Skip to content

Security Glossary

Machine translation of the French original.

Each term is given twice: its general definition, and what it refers to within this park. The second column is the same length as the first – the same word may refer to two unrelated things (the "SCA" in dependency analysis is not the "SCA" of the SIEM), and this is where misunderstandings arise.

The terms are arranged by major function, in the order that an attack encounters them: prevent, understand its weaknesses, detect, respond, survive, prove.

Prevent – to stop entry

Term Definition Within this park
Perimeter, edge The first component that receives traffic from the Internet. A perimeter proxy hosted on the NAS storage, behind the router's NAT. This is not the container host.
Reverse proxy A server that receives requests, terminates TLS, and forwards them to the appropriate internal service. Two layers: the perimeter, and then an internal proxy (Caddy) that routes to the containers.
TLS, certificate Transport encryption; the certificate proves the identity of the site. Issued by ACME; a probe checks for certificates that are actually served, not those present on disk.
DNS-01 An ACME challenge where you prove control of a domain by publishing a temporary DNS record. Allows you to issue a certificate for a service that is not exposed to the Internet.
Bouncer The component that enforces a blocking decision made elsewhere. CrowdSec makes the decision, and an integrated module within the internal proxy enforces it (response 403).
L3 / L7 Network layer (addresses, packets) / application layer (HTTP). An L3 block terminates the connection, while an L7 block rejects the request. Web attack mitigation is performed at L7: this is the only layer where the real client address is known.
Fail-open / fail-closed The behavior of a protection mechanism when it fails: allow everything (open) or deny everything (closed). Each layer has a failover mode. This is chosen and configured – a default failover mode is a decision that no one has made.
SSO Single sign-on for all services. Authentik, a single identity provider.
OIDC Standard identity delegation protocol: the application receives a signed token and knows who is connected. The default configuration for any new service.
forward_auth The proxy asks the identity provider "Do they have permission?" before allowing access. The application itself does not know who is there. A last resort for a service without any notion of accounts. Never used in conjunction with OIDC.
MFA Second factor (one-time code, hardware key) in addition to the password. Required for privileged accounts, and verified by a probe rather than assumed.
Least privilege Each account has only the rights it needs. Service tokens are limited to their intended use; an application without an explicit access policy is considered open to any authenticated account, and therefore needs to be secured.
Secrets vault Centralized and encrypted storage of passwords, tokens, and keys. Self-hosted; a value is read out via a pipe, never via the command line.
SOPS + age SOPS calculates the values of a configuration file; age provides the algorithm and the key pair. Environment variables for stacks are versioned, encrypted, and decrypted in memory at startup.
Supply Chain Everything we don't explicitly write but execute: images, packages, dependencies. Covered by the quarantine of versions, image scanning, and SBOMs.
Quarantine of Versions Reject any package version published less than N days ago. Seven days, across the three JavaScript package managers – each with its own unit (days, minutes, seconds).
SBOM Software Bill of Materials: the inventory of all components of a software. One SBOM per running image, regenerated weekly.
CycloneDX Standard SBOM format (OWASP). Produced by Trivy.
Hardening Reducing the attack surface of a system: unnecessary services, permissions, options. Continuously evaluated by the SIEM against CIS benchmarks.
CIS Benchmark Public repository of secure configurations, by operating system. SIEM configuration assessment policies.

Knowing Your Weaknesses – Vulnerabilities

Term Definition In this park
CVE Public identifier for a known vulnerability. Searched for in images (Trivy), on hosts (SIEM), and in the inventory of deployed versions (OpenCVE).
CVSS, severity A theoretical severity score for a CVE. The starting point for prioritization, but not the final destination.
EPSS The probability that a CVE will be exploited within 30 days (published by FIRST). Used in risk scoring.
KEV CISA's catalog of CVEs that are actually exploited. Skips a CVE at the top of the list. A CVE from the KEV can have a low EPSS: the two are not interchangeable.
Exposure The accessibility of a service: public with only application-level authentication, public behind an identity provider, or internal. The third axis of the score, along with severity and exploitation.
SAST Static analysis of source code to identify defects. Semgrep, on repositories.
SCA (dependencies) Software Composition Analysis: the CVEs of the libraries that a project uses. Trivy in file system mode. No relation to the SCA in the SIEM below.
Bad IaC configuration A defect in an infrastructure file (e.g., a configuration file, YAML). Trivy, even with the same settings as dependencies.
Triage Deciding the fate of a finding: open, ignored, deferred, false positive. Each decision is recorded, with its author, in an audit log.

Detecting – seeing what's happening

Term Definition In this park
SIEM A platform that collects, correlates, and alerts on logs from the entire park. Wazuh: a manager, and an agent on each machine.
EDR / XDR Detection and response on endpoints (devices), extended to multiple sources. Wazuh agents and their automated responses.
FIM File Integrity Monitoring: alert when a monitored file changes. Wazuh's integrity module.
SCA (SIEM) Security Configuration Assessment: evaluation against a standard. CIS benchmarks applied by Wazuh.
Rootcheck Detection of rootkits, hidden files, and ports. Wazuh module – making dedicated tools of the same type redundant.
osquery Querying the state of a machine using SQL: processes, services, scheduled tasks. Integrated within the SIEM, not alongside: a single inventory to reconcile.
Persistence Mechanism that an attacker uses to survive a reboot: scheduled task, service, authorized SSH key. Enumerated by osquery on Linux, by KnockKnock on the macOS workstation.
IDS / NDR Network Intrusion Detection: signatures applied to network traffic. Suricata, placed at the point where traffic converges.
Signature Known attack pattern, in a stream or file. Open rule sets, refreshed without manual intervention.
System Call Request that a program makes to the kernel: open a file, start a process, establish a connection. What is observed by runtime detection.
eBPF Linux kernel mechanism that allows observing system calls without loading a module. The "modern eBPF" probe from Falco: nothing to compile, nothing to recompile after a kernel update.
Runtime Security Detecting abnormal behavior while a program is running. Falco: An open shell inside a container, reading a sensitive file, writing to a scheduled task.
YARA A rule language for recognizing malicious files by their content. Thousands of public rules, plus a custom "dummy" rule.
Signature-based Antivirus Recognizes a known malicious file. A central ClamAV engine, queried by the network.
Deep Static Analysis Decompiling a file (archive within archive, document, embedded object) and analyzing each piece, without ever executing it. Strelka.
Sandbox Running a suspicious file in an isolated environment to observe its behavior. Rejected by decision: the volume of files doesn't justify it. It will return when a real sample passes both engines.
IOC Indicator of Compromise: Known addresses, domains, or fingerprints associated with malicious activity. Three lists (addresses, domains, fingerprints) consulted in real-time by the SIEM.
Threat Intelligence A stream of IOCs and contextual information about attackers. Consumed, not produced: public lists and CrowdSec community blocking.
CDB List Key → value that Wazuh rules consult when an event arrives. Refreshed by a scheduled task, monitored for freshness.
False Positive An alert on legitimate behavior. Handled by a named exception, never by disabling an entire rule.
Noise The volume of alerts a detector produces on a healthy system. Measured before a notification is armed.
Functional Test, Canary A known, pre-loaded element used to verify that a detector still functions. YARA canary rule, EICAR file, shell within a disposable container, investigation request across the entire fleet.
EICAR A standard, harmless test file that all antivirus software should recognize. Daily test of the antivirus engine.

Respond – Act

Term Definition In this park
Alert Distribution A central point where all emitters post, and which duplicates to destinations. A dedicated service; two output messaging channels, with a direct fallback if the distributor is silent.
Hysteresis Distinct thresholds for opening and closing an alert, to prevent it from flickering. Mandatory for any recurring notification.
Automatic Response An action triggered by a detection rule: blocking a source, restarting a service, isolating. An active response from Wazuh, linked to specific rule identifiers.
Timeout (of a block) The duration after which an automatic block is automatically lifted. Systematic: a permanent block on a false positive is a failure that we inflict on ourselves.
SOAR Orchestration and automation of the response. The distributor and existing workflow engine; no third orchestrator.
DFIR Digital Forensics and Incident Response: investigating during and after an incident. Velociraptor.
Hot Investigation Querying machines during the incident, on a question that was not initially planned. Velociraptor, client on each machine.
VQL Velociraptor's query language. Queries logged in a runbook.
Hunt The same query launched on an entire fleet at once. Also serves as a witness: as many responses as there are posts, otherwise something is silent.
Significant Incident (NIS2) An incident causing a serious disruption or significant damage (Article 23 §3). Recorded in a dedicated log, with its deadlines calculated.

Surviving – Business Continuity

Term Definition In this park
RPO Recovery Point Objective: The maximum acceptable data loss, i.e., the age of the last usable backup. Measured during a test, not derived from the plan.
RTO Recovery Time Objective: The duration of the recovery process. Measured from the time the application responds.
Immutability, append-only A backup that cannot be modified or deleted from the source system. Verified by attempting to delete it using the source system's access, and waiting for a refusal.
Object Locking Immutability enforced by the object storage itself, for a given duration. One possible form of off-site immutability.
Ransomware Software that encrypts data, and backs it up if it reaches it. It creates fresh backups – of encrypted content.
Restore exercise Actual, timed restore on a new machine. Recorded in a log; a probe fails if it is more than 90 days old.
Master key The key that all other keys depend on. The aging key that decrypts all stack secrets.
Offline copy A copy that does not touch any network: paper, disconnected storage. For the master key, verifiable without ever displaying it.

Proving – Compliance

Term Definition In this park
NIS2 Directive (EU) 2022/2555: Mandatory cybersecurity measures for essential and important entities. Voluntarily applied, as a measurement framework: a personal park is not an NIS2 entity.
Article 21 §2 The ten minimum NIS2 measures, numbered a) to j). Each control in the catalog is linked to one.
Article 23 Notification of significant incidents: early alert within 24 hours, notification within 72 hours, final report within one month. Deadlines are calculated by the incident log.
SOC 2 Report from a qualified auditor (CPA) on an organization's controls. Type I: at a specific date; Type II: over a period. No tool is "SOC 2 certified": a tool can produce the evidence package that an auditor would request.
TSC Trust Services Criteria: the SOC 2 criteria – security, availability, confidentiality… Each control is linked to it, as with NIS2.
Control A security measure that can be proven to be working. Around thirty, identified and versioned in a catalog.
Common Controls Framework A control implemented once, linked to multiple frameworks at the same time. One catalog is used for both NIS2 and SOC 2.
Evidence A dated measure that demonstrates that a control is working. The result of a probe, or an attestation.
Probe A script that measures a fact and produces pass, fail, or indeterminate. One per fact measured, launched every six hours.
Indeterminate The result of a probe that was unable to measure. An unreachable target produces indeterminate, never pass.
Attestation A dated human statement, for what no probe can measure: governance, training, suppliers. Reserved for an authenticated session, and it expires.
Derived Status A status calculated from evidence, never captured. "Effective," "failed," or "unverified," recalculated each time it is read.
Chained Register A journal where each entry contains the imprint of the previous one: any modification breaks the chain. All evidence is entered here, with only additions.
Anchor The header imprint of the register, published outside of the machine that holds it. Versioned daily in Git, on two remote repositories: it reveals a truncation that the chain alone cannot see.
Reverse Verification Intentionally causing a control to fail in order to prove that it can fail. Required of each probe before admission.
Audit Log Complete export: catalog, statutes, evidence, incidents, method. Produced on demand, in a single file.

Next to Read

Dernière vérification de cette page : 2026-09-11