244 results
NIST SP 800-66r2: implementing the HIPAA Security Rule, explained
What NIST SP 800-66 Revision 2 (February 2024) actually says about the HIPAA Security Rule's required vs. addressable implementation specifications, the six safeguard sections, and the seven-step risk assessment process it recommends for electronic protected health information (ePHI).
5 min read Updated
NIST SP 800-82 Rev. 3: the Guide to Operational Technology (OT) Security, explained
What NIST SP 800-82 Rev. 3 actually covers: the broadened ICS-to-OT scope, typical OT threats and vulnerabilities, the SP 800-53 OT overlay, and how it differs from Rev. 2.
4 min read Updated
NIST SP 800-88 Rev. 2 (media sanitization guidelines), explained
NIST SP 800-88 Revision 2 (September 2025) — the Clear/Purge/Destroy sanitization methods, cryptographic erase, the sanitization-and-disposition decision flow, and what changed from the 2014 edition.
6 min read Updated
NIST SSDF (SP 800-218): the four practice groups, explained
NIST's Secure Software Development Framework, SP 800-218: its four practice groups, the link to Executive Order 14028, and the SP 800-218A AI profile.
4 min read Updated
OCPP protocol security: why plaintext WebSockets keep showing up in CISA advisories
OCPP 1.6J's own default Security Profile 1 allows an unencrypted WebSocket with optional basic auth, and in 2026 CISA published at least seven ICS advisories — Monta (CVSS 9.4), Everon (9.4), Hydro-Québec (9.8) — for exactly that gap: unauthenticated OCPP WebSocket endpoints.
9 min read Updated
OPC UA security: built in, often unused, and what breaks when it is
OPC UA was designed with security in its own spec — authentication, signing and encryption, defined policies and modes — unlike Modbus or classic OPC DA. What CISA's and the OPC Foundation's own 2026 research says about why most deployments still run without it, and the implementation CVEs in Kepware, Softing and open62541 that fill the gap.
5 min read Updated
OpenSSF Best Practices Badge: the passing, silver and gold criteria, explained
The OpenSSF Best Practices Badge (formerly CII Best Practices Badge) lets open-source projects self-certify against 67 passing-level criteria across 6 categories, with Silver and Gold tiers above it. What the project's own criteria document actually requires, and how OpenSSF Scorecard scores badge tier directly.
5 min read Updated
OpenSSF Model Signing (OMS): Sigstore-based signing for ML models, explained
OMS v1.0, launched 4 April 2025 by the OpenSSF AI/ML Working Group with Google, NVIDIA and HiddenLayer: how Sigstore-based model signing works, who's using it, and how it relates to an AI-BOM and SLSA.
4 min read Updated
OpenSSF Scorecard explained: how the 0-10 score is built
What OpenSSF Scorecard measures, its risk-weighted 0-10 scoring, the 20 checks it runs, and how to read a result before trusting a dependency.
4 min read Updated
OpenSSF Security Baseline (OSPS Baseline): what it actually requires
What the OpenSSF Security Baseline is, its three maturity levels and control families, how it differs from OpenSSF Scorecard and the Best Practices Badge, and how it maps to the Cyber Resilience Act and NIST SSDF.
4 min read Updated
OpenVEX: the minimal, embeddable VEX format
What OpenVEX is, its four status values and five not_affected justifications, how it meets CISA's Minimum Requirements for VEX, and how it compares to CycloneDX VEX and CSAF VEX.
3 min read Updated
OT/ICS security for small and mid-sized manufacturers: where to start with no dedicated team
Where a small factory with no OT security team should start: a passive asset inventory first, CISA's prioritized goals second, and IEC 62443-2-1 as the growth path — without installing agents on the shop floor.
5 min read Updated
OWASP API Security Top 10 (2023), explained
OWASP's API Security Top 10 2023 edition — all 10 risk categories from Broken Object Level Authorization to Unsafe Consumption of APIs, what changed from the 2019 edition, and how the ranking methodology works.
4 min read Updated
OWASP ASVS: the Application Security Verification Standard, explained
OWASP's Application Security Verification Standard (ASVS) 5.0.0: its three verification levels, roughly 350 requirements across 17 chapters, and how it differs from the OWASP Top 10 and OWASP SAMM.
4 min read Updated
OWASP DSOMM: the DevSecOps Maturity Model's dimensions and levels, explained
OWASP DSOMM scores security practice across 6 dimensions, ~20 sub-dimensions and 5 maturity levels — including a new Agentic AI dimension added in 2026 for securing AI coding agents. What the model actually measures, sourced from its own YAML model and GitHub history.
6 min read Updated
OWASP Firmware Security Testing Methodology (FSTM), explained
OWASP's nine-stage Firmware Security Testing Methodology (FSTM) — obtaining and extracting firmware, static and dynamic analysis, emulation and exploitation — plus how it fits with OWASP's ISTG and ISVS.
5 min read Updated
OWASP IoT Top 10: the 10 risk categories, explained
OWASP's Internet of Things Top 10 list in full: all ten risk categories, how the 2018 edition was built, and how it relates to ETSI EN 303 645 and the Cyber Resilience Act.
5 min read Updated
OWASP ISVS: the IoT Security Verification Standard, explained
OWASP ISVS v1.0.0-RC2's three verification levels, its five requirement categories spanning ecosystem, application, software-platform, communication and hardware controls, its new post-quantum requirements, and how it complements OWASP's ISTG and FSTM.
5 min read Updated
OWASP MASTG (Mobile Application Security Testing Guide), explained
OWASP's Mobile Application Security Testing Guide (MASTG) v2.0.0: how it tests the MASVS controls, the MASWE weakness catalog that bridges the two, its modular test/technique/demo structure, and its license.
3 min read Updated
OWASP MASVS (Mobile Application Security Verification Standard), explained
OWASP's Mobile Application Security Verification Standard (MASVS) v2.1.0: the eight MASVS-* control categories, the MAS testing Profiles (L1, L2, R, P), and how MASTG and MASWE fit alongside it.
4 min read Updated
OWASP Top 10 Proactive Controls: the C1-C10 catalog, explained
OWASP's Top 10 Proactive Controls — the C1-C10 catalog of secure-coding practices for developers, how it differs from the OWASP Top 10 vulnerability list, and where ASVS and SAMM fit alongside it.
5 min read Updated
OWASP SAMM: the Software Assurance Maturity Model, explained
OWASP SAMM v2's 5 business functions, 15 security practices, two streams per practice and 3 maturity levels — and how it compares to NIST SSDF.
4 min read Updated
OWASP SCVS: the Software Component Verification Standard, explained
OWASP SCVS v1.0's three verification levels, its six control families totalling 87 requirements, and how NIST's SP 800-218 Secure Software Development Framework crosswalks specific SCVS requirement IDs into its own practices.
5 min read Updated
OWASP threat modeling: the four questions and core methodologies
OWASP's threat modeling guidance — the four-question framework from the Threat Modeling Manifesto, the structured steps, and how STRIDE, PASTA, Attack Trees and LINDDUN compare, per OWASP's own community page and Cheat Sheet.
4 min read Updated
Questions about this page?