (IDS, monitoring), corrective (patching), compensating.

Frameworks : CIS Controls, NIST 800-53, ISO 27001, SOC 2.

Techniques : encryption, RBAC, network segmentation, vulnerability scanning, logging.

Best practices : defense in depth, proportional to risk, documented, tested, continuous improvement.

A SIEM centralizes security logs, detects threats, and streamlines incident investigation.

Functions: log collection, normalization, correlation, alerting, dashboards.

Sources: firewalls, IDS/IPS, EDR, cloud audit logs, applications.

Detection: rules, anomalies, threat intelligence, ML.

Solutions: Splunk, Microsoft Sentinel, Elastic Security, Wazuh. DevSecOps: CI/CD logs, audit trail, compliance.

Security monitoring is the continuous observation of systems to detect threats, intrusions, and abnormal behavior.

Sources: logs, network traffic, endpoint telemetry, audit logs, auth events.

Detection: signature-based, anomaly-based, ML-based.

Tools: SIEM (Splunk, Elastic), IDS/IPS, EDR, cloud-native (GuardDuty).

SOC: a 24/7 team analyzing alerts. Best practices: log everything, correlation, playbooks, threat intel.

Security scanning is the automated examination of systems, code, or configs to identify vulnerabilities and non-compliance.

Types: SAST, DAST, SCA, container scanning, infrastructure scanning.

CI/CD integration: scan on every commit, block on critical findings, shift-left.

Tools: Trivy, Snyk, Checkov/tfsec, Nessus, OWASP ZAP.

Output: a report with severity, CVE, remediation. Best practices: scan regularly, prioritize, track remediation.

Security testing systematically validates that systems withstand attacks and protect data.

Types: vulnerability assessment, penetration testing, security audit, red team, bug bounty.

Approaches: black box, white box, grey box.

DevSecOps: automated SAST/DAST in CI, fuzzing, periodic pentests.

Standards: OWASP Testing Guide, PTES, NIST 800-115. Best practices: test regularly, define a clear scope, retest.

Segmentation is the division of a network into isolated zones to limit the spread of attacks and apply differentiated security policies.

Levels: network (VLANs), micro-segmentation (workload-level), application (web/app/db tiers).

Benefits: limited blast radius, lateral movement made difficult, compliance.

Implementations: VLANs, Security Groups, Network Policies, service mesh.

Zero Trust: segmentation is fundamental, "never trust, always verify".

SELinux labels processes and files by type and enforces a policy: a compromised service can only do what its domain allows. Three modes: enforcing (blocks), permissive (logs only), disabled.

Only enforcing protects: getenforce/sestatus give the real state; a denial is diagnosed via AVC records (ausearch -m avc, audit2why).

Signing (cryptographic signing) guarantees the authenticity and integrity of an artifact via asymmetric cryptography.

Principle: the private key signs, the public key verifies.

Applications: code signing, container image signing (cosign), Git commit signing, packages.

Tools: GPG, cosign (Sigstore), AWS KMS, Vault.

Supply chain: verify signatures in CI/CD, a "signed images only" policy, SLSA. Best practices: protect keys (HSM), rotation.

SSO (Single Sign-On) lets users log in once to access multiple applications.

How it works: an Identity Provider centralizes authentication, applications delegate to it.

Protocols: SAML (enterprise), OAuth 2.0/OIDC (modern), Kerberos.

Solutions: Okta, Auth0, Azure AD, Keycloak.

Security: mandatory MFA, session timeouts, connection monitoring, Single Logout.

An SBOM (Software Bill of Materials) is an exhaustive inventory of a software's components : dependencies, versions, licenses, provenance.

Standard formats : CycloneDX (OWASP), SPDX (Linux Foundation), SWID tags.

Contents : component name, version, license, hash, supplier, known vulnerabilities.

DevSecOps use : license compliance, vulnerability detection (CVE), supply chain security, audit.

Generation : Syft, Trivy, CycloneDX CLI. Regulation : US Executive Order 14028, EU NIS2.

SCA (Software Composition Analysis) automatically analyzes software dependencies to identify vulnerabilities (CVE) and license issues.

Detects : vulnerabilities in dependencies, incompatible licenses, outdated dependencies.

Sources : NVD, GitHub Advisory, OSV.

Tools : Snyk, Dependabot, Trivy, OWASP Dependency-Check, Renovate.

Integration : CI/CD, IDE, registry. Best practices : regular scans, stay up to date, license policy, SBOM.

SQL injection allows malicious SQL code to be inserted through unvalidated input.

Example: the input "' OR 1=1 --" bypasses authentication if the query is not parameterized.

Impacts: data theft, auth bypass, modification/deletion.

Prevention: prepared statements, ORM, input validation, WAF.

Types: in-band, blind, out-of-band. Detection: SAST, sqlmap, DAST. OWASP Top 10.

State represents the data describing the current situation of a system.

Types: application state (UI, session), server state (database), infrastructure state (config).

Stateful vs Stateless: stateful preserves state between requests, stateless = independent.

Challenges: synchronization, persistence, scalability.

Management: databases, caches, Terraform state, K8s etcd. Principle: minimize wherever possible.

SAST (Static Application Security Testing) analyzes source code to detect vulnerabilities without executing the application.

Detects : SQL/XSS injections, hardcoded secrets, weak cryptography.

Tools : Semgrep, SonarQube, CodeQL, Snyk Code.

CI/CD : scan on every PR, block on critical findings. Advantages : shift-left, broad coverage. Limitations : false positives, complementary with DAST.

A STIG details, rule by rule, the secure configuration of a product (e.g. Ubuntu 22.04), with severity (CAT I/II/III). Widely required in US government contracts.

Pavois carries the stig: tag; like CIS, it is a direct mapping (the rule prescribes the exact setting).

sudo grants scoped, logged escalation instead of a shared root. Pitfalls: NOPASSWD: ALL (defeats authentication), no use_pty (TTY hijack), preserved environment variables.

Hardening: scope each rule to the exact command, require a password, set Defaults use_pty and log.

A SUID root binary (e.g. passwd) runs as root whoever launches it: essential for a few tools, but a stray or writable SUID is a direct path to root.

Hardening: inventory (find / -perm -4000), compare to the distro baseline, strip the unexpected (chmod u-s).

The software supply chain encompasses the components, dependencies, tools and processes used to build software.

Components: source code, dependencies, base images, CI/CD tools, registries.

Risks: vulnerable dependencies, typosquatting, dependency confusion.

Protection: SCA, SBOM, lock files, signatures, SLSA.

Practices: audit dependencies, minimize them, pin versions.

A supply chain attack compromises a third-party component (library, CI action, Docker image) to infect the projects that depend on it.

Vectors: malicious dependency, compromised GitHub action, infected image, typosquatting, dependency confusion.

Notable attacks: SolarWinds, Codecov, ua-parser-js, tj-actions.

Impact: massive propagation, difficult detection.

Prevention: SHA/hash pinning, lockfiles, SBOM, Sigstore, minimal dependencies, code-reviewed updates.

SLSA (pronounced "salsa") defines security levels to protect the software supply chain.

Levels: L1 (documentation), L2 (signed build service), L3 (hardened platform).

Provenance: metadata attesting who built what, where, and when, cryptographically signed.

Implementation: GitHub Actions attestations, Sigstore, in-toto.

Adoption: Google, npm, and PyPI are integrating it progressively.

Supply chain security protects against compromises of dependencies and build processes.

Threats: malicious dependencies, build compromise, stolen credentials.

Defenses: SCA, SBOM, signatures (Sigstore), SLSA attestations.

Frameworks: SLSA, NIST SSDF, OpenSSF Scorecard.

CI/CD hardening: least privilege, audit logs, signed commits, protected branches.

sysctl sets dynamic kernel parameters (e.g. net.ipv4.ip_forward, kernel.randomize_va_space). The effective value is the running kernel's (sysctl -a, /proc/sys), resolved from a stack of files (/usr/lib/sysctl.d/, /etc/sysctl.d/, /etc/sysctl.conf).

Hardening: set the safe value and persist it in /etc/sysctl.d/, because a runtime sysctl -w regresses on reboot.

Threat intelligence (CTI) is the collection and analysis of information on cyber threats for proactive defense.

Types: Strategic (trends), Tactical (TTPs), Operational (campaigns), Technical (IOCs: IPs, hashes).

Sources: commercial feeds, open source (MISP), ISACs, dark web monitoring.

Integration: SIEM (enrich alerts), SOAR, threat hunting. Frameworks: MITRE ATT&CK, Diamond Model, Kill Chain.

Threat prevention encompasses proactive measures blocking attacks before they compromise systems.

Levels: network (firewalls, IPS), endpoint (EDR), application (WAF, input validation), identity (MFA).

Technologies: Next-Gen Firewalls, IPS, WAF, sandboxing.

Approaches: signature-based, behavior-based, reputation, ML. DevSecOps: prevention integrated into the pipeline, hardening, automated patching.

Time is a fundamental measure in distributed systems for synchronization and event ordering.

Challenges: clock skew (desynchronized clocks), network delays, event ordering.

Synchronization: NTP (ms precision), PTP (µs). Representation: Unix timestamp, ISO 8601, UTC.

Logical time: Lamport clocks, vector clocks. Best practices: UTC internally, NTP on servers, timezones at display time.

A timestamp is a precise temporal marker identifying when an event occurred, essential for logging and auditing.

Formats: Unix epoch (seconds since 1970), ISO 8601 (2024-01-15T10:30:00Z), milliseconds.

Timezone: always store in UTC, convert at display time.

Usage: logs, audit, cache expiration, database records. Generation: Date.now(), time.time(), NOW().

A token is a digital artifact representing identity or authorizations, used for authentication without transmitting credentials.

Types: access token (short-lived), refresh token (long-lived), ID token (identity), session token.

JWT: header.payload.signature, self-contained (claims), stateless, base64url encoded.

Security: HTTPS only, short expiration, signature verification, secure storage. Best practices: short-lived access tokens (1h max), rotate refresh tokens, validate issuer/audience.

TLS is the standard cryptographic protocol providing confidentiality, integrity and authentication for network communications.

Versions: TLS 1.2 (current standard), TLS 1.3 (latest, faster handshake).

Components: certificates (X.509), cipher suites (AES-256-GCM), key exchange (ECDHE), MAC.

mTLS: client and server authenticate each other mutually. Best practices: TLS 1.2+ minimum, strong ciphers, forward secrecy, HSTS, automated renewal.

Every created file inherits a mode masked by the umask. The permissive default 022 makes new files world-readable; 027 removes all access for others.

It is a system-wide safety net (set in /etc/login.defs + PAM pam_umask): it fixes the files you forget to chmod.

Unauthorized access is access to a system or data by an entity without appropriate permissions, representing a major security breach.

Types: privilege escalation, credential theft, vulnerability exploitation, insider threat.

Vectors: brute-force, phishing, SQL injection, session hijacking.

Detection: failed logins, anomalous patterns, SIEM, audit logs. Prevention: strong auth (MFA), least privilege, segmentation, encryption. Response: revocation, investigation, rotation.

The Unix timestamp is the number of seconds since January 1, 1970 00:00:00 UTC, the standard format for representing time.

Format: integer (1705312200), sometimes milliseconds. Simple, universal, no timezone ambiguity.

Conversion: date -d @timestamp (Linux), new Date(ts * 1000) (JS), datetime.fromtimestamp(ts) (Python).

Advantages: easy to store/compare, universal. Limits: hard to read, Year 2038 (solved with 64-bit). Usage: database storage, APIs, logs.

A user is a human or service entity interacting with a system, holding a unique identity and defined permissions.

Types: end user, service account, admin user, guest user.

Identity: username, user ID, email, attributes. Authentication: password, SSH key, MFA, SSO.

Authorization: roles, permissions, RBAC, policies. Lifecycle: provisioning → active → suspension → deprovisioning. Session: login, session token, timeout, logout.

Vault (HashiCorp) manages secrets, encryption keys and sensitive data with fine-grained access control.

Features: encrypted secrets storage, dynamic secrets (ephemeral credentials), encryption as a service, PKI.

Access: authentication (tokens, OIDC, K8s), policies, audit logs.

Alternatives: AWS Secrets Manager, Azure Key Vault, GCP Secret Manager. Integration: CI/CD, Kubernetes sidecar/CSI.

A vulnerability is a weakness in a system, software or process that can be exploited by an attacker to compromise security.

Types: code (injection, XSS, buffer overflow), configuration (defaults, open ports), dependencies (CVE), human (phishing).

Identification: CVE (unique identifier), CVSS (severity score 0-10), NVD (US national database).

Lifecycle: discovery → disclosure (responsible or 0-day) → patch → deployment.

DevSecOps: shift-left (scan early), SCA (dependencies), SAST/DAST (code), automated patching.

Prioritization: CVSS + exploitability (EPSS) + business context = real risk.

Vulnerability management continuously identifies, assesses, prioritizes and remediates vulnerabilities.

Cycle: discover (scanners), assess (CVSS, EPSS), prioritize (real risk), remediate, verify.

Tools: Nessus, Qualys, Trivy, Snyk, Dependabot. SLA: critical 24-48h, high 7d, medium 30d.

DevSecOps: CI/CD scans, shift-left, documented exceptions, MTTR metrics.

Vulnerability scanning automatically examines systems and applications to identify known flaws.

Types: network, host-based, application (DAST), containers, dependencies (SCA).

Tools: Nessus, OpenVAS (infra), ZAP, Burp (web), Trivy, Grype (containers), Snyk (deps).

Frequency: continuous in CI/CD, scheduled infra, ad-hoc. Limits: false positives, complement with pentests.

A WAF (Web Application Firewall) is an application firewall filtering HTTP/HTTPS traffic to protect web applications against common attacks (SQL injection, XSS, CSRF). Placed in front of the server, it inspects every request and blocks those matching malicious signatures or violating the defined rules.

Web security covers the practices and technologies that protect web applications against attacks.

OWASP Top 10: injection, broken auth, XSS, security misconfiguration, etc.

Headers: CSP, X-Frame-Options, HSTS. Protection: WAF, rate limiting, input validation, HTTPS.

Auth: MFA, OAuth/OIDC, password hashing. Testing: SAST, DAST (ZAP, Burp), pentests.

Security model built on the principle "never trust, always verify".

Unlike traditional approaches (network perimeter), Zero Trust authenticates and authorizes every request regardless of its origin.

Pillars: strong identity (MFA), micro-segmentation, least privilege, E2E encryption, continuous monitoring.

Implementations: BeyondCorp (Google), Azure AD Conditional Access, Cloudflare Access, Zscaler.

In DevSecOps, Zero Trust also applies to CI/CD: workload identity, ephemeral secrets, OIDC federation.

/etc/shadow must be 0000/0640, root only: a shadow readable by other enables offline cracking of every account. Its format encodes the algorithm ($6$ = SHA-512, $y$ = yescrypt) and password aging.

Hardening: strict permissions (DAC) + a strong algorithm + pwquality.