# Security Privacy Compliance > Every term in this category is listed as one record, with its kind, its definition and its aliases, the principles whose relations name it, the principle or… Page: Ontology · Lexicon Canonical: https://banes-lab.com/ontology/lexicon#lex-category-security-privacy-compliance Every term in this category is listed as one record, with its kind, its definition and its aliases, the principles whose relations name it, the principle or contract that carries the same name where one exists, and the layer its category belongs to. ### Ad-Hoc Permission Checks - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Authorization logic scattered inline throughout the codebase instead of centralized, leaving checks inconsistent and easy to omit. Referenced by [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md) ### Ambient-Credential Trust - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Treating any request that carries ambient credentials, such as a session cookie, as legitimate without verifying its origin or intent. Referenced by [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md) ### Analytics/Personalization - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to analyze collected data and tailor experiences to individuals, in tension with strict data minimization. Referenced by [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md) ### Anonymous Sensitive Access - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Permitting access to sensitive resources without first establishing the caller's identity. Referenced by [Authentication](https://banes-lab.com/records/arch/authentication.md) ### Assets - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The data, systems, and capabilities of value that a threat model enumerates as the things worth protecting. Referenced by [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md) ### Assumption-Driven Security - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Designing defenses around assumed threats rather than a deliberate analysis of realistic attack vectors. Referenced by [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md) ### Attribute Definitions - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Declared descriptions of the subject, resource, action, and environment attributes that an access policy evaluates. Referenced by [ABAC](https://banes-lab.com/records/arch/attribute-based-access-control.md) ### Authenticated Principal - Kind: [model](https://banes-lab.com/records/kind/model.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The verified identity of the user or service on whose behalf a request executes, against which permissions are checked. Referenced by [Authorization](https://banes-lab.com/records/arch/authorization.md) ### Authenticated-Equals-Authorized - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Conflating authentication with authorization, so any authenticated caller is granted access without a permission check. Referenced by [Authorization](https://banes-lab.com/records/arch/authorization.md) ### Authorization Policy - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The declared set of rules determining which principals may perform which actions on which resources. Referenced by [Access Control](https://banes-lab.com/records/arch/access-control.md) ### Automated Control - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to enforce rules automatically at runtime without manual intervention. Referenced by [Policy Enforcement](https://banes-lab.com/records/arch/policy-enforcement.md) ### Bounded Session Lifetime - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a session's validity is time-limited so that access does not persist indefinitely. Referenced by [Session Management](https://banes-lab.com/records/arch/session-management.md) ### Broad Admin Access - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Granting sweeping administrative privileges by default instead of the least access each role requires. Referenced by [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md) ### Certificate Management - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of issuing, deploying, renewing, and revoking the digital certificates that transport encryption depends on. Referenced by [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) ### Client Complexity - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree of additional effort a protective measure imposes on client implementations. Referenced by [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md) ### Coarse-Grained Permission Management - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to manage access by assigning broad, role-level permission sets rather than per-individual grants. Referenced by [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md) ### Compromise Containment - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to keep a breach confined to one layer or segment so it cannot spread system-wide. Referenced by [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md) ### Confidentiality - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which data is kept secret from all but authorized parties. Referenced by [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) ### Confidentiality of Stored Data - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which data held at rest remains unreadable to anyone without authorized access. Referenced by [Encryption at Rest](https://banes-lab.com/records/arch/encryption-at-rest.md) ### Consent/Policy - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The recorded permission and governing rules under which personal data may lawfully be collected and processed. Referenced by [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md) ### Context-Aware Authorization - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to base access decisions on the runtime context of a request, such as its attributes, its environment and the resource's state. Referenced by [ABAC](https://banes-lab.com/records/arch/attribute-based-access-control.md) ### Context-Aware Encoding - Kind: [technique](https://banes-lab.com/records/kind/technique.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Choosing an output encoding matched to the destination context, such as HTML, an attribute, a URL or a script, so data is neutralized wherever it lands. Referenced by [Output Encoding](https://banes-lab.com/records/arch/output-encoding.md) ### Continuous Authorization - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The practice of re-verifying a caller's authorization on every request rather than trusting a single earlier check. Referenced by [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md) ### Control Selection - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of choosing which security controls to apply based on identified threats and their priority. Referenced by [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md) ### Controls - Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The safeguards and countermeasures put in place to reduce security or compliance risk to an acceptable level. Referenced by [Compliance](https://banes-lab.com/records/arch/compliance.md) ### Data Minimization - Kind: [principle](https://banes-lab.com/records/kind/principle.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Collecting and retaining only the personal data strictly necessary for a stated purpose. Referenced by [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md) ### Data Protection - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to safeguard data against unauthorized access, loss, or disclosure throughout its lifecycle. Referenced by [Encryption at Rest](https://banes-lab.com/records/arch/encryption-at-rest.md) ### Defined Policy - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition An explicit, declared set of rules specifying what is permitted or denied, against which enforcement acts. Referenced by [Policy Enforcement](https://banes-lab.com/records/arch/policy-enforcement.md) ### Developer Ergonomics - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system is convenient and pleasant for developers to work with. Referenced by [Security by Design](https://banes-lab.com/records/arch/security-by-design.md) ### Document-Only Policy - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Expressing security policy only as prose documentation, so it cannot be enforced automatically and drifts from what the system does. Referenced by [Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md) ### Dynamic Query Flexibility - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree of freedom to vary a query's structure at runtime, constrained when inputs must be bound as parameters. Referenced by [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md) ### Ease of Initial Use - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system is easy to start using without upfront configuration. Referenced by [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md) ### Evidence Automation - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to generate and collect compliance evidence automatically from live systems rather than assembling it by hand. Referenced by [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md) ### Feature Exposure - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which functionality is made accessible, which broadens capability but enlarges the attack surface. Referenced by [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md) ### Fine-Grained Access Control - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to grant or deny access at a precise level using specific attributes rather than broad roles. Referenced by [ABAC](https://banes-lab.com/records/arch/attribute-based-access-control.md) ### Forged-Request Rejection - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to detect and reject requests that a user did not intentionally initiate. Referenced by [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md) ### Formatting Flexibility - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree of latitude to present output in varied formats, constrained when encoding must be strict. Referenced by [Output Encoding](https://banes-lab.com/records/arch/output-encoding.md) ### Hardcoded Rules - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Embedding access rules directly in code, so changing policy requires a code change and cannot respond to runtime attributes. Referenced by [ABAC](https://banes-lab.com/records/arch/attribute-based-access-control.md) ### Hardcoded Secrets - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Embedding credentials, keys, or tokens directly in source or configuration, exposing them to anyone who can read it. Referenced by [Secrets Management](https://banes-lab.com/records/arch/secrets-management.md) ### Identity Proof - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The evidence a principal presents to establish its identity, such as a password, token, or certificate. Referenced by [Authentication](https://banes-lab.com/records/arch/authentication.md) ### Identity-Aware Authorization - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to make access decisions grounded in a verified caller identity. Referenced by [Authentication](https://banes-lab.com/records/arch/authentication.md) ### Immortal Client-Trusted Session - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition A session that never expires and is trusted from client-supplied state alone, so a captured token grants indefinite access. Referenced by [Session Management](https://banes-lab.com/records/arch/session-management.md) ### Injection Prevention - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to stop untrusted input from being interpreted as executable code or commands. Referenced by [Output Encoding](https://banes-lab.com/records/arch/output-encoding.md) ### Injection-Safe Data Access - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to query data such that input can never be interpreted as part of the query structure. Referenced by [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md) ### Input Flexibility - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system accepts varied or loosely-structured input, in tension with strict validation. Referenced by [Input Validation](https://banes-lab.com/records/arch/input-validation.md) ### Insecure Defaults - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Shipping default settings that favor convenience over safety, leaving a system exposed unless it is explicitly hardened. Referenced by [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md) ### Integrity - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which data is protected from unauthorized or undetected alteration. Referenced by [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) ### Key Management - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of generating, distributing, rotating, and revoking cryptographic keys across their lifecycle. Referenced by [Encryption at Rest](https://banes-lab.com/records/arch/encryption-at-rest.md) ### Key Operations - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree of operational burden imposed by generating, rotating, and safeguarding cryptographic keys. Referenced by [Encryption at Rest](https://banes-lab.com/records/arch/encryption-at-rest.md) ### Latency/Complexity - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree of added latency and complexity introduced by verifying every request rather than trusting a perimeter. Referenced by [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md) ### Layered Controls - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The requirement that multiple independent safeguards protect a resource, so no single failure exposes it. Referenced by [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md) ### Machine-Readable Policies - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Security or compliance policies expressed in a structured, executable format that tools can evaluate directly. Referenced by [Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md) ### Manual-Only Review - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Relying solely on human review to catch policy violations, which neither scales nor reliably covers every case. Referenced by [Policy Enforcement](https://banes-lab.com/records/arch/policy-enforcement.md) ### Minimal Exposure - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The condition of exposing only the endpoints, ports, and capabilities strictly required. Referenced by [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md) ### Minimal Permissions - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The requirement that each principal hold only the permissions its function needs. Referenced by [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md) ### Mitigation - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of reducing a risk's likelihood or impact through deliberate countermeasures. Referenced by [Risk Management](https://banes-lab.com/records/arch/risk-management.md) ### Ongoing Assurance - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to demonstrate continuously that controls remain effective, rather than only at audit time. Referenced by [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md) ### Operational Convenience - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which broad access makes day-to-day operations easier, in tension with least privilege. Referenced by [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md) ### Perimeterless Security - Kind: [approach](https://banes-lab.com/records/kind/approach.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition A security model that trusts no network location implicitly and verifies every request regardless of origin. Referenced by [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md) ### Pipeline Complexity - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree of intricacy added to a delivery pipeline by embedding continuous checks within it. Referenced by [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md) ### Plaintext Sensitive Storage - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Storing sensitive data unencrypted at rest, exposing it to anyone who reaches the underlying storage. Referenced by [Encryption at Rest](https://banes-lab.com/records/arch/encryption-at-rest.md) ### Plaintext Transport - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Sending data over an unencrypted channel, exposing it to interception and tampering in transit. Referenced by [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) ### Point-in-Time Audit Only - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Verifying compliance only at isolated audit moments, leaving the intervals between checks unmonitored for drift. Referenced by [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md) ### Policy Engine - Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition A runtime component that evaluates access requests against declared policies and returns permit or deny decisions. Referenced by [ABAC](https://banes-lab.com/records/arch/attribute-based-access-control.md) ### Policy Maintenance - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of keeping codified policies correct and current as requirements evolve. Referenced by [Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md) ### Priority-Based Controls - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to apply controls in order of risk priority, addressing the greatest exposure first. Referenced by [Risk Management](https://banes-lab.com/records/arch/risk-management.md) ### Privacy Compliance - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system meets the privacy obligations imposed by law and policy. Referenced by [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md) ### Proactive Risk Reduction - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to reduce risk by designing safeguards in from the start rather than patching flaws later. Referenced by [Security by Design](https://banes-lab.com/records/arch/security-by-design.md) ### Query Parameter Binding - Kind: [technique](https://banes-lab.com/records/kind/technique.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Passing query values as bound parameters separate from the query text, so input can never alter the query structure. Referenced by [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md) ### Raw Output Rendering - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Emitting untrusted data into output without encoding it for its context, enabling injection attacks such as cross-site scripting. Referenced by [Output Encoding](https://banes-lab.com/records/arch/output-encoding.md) ### Reduced Blast Radius - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which the impact of a compromise is confined to a limited scope. Referenced by [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md) ### Reduced Exploitability - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which fewer exposed features leave a system harder to exploit. Referenced by [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md) ### Reduced Misconfiguration Risk - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which safe defaults lower the chance of an insecure configuration. Referenced by [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md) ### Regulatory Alignment - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system conforms to the laws and regulations that govern it. Referenced by [Compliance](https://banes-lab.com/records/arch/compliance.md) ### Request Origin Verification - Kind: [technique](https://banes-lab.com/records/kind/technique.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Confirming that a state-changing request originates from a trusted client, typically via a token or origin check. Referenced by [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md) ### Resource Protection - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to ensure that only permitted operations reach a protected resource. Referenced by [Access Control](https://banes-lab.com/records/arch/access-control.md) ### Review - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of examining a change or artifact against standards before it is accepted. Referenced by [Governance](https://banes-lab.com/records/arch/governance.md) ### Revocable Access - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to withdraw a principal's access immediately when a session or grant is terminated. Referenced by [Session Management](https://banes-lab.com/records/arch/session-management.md) ### Risk Identification - Kind: [activity](https://banes-lab.com/records/kind/activity.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The activity of discovering and cataloguing the risks that could affect a system or objective. Referenced by [Risk Management](https://banes-lab.com/records/arch/risk-management.md) ### Role Definitions - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Declared sets of permissions grouped into named roles that are assigned to principals. Referenced by [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md) ### Role Explosion - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which roles proliferate into many narrow definitions as access requirements grow. Referenced by [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md) ### Rotation Policy - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The specified interval and procedure by which secrets or keys must be replaced to limit the value of any single compromise. Referenced by [Secrets Management](https://banes-lab.com/records/arch/secrets-management.md) ### Safe Credential Handling - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to store, transmit, and use credentials without exposing them. Referenced by [Secrets Management](https://banes-lab.com/records/arch/secrets-management.md) ### Safe Rendering - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to display untrusted data without allowing it to execute as markup or script. Referenced by [Output Encoding](https://banes-lab.com/records/arch/output-encoding.md) ### Secret Store - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition A dedicated, access-controlled repository that holds credentials and keys outside of application code. Referenced by [Secrets Management](https://banes-lab.com/records/arch/secrets-management.md) ### Secure Communication - Kind: [capability](https://banes-lab.com/records/kind/capability.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ability to exchange data over a channel protected from interception and tampering. Referenced by [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) ### Secure Configuration - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system's settings and secrets are arranged to minimize exposure. Referenced by [Secrets Management](https://banes-lab.com/records/arch/secrets-management.md) ### Security as Afterthought - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Deferring security concerns until late in development, when vulnerabilities are costly and difficult to remediate. Referenced by [Security by Design](https://banes-lab.com/records/arch/security-by-design.md) ### Single Control Reliance - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Depending on one security control with no layered defenses, so a single bypass compromises the whole system. Referenced by [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md) ### Speed - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which delivery proceeds rapidly, in tension with the caution that managing risk requires. Referenced by [Risk Management](https://banes-lab.com/records/arch/risk-management.md) ### String-Concatenated SQL - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Assembling SQL queries by concatenating untrusted input into strings, opening the system to SQL injection. Referenced by [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md) ### Strong Identity - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The requirement that every actor prove a strong, verified identity before any access is granted. Referenced by [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md) ### Team Velocity - Kind: [metric](https://banes-lab.com/records/kind/metric.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The rate at which a team delivers completed work, which governance overhead can slow. Referenced by [Governance](https://banes-lab.com/records/arch/governance.md) ### Threat Scenarios - Kind: [artifact](https://banes-lab.com/records/kind/artifact.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Concrete descriptions of how an attacker might attempt to compromise a system, enumerated during threat modeling. Referenced by [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md) ### TLS/mTLS - Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Transport-layer protocols that encrypt a connection and, with mutual TLS, mutually authenticate both endpoints. Referenced by [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) ### Trust Boundaries - Kind: [model](https://banes-lab.com/records/kind/model.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The demarcations in a system where the level of trust changes and data crossing them must be validated. Referenced by [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md) ### Trusted Internal Network Assumption - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Assuming that traffic originating inside the network perimeter is inherently trustworthy, ignoring insider and lateral-movement threats. Referenced by [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md) ### Trusting External Input - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Accepting external input as well-formed and safe without validating it, exposing the system to malformed or malicious data. Referenced by [Input Validation](https://banes-lab.com/records/arch/input-validation.md) ### Unbounded Autonomy - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Allowing an actor or component to act without governance limits, so unsafe or unauthorized actions go unchecked. Referenced by [Governance](https://banes-lab.com/records/arch/governance.md) ### Unbounded Data Collection - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Gathering and retaining more personal data than a purpose requires, inflating privacy risk and regulatory exposure. Referenced by [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md) ### Uncontrolled Change - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Permitting changes to a controlled system without review, approval, or record, undermining compliance and traceability. Referenced by [Compliance](https://banes-lab.com/records/arch/compliance.md) ### Unknown/Unowned Risk - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition A risk that has been neither identified nor assigned to an owner, so it goes unmanaged until it materializes. Referenced by [Risk Management](https://banes-lab.com/records/arch/risk-management.md) ### Unnecessary Public Surface - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Exposing more endpoints, ports, or interfaces publicly than the function requires, enlarging the attack surface. Referenced by [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md) ### Unrestricted Access - Kind: [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Permitting access to a resource with no controls, so any caller can invoke any operation. Referenced by [Access Control](https://banes-lab.com/records/arch/access-control.md) ### Usability - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The ease with which users can accomplish their goals with a system. Referenced by [Access Control](https://banes-lab.com/records/arch/access-control.md) ### User Convenience - Kind: [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition The degree to which a system minimizes friction and effort for its users. Referenced by [Session Management](https://banes-lab.com/records/arch/session-management.md) ### Validation Rules - Kind: [constraint](https://banes-lab.com/records/kind/constraint.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition Declared constraints that input must satisfy, such as type, range, format and length, before it is accepted. Referenced by [Input Validation](https://banes-lab.com/records/arch/input-validation.md) ### Zero Trust - Kind: [approach](https://banes-lab.com/records/kind/approach.md) - Category: [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lex-category-security-privacy-compliance.md) - Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md) Details Definition A security stance that grants no implicit trust and continuously verifies every access request regardless of its source. Referenced by [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md) ## Links to - [anti-pattern](https://banes-lab.com/records/kind/anti-pattern.md) - [Security Core](https://banes-lab.com/records/layer/security-core.md) - [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md) - [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md) - [capability](https://banes-lab.com/records/kind/capability.md) - [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md) - [Authentication](https://banes-lab.com/records/arch/authentication.md) - [artifact](https://banes-lab.com/records/kind/artifact.md) - [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md) - [ABAC](https://banes-lab.com/records/arch/attribute-based-access-control.md) - [model](https://banes-lab.com/records/kind/model.md) - [Authorization](https://banes-lab.com/records/arch/authorization.md) - [constraint](https://banes-lab.com/records/kind/constraint.md) - [Access Control](https://banes-lab.com/records/arch/access-control.md) - [Policy Enforcement](https://banes-lab.com/records/arch/policy-enforcement.md) - [quality-attribute](https://banes-lab.com/records/kind/quality-attribute.md) - [Session Management](https://banes-lab.com/records/arch/session-management.md) - [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md) - [activity](https://banes-lab.com/records/kind/activity.md) - [Encryption in Transit](https://banes-lab.com/records/arch/encryption-in-transit.md) - [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md) - [Encryption at Rest](https://banes-lab.com/records/arch/encryption-at-rest.md) - [technique](https://banes-lab.com/records/kind/technique.md) - [Output Encoding](https://banes-lab.com/records/arch/output-encoding.md) - [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md) - [mechanism](https://banes-lab.com/records/kind/mechanism.md) - [Compliance](https://banes-lab.com/records/arch/compliance.md) - [principle](https://banes-lab.com/records/kind/principle.md) - [Security by Design](https://banes-lab.com/records/arch/security-by-design.md) - [Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md) - [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md) - [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md) - [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md) - [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md) - [Secrets Management](https://banes-lab.com/records/arch/secrets-management.md) - [Input Validation](https://banes-lab.com/records/arch/input-validation.md) - [Risk Management](https://banes-lab.com/records/arch/risk-management.md) - [approach](https://banes-lab.com/records/kind/approach.md) - [Governance](https://banes-lab.com/records/arch/governance.md) - [metric](https://banes-lab.com/records/kind/metric.md) ## Linked from - [The layer topology](https://banes-lab.com/ontology/schema/the-layer-topology.md) - [The membership](https://banes-lab.com/ontology/schema/the-membership.md)