Glossary

204 terms from Security Architecture Models, in plain words, each with the chapter that teaches it.

Search the glossary

A

accountability: Being the one who answers for the result, for example to the law and to customers. Kettle & Crane can hand security jobs to a cloud provider, but it stays accountable for its customers' data.
ACL (access control list): A set of rules on a router or firewall that allows or blocks traffic between network segments. It is one of the tools for logical segmentation.
active scan: A check that sends probes to a device to look for weaknesses. It is harmless on a laptop, but it can freeze an old OT controller while it is running a process.
adequacy decision: An EU ruling that another country protects personal data well enough, so under the GDPR personal data may be sent there. Without one, the transfer needs approved safeguards such as standard contract terms.
air-gapped network: A network with no connection at all to any other network: no cable, no Wi-Fi and no internet. Data only moves in or out when a person carries it, for example on a USB drive.
Ansible: An open-source Infrastructure as Code tool. It reads playbooks and makes real systems match them. Alex uses it to keep SSH settings safe on Kettle & Crane's web servers.
ansible-playbook: The command that runs an Ansible playbook so the real systems end up matching the settings written in it. Its `-e` option passes in a value, such as the file to fix. `--check` only reports what would change, and `--diff` shows each difference, which is how Alex catches configuration drift.
Apache web server: A widely used open-source program that delivers web pages to browsers. Because its source code is published, anyone can read, change and share it.
API (application programming interface): A defined set of requests that one program can send to another. In Kettle & Crane's new shop, the microservices talk to each other through APIs, and every API is one more door to guard.
API gateway: A single front door for outside requests. It checks who is calling, limits how fast each caller can send requests and logs every call, then passes the request to the right service.
architecture: The overall design of a set of systems: what runs where, who runs it and how the parts connect. Each architecture model changes what you must protect and who protects it.
ASHRAE: The engineering body that publishes data center guidelines. It recommends that air entering equipment be 18 to 27 °C, and it also gives humidity limits.
attack surface: Everything an attacker could try to reach. Every extra account, console, connection or API makes it bigger.
audit reports: Independent reports on how well a provider protects its data centers, power and services. Customers can't inspect a cloud provider's buildings, so they rely on these reports.
automatic recovery: A system's ability to notice a failure and fix itself, for example by restarting a crashed service or replacing a failed server.
availability: Whether a system is up and usable when people need it. It is the A in the CIA triad and is measured as a percentage of time, such as 99.9%.
availability zone: One of several separate data centers inside a cloud region, each with its own power and network. If you spread a system over two zones, one building is no longer a single point of failure.
AWS (Amazon Web Services): One of the largest public cloud providers. Kettle & Crane might host its shop there.
AWS CloudFormation: Amazon's Infrastructure as Code service, which builds AWS resources from template files.
AWS Lambda: Amazon's serverless service. It runs your function only when an event happens.
Azure Functions: Microsoft Azure's serverless service. It runs short functions in response to events.

B

bare metal: A whole physical machine for one owner, with nothing else running on it. It gives the strongest isolation, but all the patching and other work is yours.
blast radius: How far the damage from one breach or failure can spread. Microservices keep it small: a flaw in the catalog service does not hand over payments.
budget alerts and spending limits: Cloud settings that warn you, or stop new spending, when costs pass an amount you set. They also work as security controls, because a sudden jump in cost can reveal cryptojacking or an attack that floods a service to run up the bill.
business considerations: The non-technical factors used to choose an architecture: data sovereignty, data classification, cost, ownership, environmental requirements, scalability and risk.

C

capital expenditure (CapEx): Paying up front for things such as servers and switches, then using them for years. On-premises is mostly CapEx.
certificate authority (CA): An organization that issues digital certificates. The computers that hold its root key are so critical that they are often air-gapped.
CIA triad: The three core security goals: confidentiality, integrity and availability. Office IT usually puts confidentiality first, but OT reverses the order and puts safety and availability first.
circuit breaker: A microservices pattern. When a service keeps failing, the services that call it stop sending it requests for a while, so one failure does not jam the whole chain.
CLOUD Act: A 2018 US law that lets US law enforcement, with a warrant, require a US provider to hand over data it controls, even if the data is stored abroad.
cloud computing: Renting computing from a provider over the network instead of buying and running your own machines. You pay for what you use and can scale up or down within minutes.
cloud provider: The company that owns the data centers and rents out computing, for example AWS, Microsoft Azure or Google Cloud.
community cloud: A cloud shared by a group of organizations with the same laws, mission or security rules, such as the twelve cafés that share food safety records. The members, an outside company or both can run it.
compute: The processing power (CPUs and memory) that runs programs. Choosing compute means choosing where and how your code runs: bare metal, a virtual machine or serverless.
concentration risk: The risk that too much depends on one provider, site or system. For example, an outage in one cloud region can stop thousands of companies at once.
configuration drift: The slow way a system stops matching its approved design as people make quick changes by hand. IaC finds drift and puts the approved settings back.
containers: Lightweight packages for running code that share the host's operating system with each other. For this exam they are one more place code can run.
copyleft license: An open-source license that can require you to publish your own changes to the code. The GPL is an example.
CPU (central processing unit): The processor that runs program instructions. Together with memory, it makes up compute.
critical: A data label for data whose loss would stop the business, such as the order database. Because it is about availability, it pushes the design toward redundant, resilient architectures.
cryptojacking: An attack where criminals use stolen cloud credentials to start many large machines that mine cryptocurrency, and the victim pays the bill. Spending alerts and limits catch it early.
ct state established,related: An nftables rule that accepts packets belonging to connections already allowed, such as replies. In Alex's lab, it lets replies come back when the office starts a connection to the guest side.
custodian: The person who runs a system day to day and carries out the owner's decisions. Alex is the custodian of the ordering system, and Sam is its owner.
customer-held encryption keys: Encrypting data with keys that you control, kept away from the provider. If the provider is forced to hand over the data, it can only hand over unreadable text.
CVE (Common Vulnerabilities and Exposures): A public ID number for a known security flaw. The xz backdoor was listed as CVE-2024-3094.

D

data classification: Sorting data into levels by how much harm its exposure, change or loss would cause. Each level gets a label with its own handling rules, and the label decides where the data may live.
data diode: A one-way network link that makes it physically impossible for data to flow in the reverse direction. A network that uses one is strongly segmented, not air-gapped.
data labels: The names given to classification levels. Kettle & Crane uses public, sensitive, confidential and restricted, and the higher the label, the fewer places the data may live.
data localization: A law that requires certain data, such as health or government data, to stay inside a country. On the exam, this kind of rule counts as a data sovereignty requirement.
data residency: Where data is physically stored, for example German customers' records in the Frankfurt region.
data sovereignty: The idea that data falls under the laws of the country where it is stored. That means every copy, backup and log counts when you choose where data lives.
dedicated host: A whole physical server rented to one cloud customer, so its workloads never share hardware with other customers. Kettle & Crane uses one for its payment service.
denial of wallet: An attack that floods a pay-per-run service, such as a serverless function, with events so the owner gets a huge bill.
denial-of-service attack: An attack that makes a system unavailable, for example by flooding it with traffic.
deployment model: A description of who uses a cloud and who owns it. NIST defines four models: public, private, community and hybrid.
downtime: Time when a system is not usable. To find the downtime an availability figure allows, multiply 525,600 minutes a year by the down share; for example, 99.9% allows about 525.6 minutes.
drop-in file: An extra settings file in /etc/ssh/sshd_config.d/ that sshd reads before the rest of the main sshd_config. sshd uses the first value it finds, so a cloud image's drop-in file can quietly turn password logins back on.

E

edge computing: Putting small computers close to where data is produced, such as a sensor gateway in the roastery. It gives fast answers and keeps working offline, but edge devices are hard to guard and often too weak for strong encryption or security agents.
egress fees: Charges a cloud provider makes for moving data out of its cloud. They make leaving a provider expensive, which feeds vendor lock-in.
elasticity: Scaling out and back in automatically as the load changes, and paying only for what is used. For the holiday sale, the shop runs between two and twelve servers.
environmental requirements: The physical conditions equipment needs to work reliably: the right temperature and humidity, clean air, and protection from water, fire and shaking.
EU-US Data Privacy Framework: The EU adequacy decision that allows personal data to be transferred to the US. It is in force as of November 2026, but EU privacy regulators have asked for it to be reviewed.
event: Something that triggers a serverless function, such as a web request, a new file or a timer. A customer placing an order is an example.
exit plan: A tested way to export your data and move away from a provider if it changes its terms or closes down. Alex tests each SaaS export once a year.

F

fail-open and fail-closed: What a network security device does when it fails or loses power. Fail-open lets traffic pass, and fail-closed stops traffic.
fail-safe: A door lock that unlocks when the power fails, so people can get out in a fire. It protects people.
fail-secure: A door lock that stays locked when the power fails, protecting what is inside. A server room door may be fail-secure.
fault tolerance: A system's ability to keep working with no interruption at all when one part fails, like a disk mirror that keeps running when one disk dies. Redundancy is the usual way to get it.
fire suppression: Systems that put out fires. Many server rooms use gas instead of water sprinklers, because water ruins electronics.
firewall: A device or program that allows or blocks traffic between networks according to its rules. At Kettle & Crane, a firewall keeps the roastery's OT network apart from the office, and a firewall rule keeps guests off the office network.
function: A short program that does one job. It is uploaded to a serverless service and runs only when an event happens, like Kettle & Crane's order-confirmation function.

G

GDPR (General Data Protection Regulation): The EU's privacy law. It protects the personal data of people in the EU wherever the company is based, so it covers Kettle & Crane's German customers.
generator: A fuel-powered machine that supplies electricity for hours or days during a long outage. A UPS bridges the gap until the generator starts.
Google Cloud: One of the largest public cloud providers.
GPL (GNU General Public License): A common copyleft open-source license that can require you to publish your changes.
graceful degradation: When a part fails, the system keeps its most important features and drops the rest. When the shipping-rate service stopped answering, checkout charged a flat rate and kept selling.
grep: A Linux command that keeps only the lines that match a pattern. Alex uses it to show just the ok and changed lines of Ansible's output.

H

hardened image: A server image with unneeded features removed and secure settings applied. Every server that is added automatically should be built from it.
Heartbleed: A flaw in the open-source OpenSSL library, found in 2014, that had gone unnoticed for about two years. It shows that open code helps only if people actually review it.
HMI (human-machine interface): The screen an operator uses to watch and adjust a machine, such as the small screen beside Kettle & Crane's roaster.
horizontal scaling: Handling more work by adding more machines and sharing the work among them with a load balancer. It has almost no limit and also adds resilience.
hot and cold aisles: A server room layout where servers draw cool air from a cold aisle in front and blow hot air into a hot aisle behind. Keeping the two apart makes cooling work.
hybrid cloud: Two or more deployment models joined so data and work can move between them, usually a private cloud plus a public cloud. Hybrid mixes models, while multicloud mixes providers.
hypervisor: Software that runs virtual machines on a physical server and gives each VM its own simulated hardware and operating system.

I

IaaS (Infrastructure as a Service): A cloud service model where you rent virtual machines, storage and networks, and you patch the operating system and everything above it. Kettle & Crane's shop VM is IaaS.
IaC (Infrastructure as Code): Describing servers, networks and their settings in reviewed text files, then letting a tool build and fix the real systems from them. It gives consistency and drift control, but it copies any mistake everywhere.
ICS (industrial control system): A name for a large OT system that controls industrial processes.
image: A ready-to-build copy of a server's disk, used to create new servers. A known-good image is one you have checked is clean.
immutable infrastructure: A design where servers are never changed after they are built. To update or recover, you build a fresh server from a known-good image and throw the old one away, along with any malware on it.
Internet of Things (IoT): Everyday devices with a network connection, such as smart cameras, thermostats and printers. Unlike OT, they do not control a physical process where failure causes harm.
ip netns exec: A Linux command that runs another command inside one isolated network namespace, which acts like a separate machine in the lab. In Alex's lab, 'ip netns exec guest' means "run this on the guest phone".

L

least privilege: Giving each person or service only the rights it needs. Kettle & Crane's shipping service gets shipping data only, and the confirmation function should only read orders and send email.
lineinfile: An Ansible module that makes sure one line is present in a file, replacing any line that matches a pattern. Alex uses it to set PermitRootLogin and PasswordAuthentication to no.
load balancer: A device that shares incoming requests among servers and sends customers to whichever server is up.
logical segmentation: Separating network segments with configuration, such as VLANs, subnets and firewall rules, instead of separate hardware. It is cheap and fast, but one wrong setting can undo it.

M

managed service provider (MSP): An outside company that runs IT for you. The contract says which security jobs move to the MSP.
microservices: An architecture that splits an application into small, separate services that talk over the network through APIs, like the shop's catalog, cart, payment and shipping services. It limits the blast radius but adds APIs and network traffic to protect.
Microsoft Azure: One of the largest public cloud providers. Kettle & Crane might keep its backups there.
misconfiguration: A wrong or unsafe setting, such as cloud storage left open to the public. Most cloud data leaks come from customer misconfiguration, not from the provider.
Modbus: An old OT protocol built for closed networks, with no login and no encryption. Anyone who can reach the device can send it commands.
monolith: An application built as one big program that does everything. Kettle & Crane's first shop handled the catalog, cart, payments and shipping in one program.
multicloud: Using two or more public cloud providers at once, for example the shop on AWS and backups on Azure. It reduces lock-in but adds complexity and splits visibility.
multifactor sign-in: Signing in with more than just a password. Turning it on for staff email was Kettle & Crane's job, even though the email is SaaS.
multitenancy: Many customers (tenants) sharing the same hardware, kept apart by software. It is how public clouds work.
mutual TLS (mTLS): A form of TLS where both sides of a connection show a certificate, so each service proves who it is. A service mesh uses it between microservices.

N

network switch: A device that connects the computers on a local network. Logical segmentation splits one switch by settings, and physical segmentation uses separate switches.
nftables: The Linux firewall. In Alex's lab, 'nft -f rules.nft' loads a rule that drops traffic from the guest segment to the office segment.
nines: A shorthand for availability: 99.9% is three nines and 99.999% is five nines. Each extra nine cuts the allowed downtime by ten times.
NIST (National Institute of Standards and Technology): The US agency that publishes the standard definitions of cloud models, along with guides on OT and microservices security.
NIST SP (Special Publication): NIST guidance documents. SP 800-145 defines cloud computing, SP 800-82 Revision 3 covers OT security, and SP 800-204 covers securing microservices.

O

object storage: A cloud service that holds files in folders, such as Kettle & Crane's product photos. Whether a folder is public is the customer's own setting.
on-premises: Owning your servers and network gear and running them in your own building, like Kettle & Crane's warehouse server room. You get full control and full responsibility.
open source: Software whose source code is published, with a license that lets anyone read, change and share it. Linux, OpenSSL and Ansible are examples.
OpenSSL: A widely used open-source encryption library. The Heartbleed flaw was found in it.
OpenTofu: An open-source Infrastructure as Code tool that started as a fork (copy) of Terraform and works much the same way.
operating expenditure (OpEx): Paying as you go, every month, for what you use. The cloud is mostly OpEx.
OT (operational technology): Hardware and software that watches and controls physical things, like the PLC running Kettle & Crane's roaster. In OT, safety and availability come first, patching is slow, and segmentation is the main defense.
ownership: Who owns each part of a system and answers for it: the infrastructure, the data, and each system inside the company.

P

PaaS (Platform as a Service): A cloud service model where the provider also runs the operating system and the software platform. You bring only your application and its data.
passive monitoring: Watching network traffic by only listening, without sending probes. It is the safe way to check OT devices.
passkeys: Sign-in keys stored on a phone or laptop that replace passwords. They are faster and easier than typing codes.
PasswordAuthentication: The SSH server setting that controls password logins. Setting it to no forces admins to use SSH keys.
PCI DSS (Payment Card Industry Data Security Standard): The card industry's security rules. They don't require segmentation, but segmenting card systems shrinks what the assessor must check.
PDU (power distribution unit): The power strip in a rack that feeds each device, often with remote switching and power monitoring.
PermitRootLogin: The SSH server setting that controls whether root may log in over SSH. Alex's playbook sets it to no.
physical security: Protecting equipment from physical harm and access, such as theft, floods or careless visitors, with locks, guarded rooms and similar controls. On-premises it is your job; in the cloud it is the provider's.
physical segmentation: Separating network segments with separate switches, cables and often firewalls, so no shared setting can join them. Kettle & Crane uses it for the roastery and the card terminals.
ping: A command that sends a test message and waits for a reply, which shows whether one machine can reach another. -c 1 sends one message, and -W 2 waits at most 2 seconds.
pipeline: The automated steps that test and apply each IaC change. It can change everything, so its credentials must be guarded like an admin's.
playbook: An Ansible file, written in YAML, that lists tasks describing how a system should be set up, such as Kettle & Crane's shop-web.yml.
PLC (programmable logic controller): A small, tough computer that runs one machine, like the controller that runs the roaster's burner and roast profile.
PoE (Power over Ethernet): Powering devices such as cameras, access points and phones through the network cable. The switch that feeds them must be on the UPS too.
private cloud: A cloud used by one organization only, either in its own building or in a provider's data center. It gives full control at the highest cost.
proprietary: Software owned by a company that keeps its source code secret, such as Windows. Its real strength is vendor support and accountability, not secrecy.
public cloud: A provider's cloud that serves many tenants at once, such as AWS, Azure or Google Cloud. Sharing the cloud does not make your data public, unless someone misconfigures it.

R

ransomware: Malware that encrypts systems and demands payment, like the attack on Kettle & Crane's label server. To recover cleanly, you rebuild from a known-good image instead of rolling back a snapshot that may be infected.
redundancy: Having spare copies of parts such as servers, disks, power supplies and network links, so that one failure does not stop the system.
redundant power supplies: Two power units in one server, each fed from a different source, so the server keeps running if one fails.
region: An area of the world where a cloud provider has data centers, such as an EU region in Frankfurt. Each region contains several availability zones.
regulated data: Data controlled by law or industry rules, such as card numbers or health records. Those rules decide much of the architecture.
removable media: Portable storage such as USB drives. It is the usual way data, and sometimes malware, crosses an air gap, so air-gapped sites set strict rules for it and scan every drive before use.
resilience: A system's ability to keep working when something goes wrong and to recover quickly. Resilience is the design, while availability is the measured result.
resource exhaustion: When a flood of requests or a bug that loops forever uses up the CPU and memory, so other work on the same host slows down or stops.
responsibility matrix: A table that shows who, the provider or the customer, does each security job in each service model.
risk: The chance that something bad happens, combined with how much harm it would do. Changing the architecture moves risk around rather than removing it.
risk responses: The ways a business can respond to a risk: lower it with controls, move part of it to someone else (for example with cyber insurance), avoid it, or accept it knowingly. The system owner makes the call.
root: The all-powerful admin account on Linux. Alex's playbook stops it from logging in over SSH.
RPO (recovery point objective): How much recent data the business can afford to lose, measured in time.
RTO (recovery time objective): How long a system may be down before the harm is too great.
runtime: The software that runs your code, such as Python. In serverless, the provider handles it.

S

SaaS (Software as a Service): A cloud service model where you use a finished application in a browser, like Kettle & Crane's staff email. The provider runs everything, and you manage users, settings and data.
SBOM (software bill of materials): A list of the components inside a product, so you can tell whether a newly announced flaw affects you.
SCADA (supervisory control and data acquisition): A wide-area OT control system, such as one that runs a city's water pumps.
scalability: A system's ability to handle more work by adding resources, such as the shop growing from a few orders an hour to hundreds in the holiday sale.
secrets store: A separate, protected place for passwords and keys, so they are never typed into IaC files where they would end up in version control.
secure defaults: Settings that make a new system safe before anyone changes anything.
security agent: A monitoring program that normally runs on each server. You cannot install one on serverless servers you never see.
security groups: Firewall rules attached to each cloud server, used for segmentation in the cloud.
security implication: A security effect of a choice: a new risk, a risk that goes away, or a job that moves to someone else.
security through obscurity: Relying on secrecy alone, such as hidden code, for protection. It is weak because attackers find flaws anyway by testing the running program.
segmentation: Dividing a network into separate segments and controlling what may travel between them, so an attacker in one segment cannot reach everything. It is the main defense for OT.
sensor: A device that measures something, such as the roaster's temperature, and reports it to a controller.
serverless: Running short functions on events without managing any server. The provider handles the servers, operating system and scaling, but your code, its permissions and your data stay yours.
service level agreement (SLA): The contract that says what availability a provider must deliver and what happens if it misses. The penalty is usually service credits, not your lost sales.
service mesh: A layer that handles traffic between microservices. It can encrypt every connection and check each service's identity with mutual TLS.
service models: The three ways cloud services are sold: IaaS, PaaS and SaaS. Each one says how much of the system the provider runs for you.
shadow IT: Technology staff use without IT's approval or knowledge, such as Priya's personal file-sharing site. It often comes from a security control that is too hard to use.
shared responsibility model: The split of security jobs in the cloud: the provider secures the cloud itself, and the customer secures what it puts in it. Data and access are always the customer's job.
side channels: Ways data can leak out as sound, heat or radio signals. Researchers have shown they can cross an air gap, but these attacks are slow and rare.
single point of failure (SPOF): A part with no second copy whose failure stops everything, such as Kettle & Crane's single database. A bigger server is still a single point of failure.
single sign-on (SSO): Signing in once to reach many applications, which means fewer passwords. Alex uses it to make SaaS file sharing easy for Priya.
snapshot: A saved copy of a VM's disk at a moment in time that you can roll back to. It may still hold an attacker's access.
source code: The human-readable program text that programmers write.
source code escrow: Placing a proprietary product's code with a third party, who gives it to the customer if the vendor fails.
SSH (Secure Shell): The encrypted remote login that admins use to manage servers.
SSH keys: Keys that admins use instead of passwords to log in over SSH.
sshd: The SSH server program on Linux. 'sshd -T' prints the settings it really uses, so you can confirm that password logins are off.
sshd_config: The SSH server's main settings file, which Alex's playbook fixes.
Stuxnet: A worm, found in 2010, that crossed an air gap on removable media to reach controllers at an Iranian nuclear site.
subnet: A range of IP addresses given to one segment, such as 192.168.10.0/24 for Kettle & Crane's office. A VLAN splits a switch's ports, while a subnet splits addresses.
sudo: A Linux command that runs another command with admin rights. Alex uses it in the segmentation lab.
supply chain risk: The risk that a component or supplier you depend on, such as an open-source library, brings a weakness or a hidden backdoor into your systems. The xz attack is an example.
system owner: The named person who is accountable for a system's security, approves access and accepts its risks, like Sam for the ordering system.

T

technical considerations: The technical qualities used to compare architecture models: availability, resilience, proprietary vs open source, usability, responsibility, compute, power and ease of recovery.
tenant: One customer of a public cloud, which shares the provider's hardware with other customers.
Terraform: A common Infrastructure as Code tool that builds infrastructure from text files.
third-party risk: The risk that a provider, MSP or SaaS vendor is breached, goes out of business or makes a mistake that hurts you. Contracts, audit reports and exit plans reduce it.
TLS (Transport Layer Security): The encryption protocol that protects web traffic.
top secret, secret and confidential: Government classification levels. Data at these levels often may only live in a government community cloud or an air-gapped network.
total cost of ownership (TCO): Every cost over a system's whole life, not just the price tag, including power, cooling, space, support and staff time. It is the fair way to compare CapEx with OpEx.

U

UPS (uninterruptible power supply): A battery unit that keeps equipment running for a few minutes when the power fails, long enough to shut down safely or start a generator. Plan to load it to no more than about 80% of its rating, so Kettle & Crane's 1,200 W room needs a 1,500 W UPS.
usability: How easy a system is to use correctly. People bypass controls that are hard to use, so the secure way must be the easy way.

V

vendor lock-in: Being so tied to one supplier that leaving is too costly or slow.
version control: A system that stores every version of a file, with a record of who changed what. IaC files are kept and reviewed there.
vertical scaling: Handling more work by making one machine bigger. It is simple, but it has a ceiling, and the machine is still a single point of failure.
virtual machine (VM): A complete computer simulated in software, which shares a physical server with other VMs through a hypervisor. Kettle & Crane's shop runs on one.
VLAN (virtual local area network): A configuration that splits one switch into several separate networks, so a port on VLAN 10 cannot talk directly to a port on VLAN 30.
VM escape: A rare, severe attack where code in one VM breaks out to the hypervisor and reaches other VMs on the same server.
VPC (virtual private cloud): Your own private network inside a public cloud, used for cloud segmentation.
VPN (virtual private network): An encrypted connection into a private network over the internet. Kettle & Crane's old file system needed one, which made it awkward to use.
vulnerability scanner: A tool that actively probes systems for known weaknesses. The office scanner should not be pointed at OT controllers.

X

xz backdoor: A 2024 attack in which someone spent years earning trust on the open-source xz compression project, then hid a backdoor in it (CVE-2024-3094). It was caught before it reached most stable Linux releases.

Y

YAML: A simple text format for structured settings, used to write Ansible playbooks.

Z

Zero Trust: A security approach that never trusts a user or device just because of where it sits on the network, so every request is checked before access is allowed. It builds on network segmentation by checking each access request on its own, instead of trusting everything inside a segment.