Glossary

bcrypt

A widely used password-hashing algorithm designed to be deliberately slow and to include a built-in salt, making stored passwords expensive to crack at scale. It remains a solid, well-supported choice for password storage.

blast radius

The amount of damage or access possible if one control or component fails.

ciphertext

Data that has been encrypted, rendering it unreadable without the correct key. It is the scrambled output of applying a cipher to plaintext, and protecting confidentiality means ensuring sensitive data exists as ciphertext wherever attackers might reach it.

eBPF-Based Observability

Using eBPF, a technology that safely runs custom programs inside the Linux kernel, to observe system and network activity at a deep level for security, capturing process, file, and network events with low overhead.

mTLS in Mesh

Mutual TLS between microservices, automatically managed by a service mesh, so each service authenticates the other and traffic is encrypted, providing identity-based, zero-trust-style protection of east-west communication.

plaintext

Data in its readable, unencrypted form, the input to encryption and the output of decryption. Protecting plaintext (and minimizing its exposure) is fundamental, since it is the form attackers want to obtain.

ZTNA Architecture

Zero Trust Network Access architecture: the design pattern that replaces VPN with identity- and device-aware brokered access to specific applications, granting only what's needed per session.

Zero Trust Networking

Applying zero-trust principles to the network layer, never trust the network position, verify and authorize each connection, that contrasts sharply with traditional perimeter-trust models.

Zero Trust Roadmap

A planned, phased path to adopt zero-trust architecture, identity first, then device, network, applications, that recognizes ZTA is multi-year and best implemented incrementally rather than all at once.