Contact Us

The Rietta Glossary

Cybersecurity and accessibility terms, defined and sourced.

As part of our effort to be an educational resource, Rietta maintains this glossary for terms that come up on the blog, our video learning library and in our other published works. This is the place we will share neutral definitions of terms of art in the field as well as for terms that our team may have coined.

We have had the experience of the web changing out from under us. Places were cited that are no longer available. It is our sincere hope that this resource will be available well into the future.

This resource is not exhaustive but is a continual work in progress.

If during your review of this work, you notice a substantial error, we welcome corrections or discussion via our e-mail form.

A

Abuser Story Security
An abuser story is a user story written from the point of view of a malicious adversary. Abuser stories are used in agile software development to define activities the software should actively block or mitigate, proven by automated regression tests.
Americans with Disabilities Act (ADA) Law, Accessibility
The Americans with Disabilities Act (ADA) is a U.S. civil rights law, enacted July 26, 1990, that prohibits discrimination on the basis of disability in employment, state and local government services, public accommodations, and telecommunications.
Archived Web Content Exception Law
The archived web content exception is a provision of the U.S. Department of Justice’s ADA Title II web accessibility rule, 28 CFR § 35.201(a), that exempts web content meeting four criteria defined in 28 CFR § 35.104 from the rule’s WCAG 2.1 Level A and AA requirements.
Artificial Neural Network (ANN) AI
An artificial neural network (ANN) is a machine learning model made of simple connected units, loosely modeled on neurons, arranged in layers, where each unit combines its weighted inputs and passes the result through a nonlinear function, and the weights are learned from training data.
Authentication Security
Authentication is the security property of verifying that a user, process, or device is who or what it claims to be, and that it is authorized to access a given resource.
Availability Security
Availability is the security property of ensuring timely and reliable access to and use of information and systems by authorized users.

B

bcrypt Security
bcrypt is a password hashing function, published by Niels Provos and David Mazières in 1999, that is built on an intentionally expensive Blowfish key schedule, uses a 128-bit salt for each password, and takes a cost factor that sets how much work each hash requires.
Broken Access Control Security
Broken access control is a failure of an application to enforce what each user, process, or device is permitted to do, so that someone can read, change, or delete data, or perform functions, outside their intended permissions.

C

CIAAN Security
CIAAN is a variant ordering of the acronym CIANA, naming the same five information assurance properties: Confidentiality, Integrity, Availability, Authentication, and Non-Repudiation.
CIANA Security
CIANA is an acronym for five information assurance properties: Confidentiality, Integrity, Availability, Non-Repudiation, and Authentication. It extends the three-property CIA triad.
Coding Agent AI
A coding agent is a software tool built on a large language model that carries out software development tasks from a natural-language prompt by reading a codebase, editing files, and running commands such as tests, repeating those steps until it judges the task done.
Confidentiality Security
Confidentiality is the security property of preserving authorized restrictions on information access and disclosure, so that information is not revealed to people, processes, or devices that aren’t authorized to see it.
Conformance vs. Compliance Accessibility, Law
Conformance is a technical claim that content satisfies all the requirements of a standard such as WCAG. Compliance is a legal status: meeting the obligations of a law or regulation such as ADA Title II, which may require conformance to a standard by reference.
CVE (Common Vulnerabilities and Exposures) Security
A CVE (Common Vulnerabilities and Exposures) is a documented, publicly known vulnerability in a software, hardware, or firmware product or service, identified by a unique ID such as CVE-2014-0160 for Heartbleed. The IDs come from the CVE Program, which catalogs publicly disclosed vulnerabilities so that vendors, researchers, scanners, and defenders can refer to the same issue by the same name.
CVSS (Common Vulnerability Scoring System) Security
The Common Vulnerability Scoring System (CVSS) is an open framework, maintained by FIRST, for communicating the characteristics and severity of software, hardware, and firmware vulnerabilities. It produces a score from 0.0 to 10.0 that can be mapped to a qualitative rating of None, Low, Medium, High, or Critical.

D

Document Accessibility Accessibility
Document accessibility is WCAG applied to digital documents, such as PDFs and Word files, whether they were created on a computer or scanned from paper. An accessible document can be read and used by a person with a disability, including someone who relies on a screen reader or who uses magnification or high contrast to compensate for low vision. An inaccessible document is a barrier that can leave its content effectively unavailable to people with disabilities.
Document Corpus (Accessibility) Accessibility
In document accessibility, a document corpus is the complete body of documents an organization publishes, treated as a unit of assessment in its own right. Some findings, such as the same non-descriptive title on every document or defects traced to a shared production workflow, exist only at the corpus level and cannot be seen by reviewing files one at a time.
Document Language Accessibility
In document accessibility, the document language is the default human language declared in a file’s metadata (for a PDF, the /Lang entry in the document catalog), which screen readers use to choose pronunciation. WCAG 2.1 Success Criterion 3.1.1 requires that it be programmatically determinable.
Document Provenance (Accessibility) Accessibility
In document accessibility, document provenance is the specific business process, template, and tools that produced a document, traced so that accessibility defects shared by many documents can be attributed to a common source and corrected there.
Document Title Accessibility
In document accessibility, the document title is the title stored in a file’s metadata (for a PDF, the Title entry in the document information dictionary) that viewers and assistive technology present to identify the document. WCAG 2.1 Success Criterion 2.4.2 requires that it describe the document’s topic or purpose.

E

Electronic and Information Technology (EIT) Accessibility, Law
Electronic and information technology (EIT) is the term Section 508 of the Rehabilitation Act (29 U.S.C. § 794d) uses for the technology that federal agencies must make accessible to people with disabilities. The U.S. Access Board’s current standards implementing Section 508 use the term information and communication technology (ICT).
Entropy (Cryptography) Security
In cryptography, entropy is a measure of the disorder, randomness, or variability in a closed system, usually stated in bits: a value with n bits of entropy is as unpredictable as a uniformly random n-bit value.

H

Harness (Testing and AI) AI
A harness is the code and tooling built around a piece of software or an AI model so it can be run under control. A test harness supplies what a test suite needs to run, an agent harness supplies the tools and loop that let a large language model act as an agent, and an evaluation harness runs a model against benchmark tasks.
Hashing Security
Hashing is the use of a cryptographic hash function to map input of any length to a fixed-length digest, in a way that is one-way and deterministic, so the same input always yields the same digest and the input cannot be computed back from it.

I

Information and Communication Technology (ICT) Accessibility, Security
Information and communication technology (ICT) is an umbrella term for the technologies used to capture, store, retrieve, process, present, transfer, and secure data and information, from software and computing systems to networks and telecommunications. In accessibility, it is the term the U.S. Section 508 Standards and the W3C use for the full range of technology that accessibility requirements apply to, of which the web is one part.
Integrity Security
Integrity is the security property of guarding information against improper modification or destruction, so that data has not been altered in an unauthorized or undetected way since it was created, transmitted, or stored.

K

KEV (Known Exploited Vulnerabilities Catalog) Security
The Known Exploited Vulnerabilities (KEV) catalog is the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) list of vulnerabilities that have been exploited in the wild. Each entry has a CVE ID, reliable evidence of active exploitation, and a clear remediation action, and CISA sets deadlines by which U.S. federal civilian agencies must act on it.

L

Large Language Model (LLM) AI
A large language model (LLM) is a neural network pretrained on a very large body of text to predict the next token (a word or word fragment) in a sequence, usually then further trained to follow instructions, and used to generate, summarize, translate, and classify text.
LavaRand Security
LavaRand is a method of generating random numbers from camera images of a chaotic physical system, originally a group of lava lamps: each image is digitized and cryptographically hashed, and the result seeds a cryptographically secure pseudorandom number generator (CSPRNG).
Logistic Regression AI
Logistic regression is a statistical and machine learning method for classification that estimates the probability of a binary outcome by passing a weighted sum of input features through the logistic (sigmoid) function, which maps any value to a probability between 0 and 1.

M

McCumber Cube Security
The McCumber Cube is an information security model that crosses three information states (transmission, storage, processing) with three security characteristics (confidentiality, integrity, availability) and three kinds of security measures (technology; policy and practice; education, training, and awareness), producing 27 cells that each describe an area a system must address.

N

Non-Repudiation Security
Non-repudiation is the security property that prevents a party from credibly denying an action they took, by preserving evidence of who did what, when, and where.

P

Password Hash Upgrade Security
A password hash upgrade is the process of moving stored passwords from a weaker hashing scheme to a stronger one. It is difficult because the verifier never has the passwords themselves, only their hashes, and sees each plaintext password only briefly when that user logs in.
Password Hashing Security
Password hashing is the storage of a password as the output of a deliberately expensive one-way function, combined with a unique salt, so the password itself is never stored and every guess an attacker makes is costly to test.
Pepper (Password Hashing) Security
A pepper is a secret value, shared by all stored passwords, that is mixed into password hashing and kept separately from the password database, so a breach of the database alone does not let an attacker test passwords offline.
Preexisting Conventional Electronic Documents Exception Law
The preexisting conventional electronic documents exception is a provision of the U.S. Department of Justice’s ADA Title II web accessibility rule, 28 CFR § 35.201(b), that exempts PDF, word processor, presentation, and spreadsheet files made available before a public entity’s compliance date, unless they are currently used to apply for, gain access to, or participate in its services, programs, or activities.

R

Remediation Security, Accessibility
Remediation is the correction of an identified deficiency. In cybersecurity, it means fixing or mitigating a vulnerability. In digital accessibility, it means modifying content, such as a PDF, so that it meets accessibility requirements.

S

Salt (Password Hashing) Security
A salt is a random value, unique to each stored password, that is mixed into the password before hashing and stored alongside the result. A salt is not secret.
SSL (Secure Sockets Layer) Security
Secure Sockets Layer (SSL) is the protocol Netscape developed to protect client/server connections over the Internet against eavesdropping, tampering, and message forgery. It is fully discontinued: every version is prohibited, and TLS has replaced it.

T

Threat Modeling Security
Threat modeling is a structured process for identifying what a system must protect, enumerating what can go wrong, and prioritizing mitigations by relative risk.
TLS (Transport Layer Security) Security
Transport Layer Security (TLS) is the IETF protocol that protects communication between a client and a server, such as a web browser and a web server, against eavesdropping, tampering, and message forgery. It supersedes the Secure Sockets Layer (SSL) protocol it was based on.
TrueContext™ Accessibility
TrueContext™ is Rietta Inc.’s name for the analysis in its Metadata Minder platform that examines the web pages linking to a document for evidence that the document is stored in an area clearly identified as archived, as the ADA Title II archived web content exception requires.
TrueDate™ Accessibility
TrueDate™ is Rietta Inc.’s name for the analysis in its Metadata Minder platform that determines the best supported date for a document from the document’s text, visual content, and metadata together, instead of relying on the metadata date alone.

V

Vibe Coding AI
Vibe coding is building software by describing what it should do to an AI model in natural language and accepting the code the model generates without reading or reviewing it.

W

Web Application Security, Accessibility
A web application is software that runs on a web server and that users interact with through a web browser, over a network such as the internet or an intranet. It commonly stores its data in a database on the server side.
Web Content Accessibility Guidelines (WCAG) Accessibility
The Web Content Accessibility Guidelines (WCAG) are the World Wide Web Consortium (W3C) standard for making web content accessible to people with disabilities, organized as testable success criteria at three conformance levels: A, AA, and AAA.
Web Server Security
A web server is software, or the process running it, that accepts requests over HTTP or HTTPS from a user agent such as a web browser and returns the requested content, or an error message if the request cannot be fulfilled.