Glossary

A compulsory CISA order to federal agencies.

A Binding Operational Directive is a compulsory direction from CISA to US federal civilian executive branch agencies. BOD 22-01, issued in November 2021, created the KEV catalog's remediation requirement. The required-action text of recent KEV entries also cites BOD 26-04; see each entry's notes for the linked directive.

Related: Known Exploited Vulnerabilities (KEV) catalog, KEV due date

The public identifier for a disclosed vulnerability.

A CVE ID (Common Vulnerabilities and Exposures) is a unique identifier, in the form CVE-YEAR-NUMBER, assigned to a publicly disclosed vulnerability by the CVE Program. The year in the ID is the year the ID was assigned or reserved, which is not always the year the vulnerability was disclosed or exploited.

Related: Known Exploited Vulnerabilities (KEV) catalog, CWE, National Vulnerability Database (NVD)

A catalog of weakness types behind vulnerabilities.

The Common Weakness Enumeration (CWE), maintained by MITRE, is a list of software and hardware weakness types, such as out-of-bounds write (CWE-787) or OS command injection (CWE-78). A CVE describes one specific flaw; its CWE describes the kind of mistake that caused it.

Related: CVE ID, Known Exploited Vulnerabilities (KEV) catalog

The remediation deadline CISA sets for each KEV entry.

Each KEV entry carries a due date by which US federal civilian executive branch agencies must apply the required action, usually a vendor patch or mitigation, or stop using the product. Organizations outside the federal government are not bound by the date but often use it as a benchmark.

Related: Known Exploited Vulnerabilities (KEV) catalog, Binding Operational Directive (BOD)

CISA's list of vulnerabilities exploited in the wild.

The Known Exploited Vulnerabilities catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities for which there is reliable evidence of active exploitation. Each entry has a CVE ID, the affected vendor and product, the date it was added, a required action and a due date. US federal civilian agencies must remediate entries by the due date; many other organizations use the catalog to prioritize patching.

Related: CVE ID, KEV due date, Binding Operational Directive (BOD)

KEV flag for vulnerabilities used by ransomware.

A field in each KEV entry. It is set to "Known" when CISA is aware the vulnerability has been used in a ransomware campaign, and "Unknown" otherwise. "Unknown" means CISA has not confirmed ransomware use, not that it has not happened.

Related: Known Exploited Vulnerabilities (KEV) catalog

NIST's enriched database of CVE records.

The National Vulnerability Database is run by NIST. It republishes CVE records and adds analysis such as severity scores, affected-product identifiers and weakness (CWE) mappings.

Related: CVE ID, CWE

A flaw exploited before a fix is available.

A zero-day is a vulnerability that attackers exploit before the vendor has released a fix, or before defenders know it exists. Once a patch ships, it is usually called an n-day.

Related: Known Exploited Vulnerabilities (KEV) catalog, CVE ID

Criminal control of a legitimate account.

Account takeover is when a criminal gains control of a real customer's account, usually with stolen credentials, a phished one-time passcode or a hijacked phone number, and then uses it to move money, change contact details or open new products.

Related: OTP bot, SIM swap, Phishing-resistant MFA

Scams where victims authorize the payment themselves.

Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner. Because the customer authorized it, strong authentication alone does not stop it.

Related: Account takeover (ATO), Strong customer authentication

Open-source project defining telecom network APIs.

CAMARA is an open-source project hosted by the Linux Foundation that defines common network APIs, such as Number Verification and SIM Swap, so developers can call the same interface across different mobile operators. GSMA Open Gateway builds on it.

Related: Number verification, Silent network authentication

Open standard behind passkeys and security keys.

FIDO2 is the FIDO Alliance's set of specifications, made up of the W3C's WebAuthn API and FIDO's CTAP protocol, that lets people sign in with public-key cryptography instead of passwords. Passkeys and hardware security keys are both FIDO2 credentials.

Related: Passkey, Phishing-resistant MFA

Carrier check that a device holds a given number.

Number verification is a mobile network API that confirms whether the device making a request is using the SIM registered to a given phone number, without sending the user a code.

Related: CAMARA, Silent network authentication, SIM swap

Automated calls that trick victims into reading out codes.

An OTP bot is an automated calling or messaging service that impersonates a bank or service and persuades the victim to read out or type in a one-time passcode, which the criminal then uses in real time.

Related: Account takeover (ATO), Phishing-resistant MFA

A login credential bound to one website.

A passkey is a FIDO2 credential: a key pair where the private key stays on the user's device or in their password manager, and the public key is stored by the website. Because it is bound to the site's domain, it cannot be used on a look-alike phishing site.

Related: FIDO2, Phishing-resistant MFA

Authentication a fake site can't relay.

Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.

Related: Passkey, FIDO2, OTP bot

Verification through the mobile network, with no code typed.

Silent network authentication verifies a user by checking, with their mobile operator, that the request comes from the SIM tied to their phone number. The check happens over the cellular data connection, so the user never sees or types a code.

Related: Number verification, CAMARA

Hijacking a phone number by moving it to a new SIM.

A SIM swap is when a criminal gets a mobile carrier to move a victim's phone number to a SIM or eSIM they control, by social engineering, bribery or stolen credentials. The criminal then receives the victim's calls and texts, including one-time passcodes.

Related: Account takeover (ATO), Number verification

The EU's two-factor rule for payments.

Strong customer authentication (SCA) is the requirement in EU payments law that customers authenticate with at least two independent factors from knowledge, possession and inherence for most electronic payments and account access.

Related: APP fraud

No request trusted for where it comes from alone.

Zero trust is a security model in which no user, device or request is trusted because of its network location. Every access decision is made from identity, device health and context, and re-checked continuously.

Related: Phishing-resistant MFA

Revision 4 of NIST's Digital Identity Guidelines, covering identity proofing (63A), authentication (63B) and federation (63C). US federal agencies must follow it, and many banks and auditors treat it as the benchmark.

https://pages.nist.gov/800-63-4/

The US National Institute of Standards and Technology publishes the Digital Identity Guidelines, the Cybersecurity Framework and the National Vulnerability Database.

https://www.nist.gov/

The US regulator for interstate communications. In 2023 it adopted rules requiring wireless carriers to protect customers against SIM-swap and port-out fraud.

https://www.fcc.gov/

The Federal Financial Institutions Examination Council sets uniform examination standards for US banks. Its 2021 guidance covers authentication and access to financial services.

https://www.ffiec.gov/

The US Cybersecurity and Infrastructure Security Agency maintains the Known Exploited Vulnerabilities catalog and publishes guidance on phishing-resistant MFA.

https://www.cisa.gov/

Singapore's central bank and financial regulator. In July 2024 it announced, with the Association of Banks in Singapore, that banks would phase out OTPs for customers using digital tokens.

https://www.mas.gov.sg/

The central bank of the Philippines. Its Circular No. 1213 bars SMS and email one-time passcodes for high-risk transactions from June 25, 2026.

https://www.bsp.gov.ph/

The UAE's central bank. It directed banks to phase out SMS and email one-time passcodes, starting in July 2025 and finishing by March 31, 2026.

https://www.centralbank.ae/

India's central bank. Its Authentication Directions 2025, in force from April 1, 2026, set new rules for authenticating digital payments.

https://www.rbi.org.in/

The industry association behind the FIDO2 standards and passkeys. It certifies products and runs the Authenticate conference.

https://fidoalliance.org/

The global mobile operators' association. Its Open Gateway initiative packages carrier network APIs, such as number verification and SIM swap checks, for developers.

https://www.gsma.com/

The UK's payments regulator. It introduced mandatory reimbursement for victims of authorized push payment scams on Faster Payments from October 7, 2024.

https://www.psr.org.uk/