Every term the site uses, in plain English, each linked to the chapter that explains it properly. Type in the box to filter; it searches the definitions too, so "look-alike" finds both origin binding and homoglyphs. Below the list: the standards and frameworks worth knowing by name.
Common mix-up: encryption and hashing do different jobs. Encryption is reversible with the right key and keeps data secret in transit or at rest. Hashing is one-way and is used to check that data has not changed, or, with a slow salted algorithm, to store passwords. "Encrypting passwords" is usually the wrong tool.
When a security document cites one of these, this is what it means.
| Name | What it is | Published by |
|---|---|---|
| OWASP Top 10 | The ten most critical web application security risks, revised every few years | OWASP |
| CWE | Common Weakness Enumeration: a catalogue of software and hardware flaw types, each with a number | MITRE |
| CVE | Common Vulnerabilities and Exposures: one ID per publicly known flaw in a specific product | CVE Program (MITRE) |
| CVSS | Common Vulnerability Scoring System: a 0 to 10 severity score for a vulnerability | FIRST |
| ATT&CK | A matrix of real attacker tactics and techniques, used to plan detection | MITRE |
| CSF | The Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, Recover | NIST |
| SP 800-63 | Digital identity guidelines: passwords, MFA and identity proofing | NIST |
| SP 800-61 | Incident response guidance | NIST |
| SP 800-207 | Zero trust architecture | NIST |