Security & Identity
Authentication, authorization, and securing the software supply chain. 55 in the catalog.
| Standard | What it is |
|---|---|
| CIBA | Client-Initiated Backchannel Authentication is an OpenID Connect flow in which the application asks the identity provider to authenticate a user ou... |
| Certificate Enrolment Protocols | Protocols and standards for automating the process of requesting, issuing, and renewing digital certificates from Certificate Authorities, includin... |
| CycloneDX | CycloneDX is an OWASP-stewarded standard for software, hardware, and machine-learning bills of materials (SBOM). It provides a structured inventory... |
| DPoP (Demonstrating Proof of Possession) | DPoP binds an access token to a key held by the client, so a stolen token cannot be replayed by anyone else. The client proves possession of the ke... |
| Defense In Depth | Defense In Depth is a security strategy that layers multiple, independent controls across a system so that if one safeguard fails, others still sta... |
| DevSecOps | Development, Security, and Operations methodology that integrates security practices within the DevOps process, emphasizing security automation and... |
| Dynamic Client Registration | Dynamic Client Registration (DCR), defined in RFC 7591 with management operations in RFC 7592, is the OAuth 2.0 and OpenID Connect standard for reg... |
| FAPI | FAPI (Financial-grade API) is a set of OpenID Foundation security profiles that harden OAuth 2.0 and OpenID Connect for high-value, high-risk APIs.... |
| HTTP Message Signatures | HTTP Message Signatures (RFC 9421) defines a mechanism for creating, encoding, and verifying digital signatures over components of an HTTP message.... |
| IAM | IAM (Identity and Access Management) is the discipline and tooling for managing digital identities and controlling what those identities are allowe... |
| JSON Web Token (JWT) | JSON Web Token (JWT, RFC 7519) is a compact, URL-safe standard for representing claims securely between two parties. Tokens consist of base64url-en... |
| JWE | JSON Web Encryption (JWE, RFC 7516) defines a standard for representing encrypted content using JSON-based data structures. Part of the JOSE family... |
| JWK | JSON Web Key (JWK, RFC 7517) is a JSON data structure that represents a cryptographic key, and JWK Set represents a collection of keys. It is commo... |
| JWS | JSON Web Signature (JWS, RFC 7515) defines a standard for representing digitally signed or MACed content using JSON-based data structures. It is pa... |
| Kerberos | Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography, mediated by a trusted Key Distribution Center, to l... |
| LDAP | Lightweight Directory Access Protocol - an industry-standard protocol for accessing and maintaining distributed directory information services over... |
| Mobile Connect | Mobile Connect is the GSMA's operator-backed identity and authentication standard, built on OpenID Connect, that lets a user authenticate to a serv... |
| Mutual TLS | Mutual TLS (mTLS) authenticates both client and server using X.509 certificates during the TLS handshake. RFC 8705 standardizes its use for OAuth 2... |
| Mutual TLS (mTLS) for OAuth | RFC 8705 defines mutual-TLS client authentication and certificate-bound access tokens for OAuth. The client authenticates with an X.509 certificate... |
| Notary Project Signature Specification | The Notary Project signature specification defines a portable signature envelope for OCI artifacts and blobs, along with how those signatures are s... |
| OAuth | OAuth is an open authorization framework that enables third-party applications to access user resources without exposing credentials. It provides a... |
| OAuth 2.0 | OAuth 2.0 is an authorization framework that allows third-party applications to securely access a user's resources (such as accounts or data) on an... |
| OAuth 2.0 Security Best Current Practice | The OAuth 2.0 Security Best Current Practice is the IETF's consolidated, current security guidance for OAuth deployments. It refines and in places ... |
| OAuth 2.0 Token Exchange | Token Exchange defines how one security token is traded for another, with explicitly modelled delegation and impersonation. It carries `actor_token... |
| OAuth 2.1 | OAuth 2.1 is a consolidation of OAuth 2.0 and the extensions and security practices that have become standard since 2012. It is not a new protocol ... |
| OSCAL | OSCAL is NIST's machine-readable format for compliance documentation — control catalogs, control baselines, system security plans, assessment plans... |
| OSV Schema | The OSV Schema is an OpenSSF JSON format for describing open-source vulnerabilities, with precise affected-version ranges expressed against package... |
| OWASP | Open Web Application Security Project - A nonprofit foundation that works to improve the security of software through community-led open source pro... |
| OpenID Connect | OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0, maintained by the OpenID Foundation. It lets clients verify a user's identity... |
| PASETO | PASETO (Platform-Agnostic Security Tokens) is a specification for secure stateless tokens designed as a less error-prone alternative to JWT. It use... |
| PKCE (Proof Key for Code Exchange) | PKCE is an OAuth extension that protects the authorization code flow against interception. The client generates a secret verifier, sends its hash w... |
| Privacy By Design | A framework and approach that embeds privacy protections into the design and operation of IT systems, networked infrastructure, and business practi... |
| Pushed Authorization Requests | Pushed Authorization Requests (PAR), defined in RFC 9126, let an OAuth 2.0 client send its authorization request parameters directly to the authori... |
| RBAC | Role-Based Access Control (RBAC) is a security paradigm that restricts system access based on assigned roles rather than individual user identities... |
| Rich Authorization Requests (RAR) | Rich Authorization Requests extend OAuth with an `authorization_details` parameter carrying structured, fine-grained authorization data instead of ... |
| SAML | SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorization data between identity provi... |
| SCIM | SCIM (System for Cross-domain Identity Management, RFC 7643/7644) is a standard for automating the exchange of user identity information between id... |
| SLSA | SLSA (Supply-chain Levels for Software Artifacts) is a security framework and specification of progressive levels for hardening software build and ... |
| SPDX | SPDX (Software Package Data Exchange) is an open, ISO/IEC 5962 standard for communicating software bill-of-materials information, including compone... |
| SPIFFE | SPIFFE (Secure Production Identity Framework for Everyone) is a graduated CNCF set of specifications for workload identity. It defines a URI naming... |
| SSL/TLS | SSL/TLS (Secure Sockets Layer / Transport Layer Security) is the cryptographic protocol that encrypts data in transit across networks, authenticati... |
| SSO | SSO (Single Sign-On) is an authentication scheme that lets a user sign in once with a single set of credentials and gain access to multiple indepen... |
| SecOps | Security Operations - the practice of integrating security practices into IT operations to identify, manage, and respond to security threats and vu... |
| Secure-by-Default | A security design principle where systems and software are configured with the most secure settings from the initial deployment, requiring users to... |
| Secure-by-Design | A software development approach that prioritizes security from the initial design phase through implementation, ensuring security considerations ar... |
| Sigstore | Sigstore is an open standard and set of tools for signing, verifying, and proving the provenance of software artifacts. It provides keyless signing... |
| The Update Framework (TUF) | The Update Framework is a graduated CNCF specification for securing software update systems. It defines a set of signed JSON metadata roles and a c... |
| UMA | User-Managed Access (UMA 2.0) is a Kantara Initiative profile of OAuth 2.0 that lets a resource owner control authorization for protected resources... |
| WebAuthn | Web Authentication (WebAuthn) is a W3C Recommendation that defines a browser API for strong, public-key-based authentication using authenticators s... |
| Zero Trust | A security framework that requires all users and devices to be authenticated, authorized, and continuously validated before being granted access to... |
| Zero Trust Architecture | A security framework that requires all users and devices to be authenticated, authorized, and continuously validated before being granted access to... |
| Zero Trust Network Access | A security framework that requires strict identity verification for every person and device attempting to access resources on a network, regardless... |
| Zero-Trust Security Model | A security framework that eliminates implicit trust and requires continuous verification of all users, devices, and applications attempting to acce... |
| in-toto | in-toto is a framework and specification for cryptographically verifying the integrity of a software supply chain. It captures and attests each ste... |
| private_key_jwt | private_key_jwt is an OAuth 2.0 and OpenID Connect client authentication method in which the client proves its identity to the token endpoint by si... |