Knowledge Base
Privacy & security, explained
A working reference for the vocabulary behind the hardware we ship — written so a smart customer can read it once and use it. 266 articles and counting.
Mobile & operating systems
- What is GrapheneOS?GrapheneOS is a hardened, de-Googled Android distribution focused on privacy and security. Used by journalists, security researchers and operators.
- What is CalyxOS?CalyxOS is a privacy-respecting Android distribution that bundles microG for push notifications and ships with Datura firewall.
- What is microG?microG is an open-source reimplementation of Google Play Services that lets apps relying on Google APIs run without a real Google account.
- What is an eSIM?An eSIM is an embedded SIM provisioned over the air — no physical SIM card needed, useful for travel but raises new operational questions for privacy.
- What is sandboxed Google Play?GrapheneOS lets you install Google Play in a tightly-permissioned user profile — apps that need Play APIs work, while the rest of the system stays Google-free.
Authentication & keys
- What is FIDO2?FIDO2 is the open authentication standard behind passkeys and hardware security keys — phishing-resistant logins backed by public-key cryptography.
- What is WebAuthn?WebAuthn is the browser API used by FIDO2-compatible sites to authenticate users via hardware keys or platform passkeys.
- What is a passkey?A passkey is a FIDO2 credential bound to a device or synced via a platform vault — the password-free replacement for username + password.
- What is U2F?U2F is the original FIDO security-key standard, now superseded by FIDO2 — most modern keys still speak U2F for backward compatibility.
- What is PIV?PIV is the US government smart-card standard for cryptographic identity — supported by YubiKey, Nitrokey and most enterprise authentication stacks.
- What is a YubiKey?YubiKey is Yubico's family of hardware authenticators — FIDO2, U2F, PIV, OpenPGP and OTP in a USB or NFC form factor.
- What is a Nitrokey?Nitrokey is the open-source German hardware-key family — FIDO2, OpenPGP, PIV and HSM variants with auditable firmware.
- What is MFA?Multi-Factor Authentication requires more than one independent factor — something you know, have, or are.
- What is TOTP?TOTP is the time-based one-time password algorithm behind Google Authenticator and similar apps — better than SMS, weaker than FIDO2.
Encrypted storage
- What is disk encryption?Disk encryption protects data at rest — without the passphrase or key, the contents of the drive are indistinguishable from random data.
- What is LUKS?LUKS is the Linux disk-encryption standard built on dm-crypt — the default on hardened Linux distributions and the underlying layer for full-disk encryption.
- What is BitLocker?BitLocker is Microsoft's full-disk encryption for Windows, typically sealed to a TPM and unlocked transparently at boot.
- What is VeraCrypt?VeraCrypt is the successor to TrueCrypt — cross-platform on-the-fly encryption for files, partitions and full system drives.
- What is LUKS?LUKS is the Linux disk-encryption standard — a metadata header on top of dm-crypt, supports multi-passphrase and key-rotation.
- What is VeraCrypt?VeraCrypt is the cross-platform successor to TrueCrypt — disk, partition and hidden-volume encryption with deniability features.
- What is BitLocker?BitLocker is Microsoft's full-disk encryption built into Windows Pro/Enterprise, anchored in the TPM.
- What is FileVault?FileVault is Apple's macOS full-disk encryption, sealed to the Secure Enclave and recovery-keyed to iCloud or a printed key.
- What is full-disk encryption?FDE encrypts the entire storage volume at rest so a powered-off device leaks nothing without the unlock secret.
- What is deniable encryption?Deniable encryption schemes let a holder reveal a decoy passphrase that decrypts to plausible-looking but separate content.
Secure communications
- What is an IMSI?An IMSI is the unique identifier of a cellular SIM — captured by IMSI-catchers (stingrays) used in lawful intercept and surveillance.
- What is an IMSI catcher (Stingray)?An IMSI catcher poses as a cellular tower to harvest device identifiers and downgrade to weaker encryption, used by law enforcement and adversaries alike.
- What is Signal?Signal is the end-to-end encrypted messenger used as the privacy baseline by journalists, activists and security professionals.
- What is Molly?Molly is a hardened Signal fork that adds local database encryption and other defensive features on Android, with optional FOSS build.
- What is SimpleX?SimpleX is a messenger built around per-conversation message queues with no user identifiers — strong metadata resistance for adversarial threat models.
- What is Session?Session is a Signal-fork messenger that removes phone-number identity and routes traffic over the Oxen onion network.
- What is DMR?DMR is the Digital Mobile Radio standard — TDMA-based digital voice and data, widely deployed for commercial and public-safety radio.
- What is P25?P25 is the North American public-safety digital radio standard — interoperable across federal, state and local agencies.
- What is TETRA?TETRA is the European trunked digital radio standard, used by police, military and critical infrastructure across most of Europe and parts of Asia.
- What is Iridium?Iridium is the LEO satellite constellation providing true pole-to-pole voice and data — used for expedition, maritime and remote-operator comms.
- What is Inmarsat?Inmarsat operates geostationary L-band satellites for voice and broadband data between roughly 70° N and 70° S — the workhorse of maritime and aviation comms.
- What is PoC PTT?Push-to-talk over cellular (PoC) gives instant-call radio behaviour over 4G LTE — without the licensing, range planning or hardware cost of dedicated RF.
- What is OTR messaging?OTR (Off-The-Record) is the legacy XMPP encryption layer with deniability and perfect forward secrecy — largely replaced by the Signal protocol and OMEMO.
- What is OMEMO?OMEMO is the modern multi-device E2EE layer for XMPP — based on the Signal double ratchet, used by Conversations, Dino and other XMPP clients.
- What is RCS messaging?RCS is the modern carrier-messaging standard replacing SMS. Apple's RCS implementation is not end-to-end encrypted; Google's Jibe-backed RCS is, in 1:1 chats.
- What is SMS?SMS is the legacy carrier text-message protocol — unencrypted, easy to intercept, never suitable for sensitive content.
- What is an eSIM?An eSIM is an embedded SIM provisioned by the carrier over the air — convenient for travel but tied to vendor-controlled profiles.
- What is dual SIM?Dual-SIM phones run two carrier profiles simultaneously — useful for separating work, personal and travel numbers.
- What is Push-to-Talk?PTT is half-duplex voice over radio or IP — instant talk-group communication without dialling, used by tactical and ops teams.
- What is DMR?DMR is a digital land-mobile radio standard (ETSI TS 102 361) used widely in business and public-safety bands.
- What is TETRA?TETRA is the European trunked digital radio standard for emergency services and critical infrastructure — encryption is layered, with mixed history.
- What is P25?P25 is the North American digital public-safety trunked radio standard.
- What is Iridium?Iridium is the LEO satellite constellation providing global voice, data and short-burst messaging via handheld terminals.
- What is Inmarsat?Inmarsat operates geostationary L-band satellites for voice and data — established in maritime, aero and BGAN data services.
- What is Starlink?Starlink is SpaceX's LEO broadband constellation — used for fixed and mobile high-throughput links, including maritime and RV.
Networking & routers
- What is Tor?Tor is the onion-routing network that hides which sites a user visits and which user is visiting a site — used by journalists, dissidents, researchers.
- What is a VPN?A VPN tunnels your network traffic to a remote server before exiting to the internet — useful for hiding your IP from sites and your traffic from local networks.
- What is WireGuard?WireGuard is a modern VPN protocol — small codebase, fast handshakes, strong defaults. Standard on travel routers and most modern VPN providers.
- What is OpenVPN?OpenVPN is the older, TLS-based VPN protocol that WireGuard has largely replaced for new deployments but remains widely supported.
- What is Mullvad?Mullvad is a Swedish VPN provider with account numbers instead of email, cash and crypto payment, and a long history of independent audits.
- What is Pi-hole?Pi-hole is a DNS-level ad and tracker blocker — runs on a small device or VM and filters lookups for every device on your LAN.
- What is DoH and DoT?DNS-over-HTTPS and DNS-over-TLS encrypt DNS lookups so your ISP and local network can't see which hostnames you resolve.
- What is GL.iNet?GL.iNet builds OpenWrt-based travel and SMB routers — small, WireGuard-friendly hardware widely used for VPN-everywhere setups.
- What is Tor?Tor is an anonymity network that routes traffic through three volunteer relays so neither your ISP nor the destination sees both ends.
- What is I2P?I2P is an overlay network optimised for hidden services running inside the network, rather than for anonymous browsing of the clearnet.
- What is a Tor onion service?An onion service is a server reachable only via Tor, addressed by a self-authenticating .onion hostname.
- What is a VPN?A VPN tunnels your traffic to a remote exit so your ISP and local network see the tunnel, not the destinations.
- What is WireGuard?WireGuard is a modern VPN protocol — short codebase, modern crypto, fast handshake, native in the Linux kernel.
- What is OpenVPN?OpenVPN is the long-standing TLS-based VPN protocol — slower than WireGuard but extremely well supported on legacy gear.
- What is IPsec?IPsec is the IETF-standard site-to-site VPN protocol family, common in enterprise gateways and mobile carriers.
- What is DNSSEC?DNSSEC signs DNS records so a resolver can verify answers were not forged in transit.
- What is a VLAN?A VLAN segments a physical LAN into isolated logical networks — used to keep IoT, guest and management traffic separated.
- What is a firewall?A firewall is a policy-enforcing network gate. Modern stateful firewalls track connections and decide per packet.
- What is IDS/IPS?Intrusion Detection and Prevention Systems alert on, or block, traffic that matches signatures or anomaly heuristics.
- What is Zero Trust?Zero Trust replaces perimeter security with per-request authentication and authorisation, on the assumption the network is hostile.
- What is BGP hijacking?BGP hijacking advertises false routes for someone else's IP space — used to intercept traffic or steal cryptocurrency.
Hardware & firmware
- What is verified boot?Verified boot cryptographically validates every stage of the boot chain — bootloader, kernel, system image — and refuses to run a modified one.
- What is Secure Boot?Secure Boot is the UEFI counterpart to mobile verified boot — it validates the bootloader and OS kernel signature before allowing them to run on a PC.
- What is a TPM?A TPM is a discrete or firmware-embedded security chip that stores cryptographic keys, measures boot integrity, and seals disk-encryption keys to a known-good system state.
- What is coreboot?Coreboot is an open-source firmware that replaces proprietary UEFI on supported hardware, reducing the attack surface inside the boot chain.
- What is Heads?Heads is a coreboot-based firmware focused on tamper-evident boot — it uses the TPM to attest the firmware and OS images before unlocking disk encryption.
- What is a secure element?A secure element is a tamper-resistant chip that holds cryptographic keys outside the main CPU — used in passports, payment cards, FIDO2 keys and modern phones.
- What is hardware attestation?Attestation lets a remote service verify your device is unmodified — the secure element signs a statement about the boot state and OS image.
- What is RF shielding?RF shielding is the broad term for any enclosure or material that attenuates radio signals — faraday bags, SCIFs, shielded enclosures.
- What is an HSM?A Hardware Security Module is a tamper-resistant device that stores and uses cryptographic keys without ever exporting them.
- What is a Secure Enclave?A Secure Enclave is a coprocessor isolated from the main CPU that holds keys and runs sensitive operations — Apple's SEP, Titan M2, ARM TrustZone.
- What is the Titan M2 chip?Titan M2 is Google's secure element in Pixel phones — handles verified boot anchor, lockscreen attestation and StrongBox key storage.
- What is ARM TrustZone?TrustZone is the ARM CPU extension that splits execution into a Normal World and a Secure World, used to run Trusted Execution Environments.
- What is UEFI?UEFI is the firmware interface that replaced legacy BIOS — exposes secure boot, runtime services, and a richer driver model.
- What is coreboot?coreboot is the open-source firmware project used as a minimal boot stage on Chromebooks, Purism, System76 and other libre-leaning hardware.
- What is Heads firmware?Heads is a tamper-evident BIOS replacement built on coreboot, providing measured boot, TPM-attested integrity and an OpenPGP-key boot challenge.
- What is verified boot?Verified boot anchors the OS to a hardware-rooted public key — the bootloader refuses to load a modified system image.
- What is measured boot?Measured boot records each firmware and OS component into TPM PCRs so a remote verifier can attest the boot state.
- What is Secure Boot?Secure Boot is the UEFI extension that validates each boot-stage's signature against a trusted key store.
- What is a TPM?A Trusted Platform Module is a chip (or firmware module) that stores keys, performs measured boot and seals secrets to hardware state.
- What is a data diode?A data diode is hardware that physically permits one-way data flow — used to bridge an air-gapped network for monitoring without exposing it to inbound traffic.
- What is a Faraday cage?A Faraday cage is a conductive enclosure that blocks external static and non-static electric fields — the basis of Faraday bags and SCIF shielding.
Operational security
- What is OPSEC?Operational security is the discipline of denying an adversary the small pieces of public information that, combined, reveal sensitive activity.
- What is metadata?Metadata is data about data — sender, recipient, time, location, device. In modern surveillance, metadata is often more revealing than message content.
- What is a faraday bag?A faraday bag is a metallized enclosure that blocks radio signals — preventing cellular, GPS, Wi-Fi, Bluetooth and UHF from reaching or leaving a sealed device.
- What is Tails?Tails is a live Linux OS that boots from USB, routes all traffic through Tor, and leaves no trace on the host machine after shutdown.
- What is Whonix?Whonix is a two-VM architecture that forces all traffic from a 'workstation' VM through a 'gateway' VM running Tor — preventing leaks from misbehaving applications.
- What is Qubes OS?Qubes is a security-by-isolation operating system that runs every application or workflow in its own Xen-based VM, contained from the rest of the system.
- Travel OPSEC basicsA short field guide to protecting devices, accounts and data when crossing borders or operating in adversarial environments.
- What is an evil-maid attack?An evil-maid attack is a brief physical-access attack that tampers with firmware, bootloader or BIOS to compromise the device the next time it's powered on.
- What is a passphrase?A passphrase is a long sequence of words used in place of a password — much higher entropy for the same memorability.
- What is an air gap?An air-gapped system has no network connectivity by design — used for code-signing CAs, cold wallets and forensic workstations.
- What is cold storage?Cold storage holds private keys on a device that has never touched the internet — the strongest defence for high-value crypto holdings.
- What is a hot wallet?A hot wallet keeps private keys on an internet-connected device. Convenient for small balances, never for treasury.
- What is an IMSI catcher?An IMSI catcher (Stingray) is a rogue cell tower that forces nearby phones to register and reveal their IMSI/IMEI.
- What is TEMPEST?TEMPEST is the NSA codename for emanations-security — preventing electromagnetic side-channels from leaking processed information.
- What is OPSEC?OPSEC is the discipline of identifying which observable details give away your activity, and removing or muddying them.
- What is a threat model?A threat model is an explicit list of who you're defending against, what they want, and what you're willing to spend to stop them.
- What is metadata?Metadata is the data about your communications — who, when, where, how long — often more revealing than the content itself.
- What is an SBOM?A Software Bill of Materials enumerates the dependencies of a piece of software — required for downstream vulnerability tracking.
- What is a reproducible build?A reproducible build means anyone can recompile the source and bit-for-bit reproduce the published binary — the defence against supply-chain implants.
- What is Tails?Tails is a live Linux distribution routing all traffic over Tor, designed to leave no trace on the host computer.
- What is Qubes OS?Qubes OS is a Xen-based desktop OS that runs every app group in its own VM — security by compartmentalisation.
- What is Whonix?Whonix is a pair of Tor-isolated VMs — workstation traffic must exit through a gateway VM, so leaks are architecturally impossible.
- What is a Stingray device?Stingray is the trade name for a class of IMSI catchers used by law enforcement to log phones near a target location.
- What is Pegasus spyware?Pegasus is NSO Group's commercial mercenary spyware — zero-click iOS and Android implants used against journalists, activists and officials.
- What is a zero-click exploit?A zero-click exploit compromises a device without any user interaction — usually via parsing of a maliciously crafted message or call.
- What is a SIM swap attack?A SIM swap moves your phone number to an attacker's SIM, defeating SMS 2FA and intercepting password resets.
- What is credential stuffing?Credential stuffing replays leaked username/password pairs across services that share users — defeated by unique passwords and FIDO2.
- What is phishing?Phishing tricks a user into entering credentials on an attacker-controlled site or app. FIDO2 keys make standard phishing unviable.
- What is RFID skimming?RFID skimming reads contactless cards or passports from a distance. Mitigated by RFID-blocking wallets and Faraday sleeves.
Cryptography
- What is OpenPGP?OpenPGP is the email and file encryption standard implemented by GnuPG, used to sign software releases and encrypt mail and source code commits.
- What is MLS?Messaging Layer Security (RFC 9420) is the modern group-messaging encryption protocol — efficient, forward-secret group ratchets standardised at the IETF.
- What is the Signal protocol?The Signal protocol (double ratchet) is the end-to-end encryption used by Signal, WhatsApp, Molly and others — forward-secret, post-compromise-secure messaging.
- What is end-to-end encryption?End-to-end encryption means only the sender and intended recipient can read a message — the server, ISP and any middlebox see ciphertext only.
- What is AES-XTS?AES-XTS is the block-cipher mode used for disk encryption — appropriate for fixed-size sectors where ciphertext must not expand.
- What is HTTPS?HTTPS is HTTP over TLS — encrypts content and authenticates the server via certificates issued by trusted CAs.
- What is TLS?TLS is the transport-layer encryption underlying HTTPS, SMTPS, IMAPS and most modern application protocols.
- What is AES?AES is the symmetric block cipher standardised by NIST in 2001 — used by full-disk encryption, TLS and almost every modern crypto stack.
- What is RSA?RSA is the legacy public-key cryptosystem based on integer factorisation — being supplanted by elliptic-curve schemes for new deployments.
- What is elliptic-curve cryptography?ECC offers comparable security to RSA at much shorter key lengths — the basis of Ed25519, X25519, P-256 and modern protocols.
- What is Ed25519?Ed25519 is a modern signature scheme — fast, deterministic, side-channel resistant. Default for SSH keys today.
- What is Curve25519?Curve25519 is the elliptic curve behind X25519 key exchange and Ed25519 signatures — designed for speed and constant-time implementations.
- What is post-quantum cryptography?PQC are cryptosystems believed to resist attack by large-scale quantum computers. ML-KEM and ML-DSA are now NIST standards.
- What is Shamir Secret Sharing?SSS splits a secret into N shares so any K of N reconstructs it — used for seed backups and HSM master keys.
- What is PGP?PGP is the long-standing OpenPGP encryption suite — public-key email and file encryption, also used for software-signing.
- What is GPG?GPG (GnuPG) is the free implementation of the OpenPGP standard, the canonical OpenPGP toolchain on Linux.
- What is age encryption?age is a small, modern file encryption tool — single binary, single recipient line, no PGP cruft.
- What is minisign?minisign is a lightweight signature tool by Frank Denis — used to sign release artefacts without the OpenPGP ecosystem.
- What is Sigstore?Sigstore is a project for transparent, keyless code signing — used to sign container images and release artefacts against a public log.
Regulatory & legal
- What is FIPS 140?FIPS 140 is the US government cryptographic-module validation standard required by many regulated buyers (federal, healthcare, finance).
- What is MDM?Mobile Device Management is the enterprise tooling used to enrol, configure and police phones, laptops and tablets across an organisation.
- Encryption export controls — the short versionUS EAR Category 5 Part 2 governs encryption exports — most consumer security gear ships under mass-market notation, but country and end-user restrictions still apply.
- What is export control on cryptography?Strong cryptography is classified under EAR Category 5 Part 2 in the US and similar regimes elsewhere — affects what we can ship where.
- What is the EU Cyber Resilience Act?The CRA imposes baseline security, vulnerability handling and lifecycle obligations on connected hardware sold in the EU.
- What is GDPR?GDPR is the EU's data protection regulation — lawful basis, data subject rights, breach notification, and significant fines.
- What is HIPAA?HIPAA is the US healthcare data protection law — applies to covered entities and their business associates.
- What is the EAR?The Export Administration Regulations are the US framework for dual-use export controls, including strong cryptography.
- What is ITAR?ITAR controls defence articles and services in the US — distinct from EAR and stricter; very little of our catalogue falls under it.
- What are the Wassenaar Arrangement controls?Wassenaar is the multilateral export-control regime that shaped national crypto and intrusion-software controls.
- What is DORA?The Digital Operational Resilience Act sets EU rules for ICT risk, third-party risk and incident reporting in financial services.
- What is NIS2?NIS2 is the updated EU directive on network and information security — broader scope and tougher penalties than the original NIS.
AI & machine learning security
- What is prompt injection?Prompt injection is an attack where untrusted text inside an LLM's context overrides its instructions and exfiltrates data or performs unintended actions.
- What is LLM jailbreaking?Jailbreaking is a class of prompt attacks that bypass an LLM's safety alignment to produce restricted output.
- What is model poisoning?Model poisoning injects malicious data into a training set so the resulting model behaves adversarially on specific triggers.
- What is data poisoning?Data poisoning manipulates training data — including scraped web data — to backdoor downstream models.
- What is model inversion?Model inversion attacks reconstruct training data (faces, text, PII) from a trained model's outputs.
- What is membership inference?A privacy attack that determines whether a specific record was part of a model's training set.
- What is differential privacy?DP is a mathematical privacy framework that bounds how much one record influences a model or query result.
- What is federated learning?Federated learning trains models across decentralized devices so raw data never leaves the user.
- What is homomorphic encryption?HE lets you compute on ciphertexts and get an encrypted result — used for confidential ML inference.
- What is confidential computing?Confidential computing runs workloads inside hardware-attested TEEs (Intel TDX, AMD SEV-SNP, ARM CCA) so the cloud operator cannot read them.
- What are LLM guardrails?Guardrails are runtime filters and policies that constrain LLM input and output (PII redaction, jailbreak detection, tool allowlists).
- What is RAG security?Retrieval-augmented generation expands the attack surface to the vector store and embedded documents — both need access control.
- What is AI agent security?Autonomous agents that call tools must be sandboxed, scoped, and observed — every tool call is a privileged operation.
- What is MCP security?Model Context Protocol exposes tools to LLMs over a standard interface — treat every MCP server as an attack-surface boundary.
- What is a deepfake?Synthetic media generated by ML to impersonate voices, faces or text — a primary vector for executive fraud and disinformation.
- What is voice-cloning fraud?Attackers clone an executive's voice from public audio and authorize wire transfers over the phone — verify out-of-band.
- AI vs privacy: what's at stakeFrontier models hoover up training data, log every prompt, and surface in browsers. Practical defenses cover on-device inference, prompt isolation, and DP.
- What is on-device AI?On-device inference (Apple Neural Engine, Pixel TPU, NPU laptops) keeps prompts and outputs local — no cloud round trip.
- What is Apple Private Cloud Compute?PCC is Apple's attested cloud inference stack — stateless, auditable, and verifiable from the device.
- What is LLM watermarking?Statistical fingerprints embedded in generated text so the output can later be attributed to a model.
Quantum & post-quantum
- What is quantum computing?Quantum computers use qubits and superposition to solve specific problem classes — including breaking RSA and ECC at scale.
- What is post-quantum cryptography (PQC)?PQC is the family of classical algorithms designed to resist attack by both classical and quantum computers.
- What is ML-KEM (Kyber)?ML-KEM is the NIST-standardized lattice-based key encapsulation mechanism — FIPS 203, replacing RSA/ECDH for key exchange.
- What is ML-DSA (Dilithium)?ML-DSA is NIST's standardized lattice-based digital signature — FIPS 204, replacing RSA/ECDSA signatures.
- What is SLH-DSA (SPHINCS+)?SLH-DSA is NIST's hash-based stateless signature — FIPS 205, a conservative PQC fallback with no lattice assumptions.
- What is Falcon?Falcon is a compact lattice signature scheme selected by NIST for use cases that need small signatures.
- What is "harvest now, decrypt later"?Adversaries capture and store encrypted traffic today, planning to decrypt it once quantum computers can break RSA/ECC.
- What is hybrid PQC?Hybrid PQC pairs a classical KEX (X25519) with a PQC KEM (ML-KEM) so a break of either still leaves the session secure.
- What is cryptographic agility?Agility is the ability to swap algorithms without redesigning the protocol — a prerequisite for surviving PQC migration.
- What is quantum key distribution (QKD)?QKD uses quantum mechanics to generate a shared key over a fiber link — a niche solution with strict deployment constraints.
- What is Grover's algorithm?Grover gives a quadratic speedup on unstructured search — symmetric keys should double in length (AES-128 → AES-256) to remain safe.
- What is Shor's algorithm?Shor's algorithm factors integers and computes discrete logs in polynomial time on a quantum computer — breaking RSA, DH, and ECC.
- What is a quantum-safe VPN?A VPN that negotiates session keys with hybrid PQC (X25519 + ML-KEM) so harvested traffic stays safe after Q-day.
- What is quantum-safe messaging?Messaging protocols (Signal PQXDH, iMessage PQ3) that use PQC handshakes to survive harvest-now-decrypt-later.
- NIST PQC timelineFIPS 203/204/205 finalized in 2024. Government deadline for retiring RSA-2048/ECC P-256: by 2030–2035.
Cloud & zero trust
- What is zero trust?Zero trust is a security model that never grants implicit trust based on network location — every request is authenticated and authorized.
- What is BeyondCorp?Google's zero-trust architecture — access decisions based on device posture and user identity, not VPN topology.
- What is ZTNA?Zero Trust Network Access replaces VPNs with per-app, identity-aware proxies.
- What is SASE?Secure Access Service Edge converges SD-WAN, ZTNA, SWG, CASB and FWaaS into a cloud-delivered fabric.
- What is mTLS?Mutual TLS authenticates both client and server with certificates — the spine of service-to-service zero trust.
- What is SPIFFE/SPIRE?SPIFFE is an identity framework for workloads; SPIRE issues short-lived SVIDs so services can authenticate without static secrets.
- What is workload identity?Workload identity replaces long-lived service-account keys with attested, short-lived tokens.
- What is least-privilege IAM?Grant the minimum permissions needed and expire them on a schedule — IAM is the new perimeter.
- What is CSPM?Cloud Security Posture Management continuously audits cloud configs for misconfiguration and drift.
- What is CNAPP?Cloud-Native Application Protection Platform combines CSPM, CWPP, CIEM and IaC scanning into one stack.
- What is secrets management?Centralized vaulting and rotation of API keys, tokens, and certs — never check secrets into git.
- What is BYOK?Bring Your Own Key — customer-managed keys in cloud KMS so the cloud provider cannot unilaterally decrypt your data.
- What is HYOK?Hold Your Own Key — keys never leave your HSM; the cloud only sees ciphertext.
- What is a TEE?A Trusted Execution Environment is a CPU-isolated region (Intel TDX, AMD SEV-SNP, ARM TrustZone) for confidential workloads.
Blockchain & self-custody
- What is self-custody?Self-custody means you hold the private keys to your crypto — no exchange, no third party, no withdrawal queue.
- What is cold storage?Cold storage keeps signing keys on devices that have never touched the internet.
- What is an air-gapped wallet?A signing device that communicates only via QR codes or microSD — no USB, no Bluetooth, no Wi-Fi.
- What is multisig?Multi-signature schemes require M-of-N keys to authorize a transaction — institutional standard for self-custody.
- What is an MPC wallet?Multi-Party Computation wallets split a key across parties using threshold cryptography — no single key exists.
- What is a seed phrase?A BIP-39 mnemonic that deterministically derives all wallet keys — protect it like the underlying funds.
- What is a passphrase (25th word)?An extra user-chosen word that creates a hidden wallet on top of a seed — plausible deniability under coercion.
- What is BIP-39?BIP-39 standardizes mnemonic seed phrases used by most hardware wallets.
- What is BIP-32?BIP-32 specifies hierarchical deterministic (HD) wallets — derive unlimited keys from one seed.
- What is BIP-85?BIP-85 derives child seeds from a master seed — generate isolated wallets without storing extra mnemonics.
- What is PGP-signed firmware?Hardware-wallet firmware signed by the vendor's PGP keys so the device refuses to run modified binaries.
- Supply chain attacks on hardware walletsTampered devices, swapped firmware, and pre-initialized seeds — buy direct, verify on-device, generate your own seed.
- What is CoinJoin?CoinJoin breaks the on-chain link between sender and receiver by batching transactions from multiple users.
- What is Monero?Monero is a privacy-by-default cryptocurrency using ring signatures, stealth addresses, and confidential transactions.
- What is a stealth address?A one-time receiving address derived from a recipient's view key — breaks on-chain linkability.
- What is chain analysis?Heuristics and clustering applied to public ledgers to de-anonymize wallets — defeated by privacy coins and CoinJoin.
- Crypto self-custody OPSEC checklistHardware wallet, passphrase, metal seed backup, dedicated signing laptop, FIDO2 on every exchange.
Business & enterprise security
- What is a CISO?Chief Information Security Officer — owns the security strategy, risk register, and incident response for the organization.
- What is a vCISO?A fractional or virtual CISO — outside operator who runs the program for SMBs that cannot justify a full-time exec.
- What is SOC 2?AICPA audit framework for service organizations — covers security, availability, processing integrity, confidentiality, privacy.
- What is ISO 27001?International standard for information security management systems (ISMS) — risk-based and certifiable.
- What is PCI DSS?Payment Card Industry Data Security Standard — mandatory for anyone handling cardholder data.
- What is HIPAA?US healthcare data privacy law — covered entities and business associates must protect PHI.
- What is GDPR?EU regulation governing personal data processing — extraterritorial, fines up to 4% of global revenue.
- What is CCPA/CPRA?California's consumer privacy regime — opt-out rights, data deletion, and a dedicated enforcement agency.
- What is FedRAMP?US federal program standardizing cloud-service security assessment and authorization.
- What is CMMC?Cybersecurity Maturity Model Certification — required for the US Defense Industrial Base.
- What is ITAR?International Traffic in Arms Regulations — US controls on defense articles, services and related technical data.
- What is EAR?US Export Administration Regulations — controls on dual-use commercial items including strong cryptography.
- What is BEC?Business Email Compromise — attackers impersonate execs or vendors to redirect wire transfers. Verify out-of-band.
- What is insider threat?Risk from employees, contractors or partners with legitimate access — controlled by least privilege, UEBA, and DLP.
- What is DLP?Data Loss Prevention — policies and controls to stop sensitive data from leaving the organization.
- What is EDR?Endpoint Detection and Response — continuously monitor endpoints for IoCs and enable rapid response.
- What is XDR?Extended Detection and Response — correlates signals across endpoints, network, identity and cloud.
- What is a SIEM?Security Information and Event Management — central log aggregation, correlation and alerting.
- What is SOAR?Security Orchestration, Automation and Response — playbooks that automate triage and containment.
- What is an MSSP?Managed Security Service Provider — outsourced monitoring, detection and response.
- What is MDR?Managed Detection and Response — outsourced 24x7 SOC with active threat hunting.
- What is a tabletop exercise?A discussion-based incident-response drill — cheap, fast, and the single most under-used security control.
- What is purple teaming?Red and blue teams working together — offense informs detection engineering in near real time.
- What is threat modeling?Structured exercise (STRIDE, PASTA) to enumerate threats against a system before it ships.
Supply chain security
- What is an SBOM?Software Bill of Materials — a manifest of every component in a build, required by US EO 14028.
- What is SLSA?Supply-chain Levels for Software Artifacts — framework for build integrity and provenance.
- What is Sigstore?Keyless code signing using OIDC identities and a public transparency log.
- What is in-toto?A framework for cryptographically verifying every step of a software supply chain.
- What are reproducible builds?Bit-identical builds from the same source — anyone can verify the published binary matches the code.
- What is dependency confusion?Attackers publish a malicious public package with the same name as a private internal package and hijack the build.
- What is typosquatting?Malicious packages registered with names visually similar to popular libraries.
- What was the SolarWinds attack?Nation-state supply-chain compromise that inserted a backdoor into Orion updates and reached thousands of orgs.
- What was the xz-utils backdoor?Multi-year social-engineering attack that planted an SSH backdoor in a core Linux compression library.
- What is a hardware supply-chain attack?Tampering with devices during manufacture, shipping or warehousing — defeated by tamper-evident packaging and attestation.
- What is firmware attestation?Cryptographic proof that the running firmware matches a known-good measurement — anchors verified boot.
- What is an evil-maid attack?Physical access by a hotel cleaner, customs officer or border agent to a laptop — defeated by secure boot, full-disk encryption and tamper-evident seals.
Biometrics & identity
- What are passkeys?Passkeys are FIDO2 credentials synced across a user's devices — passwordless, phishing-resistant authentication.
- What is WebAuthn?W3C standard for public-key web authentication — the protocol behind FIDO2 security keys and passkeys.
- What is CTAP2?Client to Authenticator Protocol — how browsers talk to USB/NFC/BLE security keys.
- What is Apple's Secure Enclave?A dedicated security coprocessor on Apple silicon that stores keys and runs Touch ID/Face ID matching.
- What is Titan M2?Google's dedicated security chip on Pixel devices — anchors verified boot and key attestation.
- What is StrongBox?Android API that stores keys in a tamper-resistant security chip (Titan, StrongBox-class TEE).
- What is iris recognition?Biometric authentication using the unique pattern of the iris — high entropy, low FAR.
- Can Face ID be spoofed?Modern structured-light face systems resist photo/video attacks; 3D-printed masks and twins remain edge cases.
- Can fingerprints be spoofed?Yes — capacitive readers can be fooled by glue or silicone lifts. Pair biometrics with PIN/passphrase fallback.
- Biometric vs PIN: legal implicationsIn many jurisdictions a court can compel a biometric unlock but not a PIN — threat-model the difference.
- What is decentralized identity (DID)?User-controlled identifiers (W3C DIDs, Verifiable Credentials) issued and verified without a central IdP.
- What is a zero-knowledge proof?A cryptographic proof that a statement is true without revealing the underlying data — basis of privacy-preserving identity.
- What is eIDAS 2.0?Updated EU digital-identity regulation introducing the European Digital Identity Wallet.