Term Kind Topic What it is
Dynamic Secrets pattern Secrets Management Credentials generated on demand for a specific consumer with a short lease, rather than stored, shared and rotated periodically.
Envelope Encryption pattern Encryption Encrypting data with a locally-generated data key, then encrypting that key with a master key held in a key management service, and storing the wrapped key alongside the ciphertext.
Field-Level Encryption Application-Level Encryption pattern Encryption Encrypting specific sensitive fields in the application before they reach the datastore, so the store never holds plaintext.
Microsegmentation pattern Zero Trust Enforcing fine-grained network policy between individual workloads rather than between broad network zones, so a compromise cannot move laterally.
Step-Up Authentication pattern Authentication Requiring stronger proof of identity at the moment a consequential action is attempted, rather than applying maximum friction to every session.
Tamper-Evident Log pattern Auditability An audit log constructed so that any modification or deletion of past entries is detectable, typically by chaining entries cryptographically.
Tokenisation pattern Security Architecture Replacing a sensitive value with a non-sensitive surrogate, with the mapping held in one tightly-controlled vault.
Workload Identity Service Identity, Federated Identity pattern Identity & Access Management Giving a running workload a cryptographically verifiable identity issued by the platform, so it obtains short-lived credentials without a stored secret.