# Plain-language glossary

Terms used throughout this repo, decoded. Not formal definitions — just enough to read the other
documents without stopping to look things up.

- **PLC** — Programmable Logic Controller. The computer that actually runs the physical process
  (pumps, valves, sensors) at a water treatment plant.
- **CIP / EtherNet-IP** — Common Industrial Protocol, the communication language Rockwell
  controllers (among others) speak over an EtherNet/IP network. Both are open standards from
  **ODVA**, not Rockwell-proprietary. The base protocol has **no authentication built in** — which
  is what "CIP Security" below was added to address.
- **CIP Security** — the **ODVA** security extension to CIP: identity-bound certificates and
  encrypted communication. Open and multi-vendor, *not* a Rockwell product — though on Rockwell
  equipment it is optional and **hardware-gated**, so whether you can use it depends on your
  specific controller and firmware. Same acronym as CIP, deliberately: it is the secure layer for
  that protocol, not a different one.
- **CVE** — Common Vulnerabilities and Exposures. A public ID number for a specific known
  vulnerability (this repo concerns CVE-2021-22681).
- **PSIRT** — Product Security Incident Response Team. The team inside a vendor (like Rockwell)
  whose job is fielding outside security reports.
- **Mutual TLS (mTLS)** — both sides of a connection prove their identity with a certificate, not
  just the server proving its identity to the client (the way most websites work).
- **SAN (Subject Alternative Name)** — the field inside a certificate that actually names *which*
  device it belongs to. The correct place to check identity — the deprecated CommonName field isn't.
- **CA (Certificate Authority) / PKI (Public Key Infrastructure)** — the system of issuing and
  trusting certificates. A "lightweight internal CA" for a small utility can be a few lines of code,
  not an enterprise product.
- **CRL (Certificate Revocation List)** — a signed list of certificates that have been "taken back"
  even though they haven't expired — how a credential gets recalled from someone who left, or from a
  device that was compromised.
- **IEC 62443-4-2** — the technical security standard this repo maps its evidence against, for
  industrial control system components specifically.
- **SL (Security Level)** — IEC 62443's tiering of how sophisticated an attacker the security is
  meant to withstand. SL 2 (this repo's target) means "someone with simple means and generic skills,
  acting intentionally" — matches CVE-2021-22681's actual public exploitation profile.
- **CR (Component Requirement)** — one specific, numbered requirement inside IEC 62443-4-2 (e.g.
  "CR 1.9 — strength of public-key authentication").

---
*l0gic — Patrick Crosby, 2026-08-03. DRAFT — not committed, not pushed; holding for review.*