Change the cryptography across your network without changing your applications

• Air gap

  An interface between two systems that are not physically connected and where any logical connection is manual rather than automated. An air-gapped environment cannot reach a vendor’s cloud, so anything deployed into one has to work without calling home.

  Source: NIST , NIST SP 800-53 Rev. 5 (csrc.nist.gov)

• CASB Cloud access security broker

  Software that sits on the network between cloud service customers and cloud service providers, enforcing enterprise security policy on traffic that leaves the corporate perimeter. It is one of the tools an enterprise already runs, and it inspects access to cloud services rather than the cryptography those connections negotiate.

  Source: NIST , NIST SP 800-215 (csrc.nist.gov)

• CBOM Cryptographic Bill of Materials

  A structured inventory of the cryptographic assets in a system: the algorithms, keys and certificates in use, and how they relate to the software components that use them. CycloneDX, which publishes the format, calls it a Cryptography Bill of Materials.

  Source: OWASP CycloneDX , CycloneDX v1.6 (cyclonedx.org)

• CNSA Commercial National Security Algorithm Suite

  A specific set of cryptographic algorithms and key strengths that may be used to protect classified and unclassified national security systems. The suite was announced in 2015, replacing the former release of Suite B algorithms; CNSA 2.0 is the current revision.

  Source: NIST , CNSSI 4009-2022 (csrc.nist.gov)

• Cryptographic agility

  The capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware and infrastructures while preserving security and ongoing operations. It is the property that makes a migration a configuration change rather than a rebuild.

  Source: NIST , NIST CSWP 39-upd1 (csrc.nist.gov)

• Cryptographic module

  The set of hardware, software or firmware that implements approved cryptographic functions, including key generation, within the module’s cryptographic boundary. The module, rather than the product around it, is the unit FIPS 140-3 describes.

  Source: NIST , FIPS 140-3 (csrc.nist.gov)

• EDR Endpoint detection and response

  A device-management safeguard that watches endpoints for malicious activity and responds to it. NIST lists it beside mobile device management as a control for the risks of mobile and remote computing; like a CASB, it looks at the endpoint rather than at the cryptography a connection negotiates.

  Source: NIST , NIST SP 800-66r2 (csrc.nist.gov)

• FedRAMP Federal Risk and Authorization Management Program

  A governmentwide program providing a standardized approach to security assessment and authorization for cloud products and services used by U.S. federal agencies. An agency buying a cloud service generally expects it to hold a FedRAMP authorization at a baseline matching the sensitivity of the data involved.

  Source: FedRAMP , FedRAMP program overview (www.fedramp.gov)

• FIPS Federal Information Processing Standards

  A standard for adoption and use by federal departments and agencies, developed within NIST’s Information Technology Laboratory. A FIPS covers a specific topic in information technology to achieve a common level of quality or some level of interoperability. The post-quantum algorithms are published as FIPS 203, 204 and 205.

  Source: NIST , NIST SP 1800-12b (csrc.nist.gov)

• IL6 DoD Impact Level 6

  The level of the DoD Cloud Computing Security Requirements Guide reserved for information classified up to SECRET. The SRG is maintained by DISA and defines the baseline a cloud service is assessed against; an IL6 provisional authorization builds on a FedRAMP High authorization supplemented with DoD-specific controls, and the infrastructure must be dedicated and operated under contract to the DoD or a federal agency.

  Source: Microsoft , DoD Impact Level 6, citing Cloud Computing SRG sections 5.1.1 and 5.2.2.4 (learn.microsoft.com)

• KEM Key-encapsulation mechanism

  A set of three cryptographic algorithms (KeyGen, Encaps and Decaps) that two parties use to establish a shared secret key over a public channel. It is the shape most post-quantum encryption takes, which is why the standardized algorithm is named ML-KEM rather than being described as an encryption scheme.

  Source: NIST , FIPS 203 (csrc.nist.gov)

• ML-DSA Module-Lattice-Based Digital Signature Algorithm

  NIST’s standardized post-quantum digital signature algorithm, published as FIPS 204. Signatures prove where data came from rather than keeping it secret, so ML-DSA is what replaces the signing side of a certificate chain.

  Source: NIST , FIPS 204 (csrc.nist.gov)

• ML-KEM Module-Lattice-Based Key-Encapsulation Mechanism

  NIST’s standardized post-quantum key-encapsulation mechanism, published as FIPS 203. It is the algorithm that replaces the key exchange in protocols like TLS, and its security rests on lattice problems rather than on the factoring and discrete-logarithm problems a quantum computer can solve.

  Source: NIST , FIPS 203 (csrc.nist.gov)

• mTLS Mutual Transport Layer Security

  TLS in which both ends authenticate, not just the server. The server sends a CertificateRequest when certificate-based client authentication is wanted, and omits it when it is not; mTLS is the arrangement where it is always sent, so each side proves who it is.

  Source: IETF , RFC 8446: TLS 1.3, section 4.3.2 (www.rfc-editor.org)

• PQC Post-quantum cryptography

  Cryptography designed to secure electronic information against the future threat of quantum computers, which could eventually break many of today’s widely used cryptographic systems. PQC runs on ordinary hardware; NIST released the principal three standards in 2024 as ML-KEM, ML-DSA and SLH-DSA.

  Source: NIST , NIST Post-Quantum Cryptography project (csrc.nist.gov)

• QKD Quantum key distribution

  A method for two parties to agree a shared key using the properties of quantum mechanics, carried over a dedicated optical link; ITU-T Y.3800 describes the networks that support it. QKD is not post-quantum cryptography, which is software running on ordinary hardware, and QuProtect uses the latter.

  Source: ITU-T , ITU-T Y.3800: Overview on networks supporting quantum key distribution (www.itu.int)

• R3 QuProtect R3

  QuSecure’s post-quantum cryptography platform. The R3 is its three capabilities: Recon discovers the cryptography an organization is running, Resilience changes it at the network layer by policy, and Reporting proves what changed with a CBOM.

  Source: QuSecure , The QuProtect R3 platform

• SIEM Security information and event management

  A program that provides centralized logging capabilities for a variety of log types. A SIEM is usually where a security team already looks, which is why cryptographic findings are worth sending to one rather than to a separate console.

  Source: NIST , NIST SP 800-92 (csrc.nist.gov)

• SLH-DSA Stateless Hash-Based Digital Signature Algorithm

  NIST’s standardized hash-based post-quantum signature algorithm, published as FIPS 205. Its security rests on hash functions rather than on lattices, so it is the alternative to ML-DSA for anyone who wants a second signature scheme built on different mathematics.

  Source: NIST , FIPS 205 (csrc.nist.gov)

• SOAR Security orchestration, automation, and response

  Tooling that continuously monitors log events for known malicious and suspicious activity and generates reports on what it finds, alongside a SIEM. NIST names both as the tools behind a proactive approach to incident detection and response.

  Source: NIST , NIST SP 800-61r3 (csrc.nist.gov)

See the full glossary