IAM & Cybersecurity Glossary

An IEEE standard for port-based Network Access Control (NAC). Requires devices to authenticate before being granted network access, using EAP over LAN (EAPOL). Used in enterprise Wi-Fi (WPA2-Enterprise) and wired network access control.

The process of verifying that an entity (user, device, or service) is who or what it claims to be. Authentication is distinct from authorization — it answers "who are you?" not "what can you do?".

A NIST SP 800-63B classification defining the strength of an authentication mechanism. AAL1 (single-factor), AAL2 (MFA required), AAL3 (hardware-backed cryptographic authenticator required). Higher AALs are required for sensitive systems.

The process of determining what an authenticated identity is permitted to do. Authorization is enforced after authentication and answers "what can you access?" through policies, roles, or attributes.

An access control model where access decisions are based on attributes of the subject (user department, clearance), object (data classification, owner), and environment (time of day, location). More flexible than RBAC but more complex to implement.

A list attached to an object (file, network resource, API endpoint) that specifies which subjects can access it and what operations they can perform. ACLs are a classic discretionary access control mechanism and are foundational to NTFS file permissions and AWS S3 bucket policies.

Microsoft's directory service for Windows domain networks. Stores information about objects (users, computers, groups) and provides authentication (Kerberos, NTLM) and authorization services. Organized into forests, domains, and organizational units (OUs).

The core component of Active Directory that stores directory data and manages communication between users and domains. Provides Kerberos-based authentication, LDAP directory access, and Group Policy enforcement.

Microsoft's cloud-based identity and access management service, now renamed Microsoft Entra ID. Provides SSO, MFA, Conditional Access, and B2B/B2C collaboration for cloud and hybrid environments. Distinct from on-prem AD DS.

The most secure OAuth 2.0 grant type for server-side web applications. The authorization server issues a short-lived authorization code to the client, which exchanges it for tokens via a back-channel request. Use with PKCE for single-page and mobile apps.

The winner of the 2015 Password Hashing Competition. Argon2id is the recommended choice for password hashing, offering configurable memory, iteration, and parallelism parameters. Resistant to GPU and side-channel attacks. Recommended by OWASP.

Advanced Encryption Standard — the most widely used symmetric block cipher, standardized by NIST. Operates on 128-bit blocks with 128-, 192-, or 256-bit keys. AES-256-GCM is the recommended mode for authenticated encryption in modern protocols.

An Active Directory attack targeting accounts that have Kerberos pre-authentication disabled. The attacker requests an AS-REP message for such accounts without credentials, then cracks the encrypted portion offline. Mitigated by enabling pre-authentication on all accounts.

Amazon Web Services Identity and Access Management — the native AWS service for controlling access to AWS resources. Core concepts include Users, Groups, Roles, Policies, and Permission Boundaries. The foundation of every AWS account's security posture.

A formal process by which a user or their manager submits a request for additional access rights, which is then routed through an approval workflow to the appropriate resource owner or administrator. IGA platforms automate access request, approval, and fulfillment.

A mobile application that generates TOTP codes or handles push-based MFA for enrolled accounts. Examples: Microsoft Authenticator, Google Authenticator, Authy. Apps store TOTP secrets locally and generate codes offline.

A security control that disables an account after a configured number of consecutive failed authentication attempts, preventing brute-force and password-spraying attacks. Lockout threshold, duration, and reset timing must be balanced against DoS risk.

A vulnerability where an application reveals whether a username or email exists through different error messages, response times, or HTTP status codes for valid vs invalid accounts. Enables targeted attacks against known users.

A vulnerability that allows an attacker to circumvent authentication controls and access a protected resource without valid credentials. Common causes: logic flaws in auth checks, SQL injection into login queries, JWT algorithm confusion (alg:none).

In OAuth 2.0, a credential that represents the authorization granted to a client to access protected resources on behalf of a resource owner. Access tokens are short-lived, scoped, and presented to resource servers in the Authorization header.

In OAuth 2.0, the server that authenticates the resource owner and issues access tokens to clients after obtaining proper authorization. The authorization server is the trust anchor of the OAuth ecosystem.

A process for requesting and granting access that routes requests through one or more approvers (manager, resource owner, security team) before provisioning. Approval workflows create an audit trail and enforce the four-eyes principle for sensitive access.

The system of record that is considered the primary source of truth for identity attributes. Typically the HR system for employee data (name, department, manager) — other systems pull from or defer to the authoritative source during provisioning.

An attack where a malicious actor gains unauthorized access to a victim's account, typically through credential theft, phishing, or credential stuffing. ATO is distinct from unauthorized account creation (fraud) and is the primary goal of most authentication attacks.

Assertion Consumer Service URL — the endpoint on a SAML Service Provider where the IdP posts the SAML response after authentication. The ACS URL must be registered with the IdP to prevent open redirect attacks.

A Zero Trust mindset that assumes adversaries are already present inside the network, prompting organizations to minimize lateral movement opportunity, enforce least privilege, and implement robust detection and response capabilities — rather than relying on perimeter defenses.

An attack where the adversary positions themselves between the user and a legitimate website (often using a reverse proxy like Evilginx2), intercepting and relaying authentication traffic to capture session cookies in real time — bypassing MFA by stealing the post-authentication session token.

A sophisticated, long-term cyberattack campaign — typically nation-state sponsored — that establishes a persistent presence in the target environment to conduct espionage, sabotage, or intellectual property theft. APTs use multiple TTPs and operate stealthily over months or years.

A chronological record of security-relevant events — logins, privilege escalations, data access, configuration changes, and administrative actions. Audit logs are essential for incident investigation, compliance reporting, and non-repudiation. Must be tamper-evident and retained per policy.

AWS Security Token Service — a web service that provides temporary, limited-privilege credentials for AWS resources. STS is the foundation of IAM role assumption, SAML/OIDC federation, and cross-account access. Temporary credentials consist of an access key ID, secret access key, and session token.

Previously AWS Single Sign-On (SSO) — a service that provides centralized workforce identity and access management across multiple AWS accounts and business applications. Supports integration with external IdPs (Azure AD, Okta) via SAML 2.0 and SCIM.

Azure Role-Based Access Control — the authorization system for managing access to Azure resources. Assignments consist of a security principal (user, group, service principal, managed identity), a role definition (set of permissions), and a scope (management group, subscription, resource group, resource).

A Microsoft Entra ID feature that enforces access policies based on signals including user identity, device compliance, location, and application risk. Policies can require MFA, compliant device, approved app, or block access based on sign-in risk score from Identity Protection.

An AWS service that identifies resource policies granting access to external principals (cross-account or public access). Access Analyzer uses automated reasoning to identify unintended access paths and generates least-privilege policy recommendations based on CloudTrail activity.

An AWS service that records API calls made in an AWS account — who called what API, from which IP, at what time, and with what parameters. CloudTrail is the foundational audit log for AWS environments and integrates with SIEM tools for threat detection.

AWS's managed threat detection service that uses machine learning and threat intelligence to identify malicious activity — including compromised IAM credentials, unusual API call patterns, cryptocurrency mining, and reconnaissance. Integrates with Security Hub for centralized findings.

Practices and tooling for issuing, tracking, rotating, and revoking API keys used by applications and service integrations. API keys should be scoped to minimum permissions, stored in secrets managers (not code), rotated regularly, and audited for usage.

The policies, processes, and controls that ensure access rights across an organization remain appropriate, compliant, and aligned with business need. Encompasses access request and approval workflows, periodic access reviews (UAR), SoD detection, and role lifecycle management.

A named bundle of resources and permissions that can be requested as a unit — e.g., "Marketing Team Access" granting Office 365 groups, SharePoint sites, and a SaaS app license. Used in Azure AD Entitlement Management and IGA platforms to simplify self-service access requests.

The process of connecting an application to the IAM platform — configuring SSO (SAML/OIDC), setting up SCIM provisioning, importing existing accounts (identity correlation), defining roles, and establishing access request and review processes for the application.

An extension of risk-based authentication that continuously evaluates risk throughout a session, not just at login — triggering re-authentication or session termination if risk signals increase (unusual data download, location change, impossible travel).

Authentication (AuthN) is verifying identity — proving who you are. Authorization (AuthZ) is verifying permission — what you are allowed to do. These are distinct steps: authentication establishes identity, authorization determines access rights for that identity.

A Kerberos attack targeting accounts with "Do not require Kerberos preauthentication" enabled. The KDC responds with an encrypted blob that can be cracked offline to recover the account password. Mitigated by requiring pre-authentication on all accounts.

The ability to perform an action conferred automatically by context (being logged in, being on the corporate network) rather than by explicit capability. CSRF attacks exploit ambient authority — the browser automatically sends cookies, granting the attacker the user's ambient privileges.

The requirement that all access decisions — not only successful ones — are logged with sufficient context (who, what, when, from where, decision outcome) to support forensic investigation, compliance reporting, and SoD analysis.

Advanced Encryption Standard — the NIST-standardized symmetric block cipher (AES-128, AES-192, AES-256). Used for encrypting data at rest and in transit, in cipher modes GCM (authenticated) and CBC. AES-256-GCM is the gold standard for modern symmetric encryption.

The winner of the Password Hashing Competition (2015) and the current OWASP-recommended algorithm for password storage. Argon2id (the preferred variant) is memory-hard, resisting GPU and ASIC cracking attempts. Parameters: memory (m), iterations (t), parallelism (p).

Automatic Certificate Management Environment (RFC 8555) — a protocol for automating certificate issuance, renewal, and revocation. Used by Let's Encrypt and enterprise CAs. Proves domain control via HTTP-01, DNS-01, or TLS-ALPN-01 challenges.

An attack targeting AD accounts with Kerberos pre-authentication disabled. The attacker requests an AS-REP from the KDC without authenticating and receives an encrypted blob that can be cracked offline. Even domain users can perform this attack.

The process of querying Active Directory to discover users, groups, computers, OUs, GPOs, trusts, and ACLs — building a map for subsequent attack steps. Tools: ldapdomaindump, PowerView, BloodHound. Any authenticated domain user can enumerate AD by default.

The AWS STS operation (sts:AssumeRole) that grants temporary credentials for an IAM role. The calling principal must be listed in the role's trust policy. Used for cross-account access, service roles, and just-in-time privilege escalation. Optionally requires MFA or session tags.

Azure Privileged Identity Management — a Microsoft Entra ID feature providing just-in-time privileged role activation, time-bound assignments, approval workflows, and access reviews for Azure AD roles and Azure resource roles. Reduces standing privilege exposure in Azure environments.

Cloud IAM policies that use attributes (tags, conditions) to determine access dynamically. In AWS, condition keys enable attribute-based access control (ABAC) — for example, allowing users to access only resources tagged with the same project tag as their user account.

A server that acts as the front door for all API requests, enforcing authentication (API keys, OAuth tokens, mTLS), rate limiting, logging, and authorization before forwarding to backend services. Centralizes security policy for microservices without requiring each service to implement it independently.

A time-bounded IGA process where managers, application owners, or security teams review and certify (confirm or revoke) access entitlements for a defined population. Campaigns are a primary mechanism for ongoing least-privilege enforcement and regulatory compliance.

The periodic review and reaffirmation of access rights to verify they remain appropriate and necessary. Distinct from an initial access request — recertification occurs on a defined schedule (quarterly, annually) or is triggered by role changes. A core IGA control for ongoing access governance.

The process of connecting an application to a central IAM platform using standard protocols (SAML 2.0, OIDC, SCIM) to enable SSO, automated provisioning, and access governance. Modern SaaS apps typically support OIDC/SCIM; legacy apps may require a protocol adapter or an agent.

The configuration that transforms identity attributes from an IdP's format to the attribute names expected by a service provider. Example: mapping Active Directory's sAMAccountName to the username claim, or givenName + sn to a displayName claim in a SAML assertion or OIDC token.

Signals suggesting an identity may be compromised — impossible travel, login from anonymizing proxy, credential use outside business hours, bulk data access, unfamiliar MFA device registered, or sign-in from a known malicious IP. Evaluated by Identity Protection and UEBA systems to trigger alerts or step-up auth.

Authentication using physiological or behavioral characteristics unique to an individual — fingerprint, face, iris, voice, or typing cadence. Biometrics are an "inherence factor" in MFA and are increasingly used as the primary credential in FIDO2 flows.

An adaptive password hashing function designed by Niels Provos and David Mazières, based on the Blowfish cipher. Includes a work factor (cost parameter) that can be increased as hardware improves, making brute-force attacks progressively more expensive.

A hardened server positioned on the boundary between a trusted internal network and an untrusted external network. All administrative access to internal systems is routed through the bastion host, which is highly monitored. Cloud equivalents: AWS Systems Manager Session Manager, Azure Bastion.

A type of access token where possession alone is sufficient for access — no additional proof of identity is required. Bearer tokens must be transmitted over HTTPS and protected from theft, as anyone with the token can use it.

Identity and access management patterns for external business partners, vendors, and contractors who need access to an organization's systems. Azure AD B2B, for example, allows guest users to use their existing corporate credentials to access partner resources.

Identity management for external customers and consumers, typically involving social login (Google, Apple, Facebook), self-service registration, and consent management. Azure AD B2C, Auth0, and Amazon Cognito are purpose-built B2C identity platforms.

An OIDC logout mechanism where the identity provider sends a signed logout token directly to each registered application's back-channel endpoint when a session is terminated. More reliable than front-channel logout because it does not depend on browser iframes or redirects.

A sophisticated attack where criminals use spoofed or compromised email accounts to impersonate executives or vendors to deceive employees into authorizing fraudulent wire transfers or disclosing sensitive data. Costs billions annually globally.

An open-source Active Directory attack path analysis tool used by both red teams and defenders. BloodHound maps privilege escalation paths through AD relationships (group memberships, ACLs, sessions, trusts) to reveal how an attacker could move from a low-privilege account to Domain Admin.

A legal or regulatory requirement to notify affected individuals, regulators, or the public when a data breach involving personal information occurs. GDPR requires notification within 72 hours; US state laws vary. Notification must describe the breach, data affected, and remediation steps.

An emergency privileged account with broad access, held securely outside normal PAM controls and used only when standard administrative access is unavailable (e.g., IdP outage, ransomware incident). Must be tightly controlled: credentials in a physical safe or sealed envelope with dual custody, and all use immediately alerted and audited.

Authentication based on a user's unique biological characteristics — fingerprint, face, iris, voice, or vein patterns. Used as a convenient and phishing-resistant factor in mobile devices (Touch ID, Face ID) and FIDO2 platform authenticators. Biometrics cannot be revoked if compromised.

A password hashing function designed in 1999 with an adjustable work factor (cost parameter). Widely used in web applications for password storage. Memory requirements are modest, making it more susceptible to GPU attacks than Argon2 or scrypt at equivalent cost settings.

Google's internal Zero Trust access model that eliminated VPN for corporate access, requiring all applications to be accessible via the internet with strong identity and device verification. Published in a series of papers starting 2014, it became the blueprint for enterprise Zero Trust and inspired ZTNA products.

The set of access rights automatically provisioned to a user upon joining an organization or role — email, basic collaboration tools, standard applications — based on their job profile without requiring individual requests. Birthright access should be defined conservatively and reviewed periodically.

An approach where a user's identity is continuously verified throughout a session using behavioral signals (typing cadence, mouse movement, location, device posture) rather than only at login time. Core to adaptive and risk-based access.

Information used to authenticate an identity — passwords, certificates, tokens, or biometric data. Credentials must be stored securely (hashed+salted for passwords, in secure enclaves for keys) and rotated regularly.

An OAuth 2.0 grant type for machine-to-machine (M2M) communication where no user is involved. The client authenticates directly with the authorization server using its client ID and secret to obtain an access token.

A trusted entity that issues digital certificates that bind public keys to identities. CAs are organized in a trust hierarchy: Root CAs sign Intermediate CAs, which sign end-entity certificates. Root CAs are stored in browser/OS trust stores.

A list published by a CA of certificates that have been revoked before their expiry date (due to compromise, error, or policy change). Clients check the CRL before trusting a certificate. CRLs are being superseded by OCSP for real-time revocation checking.

An automated attack that uses credentials obtained from data breaches to gain unauthorized access to accounts on other services, exploiting password reuse. Defeated by unique passwords per service, MFA, and bot detection controls.

Center for Internet Security Critical Security Controls — a prioritized set of actions for cyber defense. Version 8 organizes 18 controls by implementation group (IG1-IG3). Control 5 (Account Management) and Control 6 (Access Control Management) directly address IAM.

A pattern in AWS and other cloud platforms where an IAM role in one account is assumed by principals in another account. Requires a trust policy specifying the trusted account and a permissions policy granting the needed access. Common in multi-account landing zones.

A Microsoft Entra ID (Azure AD) feature that enforces access policies based on identity signals (user, group, role), device compliance, location, and application. Policies can require MFA, compliant device, or block access entirely based on risk score.

A secure, centralized store for privileged credentials (passwords, SSH keys, API tokens) with access controls, automatic rotation, and audit logging. Examples: CyberArk Vault, HashiCorp Vault, AWS Secrets Manager. Eliminates hard-coded credentials and enables rotation without code changes.

Controls that detect and block automated attempts to use leaked credential lists — including rate limiting, CAPTCHA, IP reputation checks, and cross-referencing submitted passwords against known-breached credential databases (Have I Been Pwned API).

An authorization model where access decisions are based on claims — statements about an identity made by a trusted authority (e.g., department=Finance, clearance=Secret). Claims are carried in tokens (JWT, SAML) and evaluated by the resource server.

In OAuth 2.0 and OIDC, the user's explicit approval granting a client application permission to access their resources or data with specified scopes. Consent screens list the requested permissions; administrators can pre-consent on behalf of their organization.

An LDAP attribute representing the name of an object within its container. The CN is the most specific component of a Distinguished Name (DN). For user objects, CN is typically the display name; for computers, it is the machine name.

Client Initiated Backchannel Authentication — an OIDC flow that allows a client to request authentication of a user via a separate authentication device (phone) without a browser redirect. Useful for call-center, IoT, and decoupled authentication scenarios.

Name/value pairs in a JWT payload (or SAML assertion) that convey information about the subject. Standard OIDC claims include sub (subject), iss (issuer), aud (audience), exp (expiration), iat (issued at), email, name, and groups. Custom claims extend the standard set.

A technique where a client hardcodes the expected certificate or public key for a specific server, rejecting connections if the certificate doesn't match — even if it is signed by a trusted CA. Protects against CA compromise and MITM attacks but complicates certificate rotation.

An open framework (RFC 6962) requiring CAs to log all issued certificates to public, append-only logs. Enables domain owners and security researchers to detect misissued or unauthorized certificates. Chrome requires CT compliance for certificates trusted by its root store.

The process of digitally signing executables, scripts, and firmware using a code signing certificate. Verifies the identity of the publisher and confirms the code has not been tampered with since signing. Required by Windows SmartScreen, Apple Gatekeeper, and app stores.

A combination of algorithms used in a TLS connection: key exchange, authentication, bulk encryption, and message authentication. Example: TLS_AES_256_GCM_SHA384. TLS 1.3 reduced cipher suites to five strong options, removing legacy weak ciphers.

Cloud Access Security Broker — a security policy enforcement point between users and cloud services. Provides visibility into cloud app usage (shadow IT), data loss prevention, threat protection, and compliance enforcement for SaaS applications.

Ongoing collection, analysis, and use of security telemetry to assess the security posture of an environment in real time. In Zero Trust, continuous monitoring feeds adaptive access decisions — a degraded device posture can trigger session termination or step-up authentication.

An attack that tricks a victim's browser into sending an authenticated request to a web application without the user's knowledge — exploiting the fact that browsers automatically include session cookies. Mitigated by CSRF tokens, SameSite cookies, and Origin header validation.

An injection attack where malicious scripts are injected into trusted websites and executed in victims' browsers. Stored XSS persists in the database; Reflected XSS is delivered via URL; DOM-based XSS manipulates the page DOM. Used to steal session cookies, redirect users, and deliver malware.

The infrastructure and channel an attacker uses to maintain communication with compromised systems, issue commands, and exfiltrate data. C2 traffic often uses legitimate protocols (HTTPS, DNS, Slack webhooks) to evade detection. Blocking C2 is a key objective in incident response.

California Consumer Privacy Act — a US state law giving California residents rights to know what personal information is collected, request deletion, and opt out of the sale of their data. Enforced by the California Privacy Protection Agency (CPPA).

Cybersecurity Maturity Model Certification — a US DoD framework requiring defense contractors to implement and be certified against tiered cybersecurity practices (Levels 1-3) before being awarded DoD contracts. Based on NIST SP 800-171.

A structured set of security controls and best practices used to manage risk and demonstrate compliance. Examples: NIST SP 800-53, ISO 27001, CIS Controls, SOC 2 Trust Services Criteria. Organizations map multiple frameworks to avoid duplicating assessment effort.

Cloud Security Alliance Cloud Controls Matrix — a cybersecurity control framework for cloud computing, aligned with major compliance standards (ISO 27001, NIST, PCI DSS, HIPAA). Provides 197 control objectives across 17 domains including Identity & Access Management.

Cloud Infrastructure Entitlement Management — a category of security tools that provide visibility and governance over entitlements across cloud environments. CIEM tools analyze who has access to what in IaaS/PaaS (AWS, Azure, GCP), detect excessive permissions, and recommend least-privilege policies.

Cloud Security Posture Management — tools that continuously assess cloud configurations against security best practices and compliance frameworks, detecting misconfigurations such as overly permissive IAM policies, public S3 buckets, unencrypted storage, and open security groups.

The automatic or manual replacement of secrets (passwords, API keys, certificates, SSH keys) on a defined schedule or after a suspected compromise. Automated rotation via secrets managers (HashiCorp Vault, AWS Secrets Manager) eliminates credential stagnation and reduces exposure windows.

The end-to-end management of X.509 certificates from issuance through renewal and revocation. Includes discovery (finding all certificates in use), tracking expiration dates, automating renewal (via ACME/Let's Encrypt or enterprise CA), and revoking compromised certificates.

An authentication model that verifies user identity throughout a session rather than only at login, using behavioral signals (typing cadence, mouse movement, gaze tracking) to detect session hijacking or unauthorized handoff without interrupting workflow.

Access decisions that incorporate environmental context — time of day, day of week, IP geolocation, network (corporate vs public), device health — beyond identity alone. Implemented in Azure Conditional Access, Okta Adaptive MFA, and Google BeyondCorp.

A dedicated component (OPA, Casbin, AWS Verified Permissions) that evaluates authorization policies and returns permit/deny decisions. Externalizes authorization logic from application code, enabling consistent policy enforcement across services and languages.

A message sent to a Certificate Authority requesting a signed certificate. The CSR contains the subject's public key and identifying information (CN, SAN, organization), signed with the corresponding private key. The CA verifies the request and issues a certificate.

Certificate Revocation List — a periodically published list of certificate serial numbers that have been revoked before their expiration. Clients download the CRL and check it locally. CRLs are large and stale; OCSP Stapling is preferred for real-time revocation checks.

An automated attack that uses lists of leaked username/password pairs from breached databases and tries them against other services, exploiting the fact that users reuse passwords. Success rate is 0.1–2%, but at scale yields thousands of account takeovers. Defeated by MFA and breached-password detection.

Common Vulnerabilities and Exposures — a publicly disclosed cybersecurity vulnerability identified with a unique ID (CVE-YYYY-NNNNN). Maintained by MITRE and NVD. CVEs are the foundation for vulnerability tracking, patch management, and threat intelligence.

Common Vulnerability Scoring System — an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS v3.1 produces scores from 0-10 (Critical, High, Medium, Low, None) based on base, temporal, and environmental metrics. Used to prioritize patching.

Center for Internet Security Critical Security Controls — a prioritized set of 18 safeguards (formerly 20) to protect organizations against cyber attacks. Organized into Implementation Groups (IG1-3) by organizational size and sophistication. Widely used as a baseline and mapped to NIST and other frameworks.

A formal process for requesting, reviewing, approving, implementing, and reviewing changes to IT systems. Prevents unauthorized configuration changes (a common attack vector), maintains system stability, and creates an audit trail for compliance. Defined in ITIL and required by SOX, SOC 2, and ISO 27001.

Google Cloud's standalone identity service providing managed Google accounts for organizations that don't use Google Workspace. Enables organizations to use Google Cloud and other Google services with corporate identities without a Workspace subscription, syncing from directories via LDAP.

An IGA capability where provisioning actions are triggered conditionally based on user attributes, approval decisions, or policy rules — for example, automatically assigning a VPN entitlement only to users whose job location is Remote.

A Lockheed Martin framework describing the stages of a cyberattack: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. Defenders use it to identify opportunities to detect or disrupt attacks at each stage.

An access control model where resource owners can grant or restrict access to their own resources at their discretion. Traditional Unix file permissions are a DAC example. Flexible but vulnerable to insider threats and over-sharing.

A centralized system for storing, organizing, and managing information about users, computers, and resources within a network. Provides authentication and authorization services. LDAP-compliant directories (AD, OpenLDAP) are the most common type in enterprise environments.

An LDAP identifier that uniquely identifies an entry in the directory tree by specifying its full path from root to the entry. Example: CN=John Doe,OU=Finance,DC=corp,DC=com. Each component is a Relative Distinguished Name (RDN).

A cryptographic mechanism that proves the authenticity and integrity of a message or document. Created by hashing the content and encrypting the hash with a private key. Verified using the corresponding public key. Used in JWT signing, code signing, and document signing.

The security state of a device at the time of an access request — including OS patch level, EDR status, disk encryption, jailbreak status, and compliance with corporate policy. Device posture is a key signal in Zero Trust and risk-based authentication decisions.

An attack that abuses Active Directory replication permissions (DS-Replication-Get-Changes-All) to impersonate a domain controller and pull password hashes for any account, including krbtgt and Domain Admins. Enables Golden Ticket creation. Requires privileged AD access to perform.

The process of disabling or deleting user accounts and revoking all associated access rights when an employee leaves or changes roles. Timely de-provisioning is critical — active accounts of departed employees are a common source of unauthorized access and compliance failures.

The process of collecting device attributes (browser version, screen resolution, installed fonts, IP address, timezone) to create a semi-unique identifier. Used in risk-based authentication to recognize returning devices without cookies.

The ability for a user (resource owner) to grant a third-party application limited access to their resources without sharing credentials. OAuth 2.0 is the standard protocol for delegated authorization.

A server in an Active Directory environment that hosts AD DS, authenticates users via Kerberos and NTLM, stores the directory database, and replicates changes to other domain controllers. Every domain must have at least one DC; primary and secondary DCs provide redundancy.

A relationship between two Active Directory domains that allows users in one domain to access resources in another. Trusts can be one-way or two-way, transitive or non-transitive. Forest trusts extend trust across all domains in both forests.

An Active Directory group used exclusively for email distribution lists. Distribution groups cannot be used for access control (unlike Security Groups) and are managed in Exchange/Microsoft 365.

The online representation of an individual, organization, device, or service — consisting of attributes, credentials, and associated access rights within a computing environment. A single person may have multiple digital identities across systems.

An OAuth 2.0 grant type (RFC 8628) for devices with limited input capabilities (smart TVs, CLI tools, IoT devices). The device displays a code and URL; the user authenticates on a separate device. The device polls the authorization server until access is granted.

Demonstrating Proof of Possession (RFC 9449) — an OAuth 2.0 mechanism that binds access tokens to a client's private key, preventing stolen tokens from being used by an attacker. The client signs each request with a proof-of-possession JWT containing a public key thumbprint.

An OIDC metadata document served at /.well-known/openid-configuration that describes the authorization server's endpoints, supported algorithms, and capabilities. Clients use it to auto-configure OAuth/OIDC integration without manual setup.

A successor to RADIUS (the name is a play on RADIUS being "half" the diameter). A full-featured AAA protocol used in mobile networks (3G/4G/5G LTE) and IMS. Provides message reliability, peer negotiation, and a more extensible attribute framework than RADIUS.

MITRE ATT&CK tactic (TA0005) covering techniques attackers use to avoid detection — disabling security tools, clearing logs, obfuscating code, timestomping, using signed binaries (LOLBins), and abusing legitimate cloud services.

The unauthorized transfer of data from a compromised environment to an attacker-controlled location. Common channels include HTTPS to cloud storage, DNS tunneling, email, and USB. DLP tools and network monitoring detect unusual data movement patterns.

A GDPR and privacy-by-design principle requiring that organizations collect only the personal data that is strictly necessary for a specified purpose. Access to data should also be minimized — users should only see data relevant to their role.

A GDPR-mandated assessment required when data processing is likely to result in high risk to individuals' rights and freedoms — such as large-scale processing, systematic monitoring, or use of new technologies. DPIAs identify risks and required mitigations before processing begins.

Defense Information Systems Agency Security Technical Implementation Guide — hardening guides published by DISA for securing DoD IT systems. STIGs provide prescriptive configuration requirements for operating systems, applications, and network devices. Widely adopted outside DoD as security baselines.

Policies governing how long data (including audit logs, access records, and personal information) must be kept before secure disposal. Retention periods are driven by regulatory requirements (GDPR data minimization, SOX 7-year retention, HIPAA 6-year retention) and litigation hold obligations.

A model where a subset of administrative privileges is granted to designated power users (business unit admins, application owners) allowing them to manage users or resources within their scope without full admin rights. Reduces central IT bottleneck while maintaining governance.

Authorization that is evaluated at request time based on current context — user attributes, resource attributes, environmental factors — rather than being pre-computed at provisioning time. Enables fine-grained, context-sensitive access decisions without reprovisioning.

In ABAC and XACML architectures: the Policy Decision Point (PDP) evaluates policies and issues a permit/deny; the Policy Enforcement Point (PEP) intercepts requests and enforces decisions; the Policy Information Point (PIP) supplies attributes to the PDP.

An attack technique that impersonates a domain controller replication request, allowing an attacker with DS-Replication permissions to dump all password hashes from Active Directory without touching LSASS. Used with Mimikatz's lsadump::dcsync. Mitigated by auditing replication permissions.

The process of propagating identity data from an on-premises directory (Active Directory) to a cloud identity provider (Entra ID) using tools like Entra Connect (formerly Azure AD Connect) or SCIM. Enables hybrid identity scenarios where the same credentials work on-prem and in the cloud.

The state of a device meeting a defined security posture — patched OS, enabled disk encryption, enrolled in MDM, active AV, screen lock configured. Device compliance is a gate in Zero Trust Conditional Access policies: non-compliant devices are blocked or limited to restricted access.

A technique where an attacker places a malicious DLL in a location that a legitimate application searches before the real DLL path. When the application loads, it loads the malicious DLL instead, executing attacker code in the context of the legitimate process.

A network evasion technique that routes malicious traffic through trusted CDN providers (Cloudflare, AWS CloudFront) by manipulating HTTP Host headers. The outer HTTPS connection appears to go to a trusted CDN domain; the inner request goes to the C2 server. Major CDN providers now block this technique.

The process of categorizing data by sensitivity and criticality (Public, Internal, Confidential, Restricted/Secret) to determine appropriate handling, access controls, encryption requirements, and retention policies. A prerequisite for effective data protection and DLP.

A self-sovereign identity model where users control their own identifiers and verifiable credentials without relying on a central identity provider. Based on W3C DID and Verifiable Credentials (VC) standards. Blockchain or distributed ledger technology is often used as the trust anchor.

A cryptographic mechanism that uses the signer's private key to create a value proving authenticity and integrity of a message or document. The recipient verifies the signature with the signer's public key. Used in code signing, email (S/MIME), JWT signatures, and PDF signing.

A centralized repository for storing, organizing, and providing access to information about network resources and users. Active Directory, OpenLDAP, and AWS Directory Service are examples. Directory services are the authoritative source for user identities, group memberships, and computer accounts in most enterprises.

A specific right or permission granted to an identity — e.g., the ability to read an S3 bucket, run a SQL query, or approve a purchase order. Entitlement management is the practice of cataloguing, requesting, approving, and reviewing entitlements at scale.

A public-key cryptography approach based on the algebraic structure of elliptic curves over finite fields. Provides equivalent security to RSA with much smaller key sizes (256-bit ECC ≈ 3072-bit RSA). Used in ECDSA, ECDH, and modern TLS cipher suites.

The discipline of defining, cataloguing, requesting, approving, and reviewing access packages (bundles of resources and permissions). Azure AD Entitlement Management and IGA tools provide self-service access request with governance controls and time-limited assignments.

The process by which a user registers an authenticator (biometric, FIDO key, authenticator app) with an authentication system. Enrollment typically requires proof of identity and links the authenticator to the user's account.

Extensible Authentication Protocol — a framework used in network access authentication (802.1X, PPP). Supports multiple authentication methods (EAP-TLS, EAP-TTLS, PEAP) and is the backbone of Wi-Fi WPA2/WPA3 Enterprise authentication.

A modern digital signature algorithm based on the Twisted Edwards curve. Offers strong security (equivalent to ~128-bit symmetric security), fast signing/verification, and small key/signature sizes. Used in SSH keys, TLS 1.3, and modern PKI. Preferred over RSA for new implementations.

Network traffic that flows laterally between servers, services, or workloads within the same data center or cloud environment. East-west traffic is the primary vector for attacker lateral movement and is often uninspected in traditional perimeter-focused architectures.

Microsoft Entra ID is the new name (since 2023) for Azure Active Directory. A cloud-based identity and access management service providing SSO, MFA, Conditional Access, Privileged Identity Management (PIM), and identity governance for cloud and hybrid environments.

Temporary, expedited access granted to resolve a critical incident, often bypassing normal approval workflows due to urgency. Emergency access must be logged, time-limited, and reviewed post-incident. Break-glass accounts are a form of pre-provisioned emergency access.

A structured list of all available access rights and roles in an organization, describing what each entitlement grants access to and under what conditions it can be requested. Enables self-service access requests and governance reporting.

A public-key cryptography approach based on the algebraic structure of elliptic curves over finite fields. Provides equivalent security to RSA with much shorter key lengths (256-bit ECC ≈ 3072-bit RSA), resulting in faster operations and smaller signatures. Used in TLS, ECDSA, and modern OAuth signing.

Elliptic Curve Digital Signature Algorithm — a variant of DSA using ECC. Used for digital signatures in TLS certificates, code signing, and JWT signing (ES256, ES384, ES512). Requires a unique, truly random nonce per signature; reuse breaks private key security.

Stealing data by routing it through the attacker's existing command-and-control channel, blending it with normal C2 traffic. Common in APT campaigns where dedicated exfiltration channels would attract detection. Detected by anomalous C2 traffic volume and DLP controls.

A targeted audit of the specific permissions associated with a role, account, or resource — verifying they remain necessary and appropriately scoped. Distinct from an access review (which assesses who has access) — an entitlement review assesses what each role or account can do.

A major commercial Certificate Authority and PKI solutions provider. Entrust offers managed PKI, TLS certificates, digital identity solutions, and HSM products for enterprise and government customers.

Endpoint Detection and Response — security software that continuously monitors endpoint devices for malicious activity, records behavioral telemetry (process creation, file writes, network connections, registry changes), and enables rapid investigation and automated or manual response. Examples: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne.

An open authentication standard developed by the FIDO Alliance and W3C. WebAuthn allows browsers to use public-key cryptography for authentication, enabling phishing-resistant passwordless login via platform authenticators (Touch ID, Face ID) or roaming authenticators (YubiKey).

Federal Risk and Authorization Management Program — a US government program that standardizes security assessment, authorization, and monitoring for cloud products used by federal agencies. Based on NIST SP 800-53 controls. Three impact levels: Low, Moderate, High.

A pattern where an external identity (from a corporate IdP, GitHub, Google, etc.) is trusted by a cloud resource without creating a local account. Implemented via OIDC or SAML federation, allowing seamless cross-organizational authentication.

An authentication arrangement where one organization's identity system (the IdP) is trusted by another organization's applications (the SP) to authenticate users — eliminating the need for separate credentials in each system.

An authorization approach that controls access at the object or field level rather than just the resource type level. Example: allowing a user to view document X but not document Y. Implemented by relationship-based access control (ReBAC) systems like Google Zanzibar.

A control requiring that any significant action be approved or witnessed by at least two independent authorized individuals. Prevents unilateral abuse of privileged access and is a core control in financial, administrative, and infrastructure change processes.

The highest-level container in Active Directory, consisting of one or more domains that share a common schema, global catalog, and configuration. Forests are the ultimate security boundary in AD — trusts between forests must be explicitly created.

An OIDC logout mechanism that triggers session termination in applications by loading their logout URLs via browser iframes. Less reliable than back-channel logout because it requires the browser to be active and load each iframe successfully.

Federal Information Security Modernization Act — US law requiring federal agencies to develop, document, and implement agency-wide information security programs. FISMA compliance is assessed using NIST SP 800-53 controls and requires annual reporting to OMB.

A standards-based document (XML for SAML, JSON for OIDC discovery) that describes an identity provider's endpoints, certificates, and capabilities. Consuming federation metadata automates IdP/SP trust configuration and enables certificate rollover without manual updates.

Federal Risk and Authorization Management Program — a US government program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products used by federal agencies. Based on NIST SP 800-53 controls at Low, Moderate, or High impact levels.

A middleware component that brokers identity assertions between an enterprise IdP and external service providers — handling protocol translation (SAML to OIDC), attribute mapping, and trust establishment. Examples: ADFS, PingFederate, Okta as a federation hub.

Federal Information Processing Standard 140-2 — NIST's security standard for cryptographic modules. Defines four security levels (1–4) with increasing physical and logical security requirements. US federal agencies must use FIPS 140-2 validated cryptography for sensitive data. FIPS 140-3 (ISO 19790) is the current edition.

A collection of settings that control the working environment of user accounts and computer accounts in Active Directory. GPOs are linked to sites, domains, or OUs and enforced at logon or at scheduled refresh intervals.

A distributed data repository in Active Directory that contains a partial replica of all objects in a multi-domain forest, enabling cross-domain searches. Global Catalog servers listen on port 3268 (LDAP) and 3269 (LDAPS).

A forged Kerberos Ticket Granting Ticket (TGT) created using the krbtgt account's NTLM hash, granting an attacker unrestricted access to any resource in the domain for the ticket's lifetime (typically 10 years by default). Requires full domain compromise to execute; reset krbtgt password twice to remediate.

General Data Protection Regulation — EU regulation governing the collection, storage, processing, and transfer of personal data of EU residents. Requires lawful basis for processing, data minimization, breach notification within 72 hours, and the right to erasure ("right to be forgotten").

A user account with limited privileges granted to external parties (contractors, partners, customers) for temporary or restricted access. Guest accounts should be time-limited, scoped to necessary resources, and regularly reviewed.

A Google Cloud feature that allows external identities (GitHub Actions, Kubernetes service accounts, AWS roles) to access GCP resources without service account keys. Uses OIDC or SAML federation to map external identities to GCP service accounts via attribute conditions.

A collection of settings that define the behavior of users and computers in an Active Directory environment. GPOs are linked to sites, domains, or OUs and are applied via a defined hierarchy (LSDOU). Used to enforce security baselines, software installations, and password policies.

An Active Directory component that stores a partial replica of all objects across all domains in a forest, indexed for fast searching. Global Catalog servers answer queries that span multiple domains and are required for universal group membership resolution during logon.

A forged Kerberos TGT created by an attacker who has obtained the KRBTGT account's password hash (typically via DCSync). A Golden Ticket grants access to any resource in the domain, is valid for up to 10 years by default, and persists even after password changes until the KRBTGT hash is rotated twice.

General Data Protection Regulation — EU law governing the collection, processing, and protection of personal data of EU residents. Key principles: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability. Penalties up to €20M or 4% of global annual turnover.

Governance, Risk, and Compliance — an integrated approach to managing an organization's governance, enterprise risk management, and regulatory compliance. GRC platforms (Archer, ServiceNow GRC, OneTrust) provide unified frameworks for policy management, risk assessments, control testing, and audit management.

A dedicated physical device that safeguards and manages cryptographic keys, performs encryption and signing operations, and provides tamper-evident, tamper-resistant protection. HSMs are used to protect CA root keys, payment HSMs, and secrets management systems.

Health Insurance Portability and Accountability Act — US law establishing national standards for protecting sensitive patient health information (PHI). The Security Rule requires administrative, physical, and technical safeguards including access controls and audit controls.

HMAC-based One-Time Password (RFC 4226) — an OTP algorithm where each code is derived from a shared secret and an incrementing counter. The counter must stay synchronized between client and server. Predecessor to TOTP.

A physical device (e.g., YubiKey, Google Titan Key) that implements FIDO2/U2F to provide phishing-resistant second factor or passwordless authentication. The key signs a challenge cryptographically using a private key that never leaves the device.

HTTP over TLS — the standard for secure web communication. HTTPS encrypts the request and response, authenticates the server via its certificate, and ensures data integrity. Required for all sites handling credentials, personal data, or sensitive transactions.

HTTP Strict Transport Security — a web security policy mechanism (RFC 6797) that instructs browsers to interact with a domain only over HTTPS, even if the user types http://. Prevents SSL stripping attacks. The includeSubDomains and preload directives extend HSTS coverage.

Hash-based Message Authentication Code — a mechanism for verifying both the integrity and authenticity of a message using a cryptographic hash function and a shared secret key. Used in JWT (HS256, HS512), API request signing, and cookie integrity verification.

An identity lifecycle approach where the HR system (Workday, SAP SuccessFactors) triggers account creation, access assignment, and de-provisioning events based on employee hire, transfer, and termination records. Ensures IAM stays in sync with workforce changes without manual tickets.

A dedicated hardware device that generates, stores, and manages cryptographic keys in a tamper-evident, tamper-resistant module. HSMs are used by CAs, payment processors, and enterprises to protect root keys and perform high-volume crypto operations. Validated to FIPS 140-2/3 standards.

Health Insurance Portability and Accountability Act — US law requiring healthcare organizations (Covered Entities) and their vendors (Business Associates) to protect Protected Health Information (PHI) through administrative, physical, and technical safeguards. Security Rule includes access control, audit controls, and encryption requirements.

A system that creates, maintains, and manages identity information and provides authentication services to relying applications (Service Providers). Examples: Azure AD/Entra ID, Okta, PingFederate, ADFS.

A network region where traffic is assumed to be trustworthy without verification — the corporate LAN being the classic example. Implicit trust zones are the opposite of Zero Trust. Attackers exploit them for lateral movement after an initial breach.

The international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Organizations can achieve ISO 27001 certification through third-party audit. Annex A provides 93 security controls.

A framework combining identity lifecycle management (provisioning/de-provisioning) with governance capabilities (access reviews, SoD detection, role management, audit trails). IGA platforms (SailPoint, Saviynt) provide visibility and control over who has access to what and why.

In cloud platforms, a role is an identity with attached permission policies that can be assumed by trusted entities (users, services, or accounts) for temporary credential-based access. Unlike user accounts, roles have no long-term credentials and are assumed using STS (AWS) or equivalent.

A local endpoint available to cloud instances (169.254.169.254 in AWS) that provides metadata including temporary IAM role credentials. SSRF vulnerabilities that reach the IMDS can lead to credential theft. IMDSv2 (token-based) mitigates most IMDS-targeting SSRF attacks.

The end-to-end management of an identity from creation to deletion: onboarding (Joiner), role changes (Mover), and offboarding (Leaver). Encompasses provisioning, access reviews, entitlement changes, and de-provisioning across all connected systems.

Authentication that occurs in the background based on previously established trust factors (device certificate, network location, behavioral patterns) without requiring active user interaction. Used in continuous authentication models.

A signed statement from an Identity Provider to a Service Provider that attests to a user's identity and attributes. In SAML, assertions are XML documents; in OIDC, the ID Token JWT is the assertion.

An agreement, standards-based arrangement, and technology that allows identity information to be portably shared across autonomous security domains. Enables SSO between organizations without merging directories.

Disconnected identity stores across different systems (HR system, Active Directory, SaaS apps) that are not synchronized, leading to inconsistent user data, orphan accounts, and administrative overhead. IGA platforms break down identity silos through connectors and identity correlation.

The process of matching accounts across multiple systems to a single physical identity, even when usernames or formats differ. A key function of IGA platforms during application onboarding.

The process of verifying that a claimed identity corresponds to a real individual and that the individual is who they claim to be. Ranges from self-assertion (IAL1) to in-person document verification (IAL3) per NIST SP 800-63A.

A NIST SP 800-63A classification defining the strength of identity proofing: IAL1 (self-asserted), IAL2 (remote or in-person identity verification), IAL3 (in-person verification with a trained representative). Higher IALs provide stronger assurance against fraudulent identity claims.

The proliferation of disconnected user identities across multiple cloud services, on-premises systems, and SaaS apps without central governance. Leads to orphan accounts, inconsistent access controls, and difficulty enforcing the principle of least privilege.

A JWT issued by an OpenID Provider that attests to the authenticated user's identity. Contains standard claims (sub, iss, aud, exp, iat) plus optional profile claims. ID Tokens must be validated by the client; they are not intended for API authorization.

A deprecated OAuth 2.0 flow where access tokens were returned directly in the redirect URI fragment, bypassing the back-channel token exchange. Deprecated in OAuth 2.1 due to token leakage risks in browser history, referrer headers, and JavaScript access. Replaced by Authorization Code + PKCE.

A certificate issued by a Root CA that is used to sign end-entity certificates. Intermediate CAs insulate Root CAs from direct issuance, reducing exposure of the Root CA private key. Most browser-trusted PKI hierarchies use one or more intermediate CAs.

A Zero Trust concept recognizing that with cloud and mobile workforces, the traditional network perimeter is obsolete. Identity verification — not network location — becomes the primary security control for access decisions.

A security risk that originates from within the organization — a current or former employee, contractor, or business partner who misuses legitimate access to steal data, sabotage systems, or enable external attackers. Mitigated by least privilege, UARs, behavioral analytics (UEBA), and PAM.

A Python library and collection of scripts for working with network protocols, widely used in offensive security for attacking Windows networks. Tools like secretsdump.py (DCSync, SAM dump), psexec.py, and smbclient.py are Impacket-based. Also used by defenders for testing.

A modern IAM architecture concept (Gartner) where identity services — authentication, authorization, lifecycle management, governance — are delivered as a cohesive, cloud-delivered capability spanning hybrid, multi-cloud, and on-prem environments, rather than siloed point solutions.

The connection between an IGA or PAM platform and an IT Service Management tool (ServiceNow, Jira Service Management) to route access requests through existing ticketing workflows, create change records for privileged access, and fulfill access grants via service catalog items.

A detection heuristic used by IDaaS and SIEM platforms that flags an authentication as suspicious when a user appears to log in from two geographically distant locations within a timeframe that would be physically impossible — indicating credential sharing, VPN use, or account compromise.

A security principle where access is denied by default unless explicitly permitted. Any resource or action not covered by a grant policy is automatically blocked. Contrast with implicit allow, where everything is permitted unless explicitly denied.

A discipline combining identity lifecycle management (provisioning, deprovisioning) with governance (access reviews, SoD enforcement, policy management, compliance reporting). IGA platforms include SailPoint IdentityNow, Saviynt, and IBM Security Verify Governance.

A security philosophy that treats identity as the primary control plane — all access decisions derive from verified identity rather than network location. Every resource access requires authentication and authorization regardless of where the request originates.

Observable artifacts (IP addresses, domain names, file hashes, registry keys, URL patterns) that indicate a system may have been compromised. IoCs are shared via threat intelligence feeds and used in SIEM rules and EDR blocklists for detection and response.

The international standard for Information Security Management Systems (ISMS). Provides a systematic framework for managing sensitive information through a risk-based approach. Certification requires an independent audit of the ISMS and controls defined in Annex A (93 controls in the 2022 edition).

Code of practice for information security controls based on ISO/IEC 27002 for cloud services. Provides guidance on 37 cloud-specific controls for both cloud service providers and cloud service customers. Complementary to ISO 27001 for cloud environments.

A cloud service that provides EC2 instances (AWS), VMs (Azure, GCP), and containers metadata including their attached IAM role credentials. Accessible at a link-local IP (169.254.169.254 / fd00:ec2::254 on AWS). IMDS v2 requires a session token, mitigating SSRF-based credential theft.

A set of permissions that can be assumed by AWS entities — users, services, or cross-account principals. IAM roles provide temporary credentials via STS and are the recommended way to grant permissions to EC2 instances, Lambda functions, and ECS tasks. Roles eliminate the need for long-term access keys.

A JSON document in AWS IAM that defines permissions (Effect, Action, Resource, Condition). Identity-based policies attach to users/groups/roles; resource-based policies attach to resources (S3 buckets, KMS keys, SQS queues). The effective permission is the intersection of identity and resource policies.

A security discipline (coined by Gartner) focused on detecting and responding to identity-based attacks — credential theft, MFA bypass, privilege escalation, and lateral movement using compromised accounts. Combines signals from IdP, PAM, SIEM, and EDR to detect identity-based TTPs.

A PAM pattern where elevated privileges are granted dynamically for a specific task and revoked immediately after, rather than held permanently. Reduces the standing privilege attack surface. Often paired with approval workflows and session recording.

A framework describing the three identity lifecycle events requiring access changes: Joiner (new employee onboarded), Mover (employee changes role or department), Leaver (employee departs). Automated JML workflows reduce over-provisioning and orphaned accounts.

A compact, URL-safe token format (RFC 7519) consisting of a Base64URL-encoded header, payload, and cryptographic signature. Used as access tokens, ID tokens (OIDC), and session tokens. JWTs are self-contained — the payload includes claims that can be verified without a database lookup.

A JSON data structure (RFC 7517) representing a set of public keys used to verify JWT signatures. Authorization servers publish JWKS at a well-known URI (/.well-known/jwks.json) so resource servers can validate tokens without shared secrets.

JWT Secured Authorization Response Mode — an OAuth 2.0 extension where the authorization response (authorization code, tokens) is wrapped in a signed and optionally encrypted JWT, protecting against response tampering and mix-up attacks.

JSON Web Encryption (RFC 7516) — a compact token format that represents encrypted content as a Base64URL-encoded string. Used to encrypt ID Tokens or access tokens so their contents are visible only to the intended recipient, providing confidentiality in addition to integrity.

JSON Web Signature (RFC 7515) — a compact serialization for digitally signed content. All signed JWTs use the JWS format. The signature covers the header and payload and is verified using the signer's public key or a shared secret.

An approach where user accounts in an application are created automatically the first time a user authenticates via SSO, rather than being pre-provisioned. Reduces orphan accounts since accounts don't exist until needed. Common in SAML-based SSO integrations.

Authentication based on answers to personal questions (mother's maiden name, first pet, etc.). Considered weak due to social engineering and data breach exposure. NIST SP 800-63B explicitly discourages KBA as a sole authentication mechanism.

A network authentication protocol (RFC 4120) that uses secret-key cryptography and a trusted third party (Key Distribution Center / KDC) to authenticate service requests. The default authentication protocol in Windows domains. Ticket-based design eliminates repeated password transmission.

A cryptographic algorithm that derives one or more secret keys from a secret value (password, shared secret). KDFs like bcrypt, Argon2, PBKDF2, and scrypt are designed to be computationally expensive to slow brute-force attacks.

An Active Directory attack where an attacker with domain credentials requests service tickets (TGS) for service accounts with SPNs, then cracks the tickets offline using the service account's password hash. Mitigated by using Managed Service Accounts with long random passwords.

A Kerberos credential issued by the Key Distribution Center (KDC) after initial authentication. The TGT is used to request service tickets (TGS) for accessing specific resources without re-entering credentials. TGTs have a configurable lifetime (default 10 hours in AD).

A cryptographic protocol that allows two parties to establish a shared secret over an insecure channel. Diffie-Hellman (DH) and Elliptic Curve Diffie-Hellman (ECDH) are the primary key exchange algorithms. Used in TLS handshakes to derive session keys.

The practice of periodically replacing cryptographic keys to limit the impact of key compromise and exposure. Applies to signing keys (JWTs), TLS certificates, database encryption keys, and API keys. Automated rotation via secrets managers reduces human error.

A Kerberos feature allowing a service to request tickets on behalf of a user to access other services (constrained or unconstrained). Unconstrained delegation is particularly dangerous — if the service account is compromised, attackers can impersonate any user who authenticates to it.

Authentication using questions whose answers only the legitimate user should know (mother's maiden name, first pet's name). Widely used in account recovery but considered weak due to answers being discoverable through social media and data breaches. NIST SP 800-63B restricts KBA use.

A Kerberos feature that allows a service to impersonate a user for specific back-end services only (not all services, unlike unconstrained delegation). Configured with an allowed list of target SPNs. Safer than unconstrained delegation but still requires careful management.

A function that derives one or more cryptographic keys from a source (password, master key, shared secret). Examples: PBKDF2, bcrypt, scrypt, Argon2, HKDF. KDFs add computational cost (for password hashing) or expand key material (HKDF for TLS key derivation).

The practice of storing copies of cryptographic keys with a trusted third party (escrow agent), enabling key recovery by authorized parties (e.g., law enforcement with a court order, or IT admins recovering encrypted employee data). Controversial for personal communications encryption.

An attack where any authenticated AD user requests Kerberos service tickets (TGS) for accounts with registered SPNs and cracks the encrypted tickets offline to recover the service account password. Does not require elevated privileges. Mitigated by long, random service account passwords and managed service accounts (gMSA).

Encrypting one cryptographic key with another (the Key Encryption Key / KEK) to protect it during storage or transmission. Enables secure distribution of data encryption keys without exposing the master key. Used in HSM key management, AWS KMS envelope encryption, and PKCS#12 files.

A security principle dictating that a user, process, or system should have only the minimum permissions necessary to perform its intended function — no more. Limits the blast radius of compromised accounts and insider threats.

Lightweight Directory Access Protocol — an application protocol for accessing and maintaining distributed directory information services over TCP/IP (port 389). Used to query user accounts, groups, and attributes in Active Directory and other LDAP-compliant directories.

LDAP over SSL/TLS — LDAP traffic encrypted with TLS, listening on port 636. Required when LDAP is used for authentication or when directory data includes sensitive attributes. Plain LDAP transmits credentials in cleartext and should not be used in production.

Techniques used by attackers to progressively move through a network after initial compromise to reach their target. Includes Pass-the-Hash, Pass-the-Ticket, remote service abuse, and WMI/PSExec execution. Microsegmentation and Zero Trust limit lateral movement blast radius.

An attack strategy where threat actors use legitimate, pre-installed system tools (PowerShell, WMI, certutil, MSHTA) to carry out malicious operations, avoiding the need to drop custom malware and evading signature-based detection.

Extracting credential material (password hashes, plaintext passwords, Kerberos tickets) from the Local Security Authority Subsystem Service (lsass.exe) process memory. Performed by tools like Mimikatz. Mitigated by Windows Credential Guard and Protected Users security group.

A parameter in OAuth/OIDC authorization requests (login_hint) that pre-populates the IdP's login form with the user's identifier, reducing friction in SSO flows by skipping email entry at the IdP.

A pre-configured, governed multi-account cloud environment that implements security, networking, logging, and IAM baselines as code. AWS Control Tower and Azure Landing Zones provide opinionated landing zone implementations with guardrails for compliance and security.

A control that slows down authentication attempts after a configurable number of failures, using exponential backoff or delays. Slows brute-force attacks without locking accounts. Often combined with CAPTCHA challenges for suspected automated attempts.

A string that uniquely identifies an object in an LDAP directory, composed of Relative Distinguished Names (RDNs) from the object up to the root. Example: CN=Jane Doe,OU=Marketing,DC=corp,DC=example,DC=com. Used in LDAP queries and bind operations.

An injection attack where unsanitized user input is embedded in LDAP queries, potentially allowing an attacker to modify the query logic to bypass authentication, enumerate directory objects, or extract sensitive data. Mitigated by parameterized LDAP queries and input validation.

LDAP over SSL/TLS — encrypts LDAP communication to prevent credential and data interception in transit. Uses port 636 (LDAPS) or StartTLS on port 389. Microsoft requires LDAP channel binding and signing as a security baseline for Active Directory domain controllers.

A free, automated, and open Certificate Authority (CA) operated by ISRG that issues DV (Domain Validation) TLS certificates via the ACME protocol. Certificates are valid for 90 days and renewal is typically automated via certbot or ACME client integrations in web servers.

Attacker techniques for moving from an initial foothold to other systems within the target environment, escalating privileges along the way. Common techniques include Pass-the-Hash, Kerberoasting, remote service exploitation, and abusing AD trusts. Zero Trust micro-segmentation limits lateral movement paths.

Attacker techniques for pivoting from an initial access point to other systems in the environment using compromised credentials, stolen tokens, or exploited trust relationships. Common techniques: PsExec, WMI, SMB, Kerberos delegation abuse, and Azure resource lateral movement.

An attack strategy where adversaries use built-in, legitimate system tools (PowerShell, WMI, certutil, msiexec, MSHTA) to perform malicious actions, avoiding the need to drop custom malware. Harder to detect because these tools are whitelisted and expected.

An authentication method that requires two or more verification factors from different categories: something you know (password), something you have (hardware token, phone), and something you are (biometric). MFA significantly reduces account takeover risk.

An access control model where the operating system enforces access policies based on security labels (classifications) on subjects and objects. Users cannot override MAC policies. Used in government/military systems (SELinux, MLS). Contrasted with Discretionary Access Control (DAC).

A network security technique that divides a network into small, isolated segments with strict access controls between them. Prevents lateral movement by attackers — compromising one segment does not grant access to others. A key pillar of Zero Trust network design.

A globally accessible, curated knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Used for threat intelligence, red team planning, detection engineering, and security gap analysis. Organized into Tactics (why) → Techniques (how) → Sub-techniques.

An Azure identity type that enables Azure resources (VMs, App Services) to authenticate to Azure services without storing credentials in code. System-assigned managed identities are tied to a single resource; user-assigned identities can be shared across resources.

A passwordless login method where a single-use, time-limited URL is sent to the user's verified email. Clicking the link authenticates the user without a password. Convenient but subject to email account compromise risk.

An attack technique where an adversary bombards a victim with repeated MFA push requests, hoping the user approves one out of frustration or confusion. Mitigated by number matching, additional context in push notifications, and rate limiting.

A TLS extension where both the client and server present certificates to authenticate each other, not just the server. Used for service-to-service authentication in microservices, API gateways, and IoT. Provides strong machine identity assurance.

A type of AD account that provides automatic password management, simplified SPN management, and the ability to be shared across multiple computers (Group Managed Service Account / gMSA). Designed to replace traditional service accounts with manually managed passwords.

Message Digest 5 — a widely used but cryptographically broken hash function producing a 128-bit output. Vulnerable to collision attacks; do not use for security purposes. Still seen in legacy systems and non-security contexts (checksums). Replaced by SHA-256.

A widely used post-exploitation tool that extracts plaintext passwords, NTLM hashes, and Kerberos tickets from Windows memory (LSASS). Developed by Benjamin Delpy, it is the primary tool for credential harvesting in AD attacks. Mitigated by Credential Guard and Protected Users group.

The challenge and practice of managing identities and access controls consistently across multiple cloud providers (AWS, Azure, GCP). Requires federated identity (same IdP across clouds), consistent RBAC modeling, and tooling (CIEM, CASBs) for unified visibility.

A discipline focused on governing the identities of non-human entities — certificates, API keys, SSH keys, OAuth client credentials — at scale. Includes discovery, lifecycle management, rotation, and revocation. Increasingly critical as organizations move to microservices and CI/CD.

A network security technique that divides data center environments into small, isolated segments with fine-grained access controls between workloads. Limits lateral movement — a compromised segment cannot communicate with others unless explicitly allowed by policy.

An Azure feature that automatically manages an identity for an Azure resource (VM, Function App, App Service) in Entra ID, eliminating the need for credentials in code. System-assigned managed identities are tied to the resource lifecycle; user-assigned managed identities are independent.

Privileged accounts whose credentials are exclusively managed by a PAM platform — the account owner never knows the current password. The PAM vault rotates credentials after each session and injects them directly, preventing credential sharing and ensuring all access goes through the PAM audit trail.

A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. ATT&CK matrices exist for Enterprise (Windows/Linux/Mac/Cloud/SaaS), Mobile, and ICS environments. Used to develop detection analytics, prioritize defenses, and report on red team findings.

NT LAN Manager — a Microsoft challenge-response authentication protocol that predates Kerberos. Still supported for backward compatibility but considered weak due to susceptibility to Pass-the-Hash and relay attacks. Organizations should disable NTLM where possible.

The foundational principle of Zero Trust — no user, device, or network segment is inherently trusted, even within the corporate perimeter. Every access request must be authenticated, authorized, and continuously validated regardless of its origin.

A voluntary framework by NIST (currently CSF 2.0) that provides guidance on managing and reducing cybersecurity risk. Organized around six functions: Govern, Identify, Protect, Detect, Respond, Recover. Widely adopted across industries and government sectors.

NIST Special Publication 800-53 — a comprehensive catalog of security and privacy controls for federal information systems. The authoritative control catalog for FedRAMP. Organized into families including Access Control (AC), Audit and Accountability (AU), and Identification and Authentication (IA).

An MFA control that requires the user to match a number shown in their browser to one displayed in the authenticator app before approving a push notification. Prevents blind approvals and defeats MFA fatigue attacks.

A security principle stating that access to information should be restricted to individuals who require it to perform their specific job function, even if they otherwise hold a sufficient clearance level. Underpins data classification and compartmentalization.

An identity assigned to a machine, application, script, API, or automated process rather than a human user. Examples include service accounts, API keys, OAuth clients, and managed identities. NHIs are estimated to outnumber human identities 50:1 in modern enterprises and represent an expanding attack surface.

A number used once — a random or pseudo-random value used to ensure a cryptographic operation cannot be replicated. Used in OAuth authorization requests (replay prevention), JWT (jti claim), and TLS handshakes.

A network security approach that enforces policy-based access control at the network level — checking device compliance (patch level, AV status, MDM enrollment) before granting LAN, VPN, or Wi-Fi access. Complements Zero Trust for on-premises environments.

The assurance that a party cannot deny having performed an action or sent a message. Achieved through digital signatures, audit logs with strong identity binding, and time-stamping. A key requirement in financial transactions, legal documents, and compliance audits.

NIST Special Publication 800-63B — the definitive US government guidance on digital identity authentication. Defines Authenticator Assurance Levels (AAL1-3), provides requirements for password policies, MFA, and authenticator types. Widely adopted as best practice beyond government use.

NT LAN Manager — a legacy Microsoft authentication protocol using a challenge-response mechanism. Weaker than Kerberos: lacks mutual authentication, susceptible to pass-the-hash, NTLM relay, and brute-force attacks. Should be disabled where Kerberos is available; still required for non-domain and local accounts.

An attack that intercepts NTLM authentication challenges and relays them to another host, authenticating as the victim without knowing their password. Exploits NTLM's lack of mutual authentication. Tools like Responder and ntlmrelayx automate this attack. Mitigated by SMB signing and EPA.

The NIST Special Publication defining the Zero Trust Architecture model — its tenets, logical components, and deployment scenarios. Published August 2020, it is the authoritative US government reference for Zero Trust implementation and compliance reporting.

A voluntary framework by NIST providing guidance for managing and reducing cybersecurity risk through five core functions: Identify, Protect, Detect, Respond, Recover (NIST CSF 1.1). CSF 2.0 (2024) added a sixth function: Govern. Widely adopted by critical infrastructure and enterprises.

A container object within Active Directory used to organize users, computers, and other objects. OUs are the smallest scope at which Group Policy Objects (GPOs) can be applied and to which administrative delegation can be scoped.

A user account that remains active in a system after the person it belongs to has left the organization or changed roles. Orphan accounts are a common audit finding and represent a significant security risk if not detected and disabled promptly.

An open authorization framework (RFC 6749) that enables applications to obtain limited access to user accounts on HTTP services. OAuth 2.0 defines grant types (Authorization Code, Client Credentials, Device Code) for different client scenarios. It is an authorization framework, not an authentication protocol.

An identity layer built on top of OAuth 2.0 (RFC 8414) that adds authentication. OIDC introduces the ID Token (a JWT) that identifies the authenticated user, and the UserInfo endpoint. OIDC is the modern standard for federated identity in web and mobile apps.

Online Certificate Status Protocol — a real-time protocol for checking whether a specific certificate has been revoked. More efficient than CRL downloads. OCSP Stapling (TLS extension) allows servers to cache and serve the OCSP response directly, reducing latency.

A password valid for only one login session or transaction. OTPs are generated either by a counter (HOTP) or time (TOTP) and resist replay attacks because each value is used only once.

Authentication that uses a secondary communication channel separate from the primary login channel. Example: SMS OTP sent to a phone number separate from the browser login session. Reduces risk of single-channel interception.

In OpenID Connect, the party that authenticates users and issues ID Tokens and access tokens. Equivalent to the Authorization Server in OAuth 2.0. Examples: Google, Microsoft Entra ID, Okta, Auth0.

An attack that tricks users into granting a malicious OAuth application access to their accounts. The app requests broad scopes (read mail, contacts, OneDrive), which the user approves. The attacker then accesses the victim's data without ever obtaining credentials. Also called "consent phishing."

An access right that remains provisioned after the justification for it no longer exists — typically because the user changed roles, the resource was decommissioned, or the project ended. Orphaned entitlements are a leading compliance finding and exploit path.

A container object in Active Directory used to organize users, computers, groups, and other OUs within a domain. OUs are the target for Group Policy Object (GPO) application and enable delegated administration by granting management rights at the OU level.

An attack variant that converts an NTLM hash into a Kerberos TGT, enabling Kerberos-based lateral movement using a captured password hash — bypassing restrictions that block NTLM. Requires tools like Mimikatz. Also called "Pass-the-Key."

A standard for establishing trust between identity providers and relying parties at federation scale, using signed Entity Statements organized in a Trust Chain. Designed for large-scale deployments such as national eID systems and academic federations (eduGAIN).

A protocol for checking the revocation status of individual X.509 certificates in real time. The client queries the CA's OCSP responder with the certificate serial number and receives a signed good/revoked/unknown response. OCSP Stapling improves performance by caching the response on the server.

Open Source Intelligence — gathering publicly available information about a target from websites, social media, WHOIS, Shodan, LinkedIn, GitHub, and data breaches. Used in reconnaissance to identify targets, email formats, technologies, and potential attack vectors.

OAuth (Open Authorization) 2.0 — the industry-standard framework (RFC 6749) for delegated authorization. Enables third-party applications to obtain limited access to a user's account on another service without exposing credentials. The foundation for most modern API authorization and SSO integrations.

Authentication that does not require a traditional password. Methods include FIDO2/WebAuthn passkeys, magic links sent to email, biometrics, and hardware security keys. Eliminates the largest category of credential-based attacks.

An IAM construct (notably in AWS) that sets the maximum permissions an identity can be granted, regardless of what policies are attached. Useful for delegating IAM administration to developers while preventing privilege escalation.

Proof Key for Code Exchange (RFC 7636) — an OAuth 2.0 security extension for public clients (mobile/SPA apps) that cannot securely store a client secret. PKCE uses a dynamically generated code verifier and code challenge to prevent authorization code interception attacks.

A framework of policies, procedures, hardware, software, and people used to create, manage, distribute, use, store, and revoke digital certificates. PKI underpins HTTPS, email encryption, code signing, and client certificate authentication.

In NIST's Zero Trust Architecture, the component that intercepts access requests, communicates with the Policy Decision Point (PDP), and either allows or blocks access to resources based on the policy decision. Examples: API gateway, network proxy, VPN.

The component in a Zero Trust Architecture that evaluates access requests against policies and grants or denies access. The PDP receives context from the Policy Engine and signals the Policy Enforcement Point (PEP). Sometimes split into Policy Engine + Policy Administrator.

A social engineering attack that deceives users into revealing credentials or installing malware by impersonating a legitimate entity via email, SMS (smishing), or voice (vishing). The leading cause of enterprise credential compromise. Mitigated by phishing-resistant MFA (FIDO2) and security awareness training.

A brute-force variation that attempts a small number of commonly used passwords against many accounts to avoid account lockout. Particularly effective against organizations with weak password policies. Mitigated by MFA and lockout policies with distributed detection.

A lateral movement technique where an attacker captures an NTLM password hash from a compromised system (e.g., via LSASS dumping) and uses it to authenticate as that user without cracking the underlying password. Requires disabling NTLM and using Credential Guard.

A lateral movement attack against Kerberos where an attacker steals a Kerberos ticket (TGT or service ticket) from memory and uses it to impersonate the victim user for the ticket's remaining validity period.

The act of gaining higher access rights than originally granted — either vertically (gaining admin/root from a standard user) or horizontally (accessing another user's resources at the same privilege level). A core step in the MITRE ATT&CK attack chain.

Payment Card Industry Data Security Standard — a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Maintained by the PCI Security Standards Council.

A category of cybersecurity tools and processes for controlling, monitoring, and auditing privileged accounts and credentials. PAM solutions (CyberArk, BeyondTrust, Delinea) provide session recording, credential vaulting, just-in-time access, and privileged session management.

A subset of PAM focusing on managing privileged identities — particularly just-in-time elevation for admin roles in Azure AD/Entra ID (Azure PIM). Users activate privileged roles on demand for a limited time rather than holding them permanently.

A hardened, dedicated workstation used exclusively for administrative tasks on sensitive systems. PAWs reduce attack surface by prohibiting internet browsing and email, using separate admin accounts, and applying additional endpoint controls. A Microsoft-recommended control for Tier 0 administration.

The process of creating and configuring user accounts and granting appropriate access rights in systems and applications when an employee joins or changes roles. Automated provisioning (via SCIM or HR system connectors) reduces errors, delays, and over-provisioning.

A FIDO2/WebAuthn credential pair — a private key stored on the user's device and a public key stored on the server — that replaces passwords. Passkeys are phishing-resistant, bound to the authenticating domain, and synchronized across devices via the platform (iCloud Keychain, Google Password Manager).

An MFA method where the authentication server sends a push notification to a registered mobile device (via an app such as Duo or Microsoft Authenticator). The user approves or denies the request. Susceptible to MFA fatigue attacks.

A set of rules governing password creation and management — minimum length, complexity requirements, history (preventing reuse), maximum age, and prohibited patterns. NIST SP 800-63B recommends length over complexity and removing periodic rotation requirements.

A mechanism where an object (file, folder, resource) inherits access permissions from its parent container. Used in NTFS file systems and Active Directory OUs. Inheritance reduces administrative overhead but can lead to unintended access if not audited.

The practice of defining authorization and security policies in machine-readable formats (OPA Rego, Cedar, Sentinel) and managing them with version control and CI/CD pipelines. Enables consistent, auditable, and testable policy enforcement across infrastructure.

An account with elevated permissions beyond those of a standard user — including domain admins, local admins, root accounts, database admins, and application service accounts. Privileged accounts are the primary target in advanced attacks and require PAM controls.

An OAuth 2.0 extension (RFC 9126) where the client sends authorization request parameters directly to the authorization server via a back-channel request before redirecting the user. Prevents parameter tampering in the URL and improves security for confidential clients.

A TLS property ensuring that session keys are derived from ephemeral key exchanges (ECDHE, DHE) rather than the server's long-term private key. If the private key is later compromised, past sessions cannot be decrypted because each session used a unique ephemeral key.

Password-Based Key Derivation Function 2 (RFC 2898) — a key stretching algorithm that applies a pseudorandom function (typically HMAC-SHA256) to a password with a salt, repeated many times. Used in WPA2 Wi-Fi, PKCS#12, and legacy password hashing. Superseded by bcrypt and Argon2 for password storage.

An approach that embeds privacy and data protection considerations into system design from the outset, rather than adding them as an afterthought. One of the seven foundational principles of GDPR. Requires data minimization, purpose limitation, and default-strong privacy settings.

A focused audit of privileged accounts and access rights — verifying that privileged accounts are justified, secured with MFA and PAM controls, subject to session recording, and reviewed on a defined schedule. Common finding in SOC 2, ISO 27001, and FedRAMP assessments.

An entity in AWS IAM (user, group, role, service, or AWS account) that can make requests for actions on AWS resources. IAM policies are attached to principals to define what they can do. In OIDC/SAML contexts, a principal is the authenticated subject.

A PAM capability that brokers privileged sessions through an intermediary, recording all activity, injecting credentials without exposing them to the user, and enabling session termination by administrators. Provides non-repudiation and supports forensic investigation.

Authentication methods that eliminate the password — including FIDO2 passkeys, magic links, hardware security keys, and biometrics. Removes the largest class of authentication vulnerabilities (credential stuffing, phishing, password reuse) while often improving user experience.

In Kerberos, pre-authentication requires the client to prove knowledge of the account password before the KDC issues a TGT. Without pre-authentication (AS-REP Roasting), an attacker can request an encrypted TGT blob for any account and crack it offline.

An attack technique where an adversary captures an NTLM password hash and uses it directly to authenticate without cracking it. Exploits the fact that NTLM authentication uses the hash itself as the credential. Mitigated by Credential Guard, Protected Users group, and disabling NTLM.

A PAM+ZTNA capability providing secure, identity-verified access to critical infrastructure for privileged users and third-party vendors, without requiring VPN or exposing management ports (RDP, SSH) to the internet. Sessions are brokered, recorded, and time-limited.

A brute-force variant that tries a small set of common passwords against many accounts, staying below lockout thresholds. Particularly effective against environments without MFA and with predictable password formats (Company1!). Common in O365 and Active Directory attacks.

The act of gaining higher permissions than initially obtained — local admin to domain admin, read-only to admin, container to host. Techniques include exploiting local vulnerabilities, abusing misconfigured AD delegation, and token impersonation.

A packaged collection of files (HTML, CSS, JS, PHP) that replicate a legitimate website's login page to harvest credentials. Modern kits include AiTM proxies (Evilginx2, Modlishka) that bypass MFA by relaying authentication in real time and capturing session cookies.

A technique where attacker code is injected into another running process's memory space (DLL injection, reflective DLL loading, process hollowing), making the malicious code run under the identity and privileges of the host process — evading process-based security controls.

MITRE ATT&CK tactic (TA0003) covering techniques adversaries use to maintain a foothold across reboots and credential changes — scheduled tasks, registry run keys, startup folder entries, web shells, new user accounts, and malicious services.

Payment Card Industry Data Security Standard — a set of security standards for all organizations that store, process, or transmit cardholder data. Administered by the PCI SSC. PCI DSS v4.0 (2022) introduced customized implementation and strengthened MFA requirements.

A simulated cyberattack against a system, application, or network conducted by authorized security professionals to identify exploitable vulnerabilities before malicious actors do. Required by PCI DSS, SOC 2, and many compliance frameworks. Produces a report of findings and remediation recommendations.

An AWS IAM feature that sets the maximum permissions an IAM entity (user or role) can have — regardless of identity-based policies. Permission boundaries are used by central security teams to delegate IAM administration while preventing privilege escalation beyond an approved scope.

A PAM component that securely stores, manages, and periodically rotates privileged account credentials. Credentials are checked in and out by authorized users; the vault injects passwords into sessions without exposing them. Examples: CyberArk Digital Vault, Delinea Secret Server.

Public Key Cryptography Standards — a family of RSA Security standards defining interoperable PKI formats. Common ones: PKCS#1 (RSA), PKCS#7/CMS (signed/encrypted messages), PKCS#8 (private key format), PKCS#10 (CSR format), PKCS#11 (HSM API), PKCS#12 (key + certificate bundle, .pfx/.p12).

A framework of policies, procedures, hardware, software, and people needed to create, manage, distribute, store, and revoke digital certificates and manage public-key encryption. A PKI consists of a Certificate Authority hierarchy, registration authorities, certificate repositories, and revocation services.

Cryptographic algorithms designed to be resistant to attacks by quantum computers, which could break RSA and ECC using Shor's algorithm. NIST finalized its first PQC standards in 2024: ML-KEM (CRYSTALS-Kyber for key exchange) and ML-DSA (CRYSTALS-Dilithium for signatures).

A collaborative security testing model where offensive (red team) and defensive (blue team) practitioners work together — sharing TTPs and detection logic in real time to accelerate detection engineering. More efficient than purely adversarial red/blue exercises for improving detection coverage.

An authentication strategy that dynamically adjusts the required authentication strength based on contextual risk signals — such as new device, unusual location, atypical access time, or high-value transaction. High-risk contexts trigger step-up MFA.

An access control model where permissions are assigned to roles, and users are assigned to roles. A user inherits the permissions of all their roles. RBAC simplifies administration at scale but can lead to role explosion in complex environments.

Remote Authentication Dial-In User Service — a networking protocol (RFC 2865) providing centralized authentication, authorization, and accounting for users who connect to a network. Widely used in VPN, Wi-Fi (802.1X), and dial-up access scenarios.

In AWS, a policy attached directly to a resource (S3 bucket, KMS key, Lambda function) that specifies who can access it and what actions they can perform. Resource-based policies enable cross-account access without assuming a role.

The process of analyzing actual access patterns and user attribute data to discover natural role structures, helping organizations move from ad-hoc entitlement assignment to a well-defined RBAC model. Identifies outliers and over-privileged accounts.

A set of single-use backup codes generated when setting up MFA. Used to regain account access if the primary MFA device is lost or unavailable. Recovery codes must be stored securely (offline or in a password manager) and never exposed.

The requirement to authenticate again during an existing session before performing a high-risk action (password change, payment, admin task). Re-authentication confirms the user is still present and has not walked away from an unlocked session.

A long-lived credential issued alongside an access token in OAuth 2.0, used to obtain new access tokens after expiry without requiring the user to re-authenticate. Refresh tokens must be stored securely and support revocation.

An access control model where permissions are determined by the relationship between a subject and a resource object. Example: a user can edit a document if they are its "owner" or a member of a group that is the "editor" of that document. Used by Google, Airbnb, and others at scale.

In OAuth 2.0, the entity capable of granting access to a protected resource — typically the end user. The resource owner can authorize a client application to access their data on a resource server.

A SAML parameter that preserves state across the SSO redirect flow — typically the URL the user was trying to access before being redirected to the IdP. After successful authentication, the SP uses RelayState to redirect the user to the original destination.

Rivest–Shamir–Adleman — the most widely used public-key cryptosystem, based on the mathematical difficulty of factoring large integers. Used for key exchange (RSA-OAEP), digital signatures (RSASSA-PKCS1-v1_5, RSA-PSS), and certificate key pairs. Minimum recommended key size: 2048 bits (3072+ for new systems).

A self-signed certificate at the top of a PKI trust hierarchy, issued by a Root Certificate Authority. Root certificates are pre-installed in browser and OS trust stores. Compromise of a root CA is catastrophic as it undermines trust in all certificates issued under it.

Malware that encrypts victim files or systems and demands payment (ransom) for the decryption key. Modern ransomware groups (RaaS) also exfiltrate data before encryption for double extortion. IAM controls (least privilege, MFA, PAM) significantly reduce ransomware blast radius.

The first phase of the attack lifecycle (MITRE ATT&CK TA0043) — gathering information about the target: employee names, email formats, technology stack, exposed services, domain structure, and third-party relationships. Conducted via OSINT, scanning, and social engineering.

The process of identifying, estimating, and prioritizing risks to organizational operations, assets, and individuals from threats exploiting vulnerabilities. Consists of threat identification, vulnerability analysis, likelihood estimation, impact analysis, and risk prioritization.

A periodic review process where role owners attest that each role definition remains appropriate — that the permissions assigned to the role are still required and that all members of the role should retain it. Part of role lifecycle management in IGA.

An adaptive authentication approach that evaluates contextual signals (device, location, behavior, IP reputation, time of day) at login time to determine the authentication challenge level. Low-risk logins proceed with less friction; high-risk logins trigger step-up MFA or block.

The process by which Active Directory changes (new objects, attribute updates, password changes) are propagated to all domain controllers in a domain or forest. AD uses multi-master replication where any DC can accept writes; conflicts are resolved by timestamp.

Remote Authentication Dial-In User Service — a UDP-based AAA protocol widely used for network access authentication (VPN, Wi-Fi, dial-up). Authenticates users against a central server before granting network access. Uses a shared secret between client and server. Being supplanted by DIAMETER in modern networks.

A Kerberos delegation model where the target resource controls which accounts can delegate to it (msDS-AllowedToActOnBehalfOfOtherIdentity attribute) — rather than the source service. Abused in attacks when an attacker can write to the target's AD object.

An OAuth 2.0 parameter (RFC 8707) that specifies the intended resource server for an access token. Enables audience-restricted tokens — the authorization server mints tokens explicitly for the named resource, preventing token reuse across different APIs.

An OAuth 2.0 extension (RFC 9396) allowing clients to pass structured authorization details as a JSON object in the authorization request — specifying exactly what permissions are being requested (e.g., transaction ID, amount, account) beyond what scopes can express.

A precomputed table mapping passwords to their hashes, used to reverse password hashes without brute-forcing. Defeated by salting — a unique salt per password means the attacker cannot precompute a useful table.

The proliferation of an unmanageable number of roles in an RBAC model, typically caused by creating roles for every unique combination of permissions rather than reusing parameterized roles. Role explosion increases administrative overhead and makes role assignment auditing impractical.

A group of security professionals who simulate advanced adversary tactics against an organization — attempting to achieve defined objectives (data exfiltration, domain compromise) while evading detection. Red team exercises test the effectiveness of defenses, detection capabilities, and incident response.

The level of risk that remains after controls have been applied. Residual risk is accepted by management, further mitigated, transferred (cyber insurance), or avoided. Risk acceptance requires formal sign-off from the appropriate risk owner.

An authentication scheme allowing a user to log in once and gain access to multiple related systems without re-authenticating. SSO typically relies on a centralized Identity Provider (IdP) and protocols such as SAML 2.0 or OIDC.

A mechanism that requires additional authentication factors when a user attempts to access a higher-risk resource or perform a sensitive action, without requiring a full re-login session. Common in banking and PAM solutions.

A cryptographically random value issued after successful authentication, used to identify and authorize subsequent requests within a session. Sessions should be time-limited, invalidated on logout, and protected against fixation and hijacking attacks.

A control requiring that no single individual has sole control over a critical business process. For example, the person who approves a payment should not be the same person who initiates it. SoD conflicts indicate when a user holds two roles that together create an unacceptable risk.

In OAuth 2.0, scopes are strings that define the specific access permissions being requested by an application. Resource servers use scopes to enforce fine-grained authorization. Examples: read:users, write:reports, openid, profile.

In SAML and SSO contexts, the application or service that relies on the Identity Provider to authenticate users. The SP consumes assertions from the IdP to grant access. Also called a Relying Party (RP) in OIDC.

A unique, immutable value assigned by Windows to every security principal (user, group, computer). SIDs persist even if the account is renamed. Access control entries in DACLs and SACLs reference SIDs, not account names.

System for Cross-domain Identity Management. An open standard (RFC 7643/7644) for automating the exchange of user identity information between identity providers and service providers (provisioning/de-provisioning). Used by Okta, Azure AD, and most modern SaaS apps.

A non-human identity used by applications, scripts, or services to authenticate and interact with other systems. Service accounts are a high-value target because they often have elevated privileges and infrequently rotated credentials.

Security Assertion Markup Language 2.0 — an XML-based open standard for exchanging authentication and authorization data between an Identity Provider and a Service Provider. SAML is the dominant SSO standard in enterprise environments, especially for legacy applications.

A random value added to a password before hashing to ensure that identical passwords produce different hashes. Salts prevent rainbow table attacks and ensure each password hash is unique. Must be stored alongside the hash.

A security framework that creates one-to-one network connections between users and the specific resources they are authorized to access, hiding resources from unauthorized users entirely. Implements "dark cloud" networking where resources are invisible until access is granted.

A forged Kerberos service ticket created using a service account's password hash. Provides access to a specific service without contacting the KDC, making it harder to detect. Less powerful than a Golden Ticket but still grants persistent service-level access.

Service Organization Control 2 — an auditing standard developed by the AICPA for service organizations. Evaluates controls related to the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Type I assesses design; Type II assesses operational effectiveness over a period.

AWS Organizations feature that sets permission guardrails (maximum available permissions) for accounts within an organizational unit. SCPs do not grant permissions — they restrict what can be granted. Useful for enforcing organization-wide security policies.

A PAM capability that captures all activity during a privileged session (commands executed, keystrokes, screen output) for forensic review and compliance. Recorded sessions provide non-repudiation and are essential for detecting insider threats and investigating incidents.

An attack where an adversary sets a known session ID for the victim before login. After the victim authenticates, the attacker uses the same session ID to hijack the authenticated session. Mitigated by regenerating session IDs upon successful authentication.

The exploitation of a valid session token to gain unauthorized access to a user's active session — typically by stealing the session cookie via XSS, network sniffing, or predictable token values.

An OIDC flow where the authorization server re-authenticates a user without visible interaction, using the prompt=none parameter. Returns an error if the user has no valid session or consent, allowing apps to seamlessly renew tokens.

A one-time password delivered via SMS text message. Convenient but vulnerable to SIM swapping, SS7 interception, and malware that forwards SMS messages. NIST SP 800-63B classifies SMS OTP as a restricted authenticator and recommends app-based alternatives.

A social engineering attack where a criminal convinces a mobile carrier to transfer a victim's phone number to an attacker-controlled SIM card, intercepting all SMS messages and calls including OTP codes. Defeats SMS-based MFA.

The gradual accumulation of access rights beyond what a role or user actually needs, due to incomplete access reviews, manual provisioning errors, or role assignments that were never cleaned up after role changes.

An Active Directory group type used to assign permissions to resources. Members inherit the permissions assigned to the group. Security groups can be email-enabled but their primary purpose is access control, unlike distribution groups.

A unique identifier for a service instance in an Active Directory environment, used by Kerberos to associate a service with a logon account. Duplicate or misconfigured SPNs can break Kerberos authentication and are also targeted in Kerberoasting attacks.

IT systems, applications, and infrastructure used by employees without explicit organizational approval or oversight. Shadow IT creates unmanaged identities, ungoverned data access, and compliance gaps, often discovered through CASB or SSO adoption audits.

A type of fraud where a criminal creates a fictitious identity by combining real and fabricated information (real SSN + fake name). Unlike account takeover, there is no real victim — making it harder to detect. A growing threat in financial services.

Simple and Protected GSSAPI Negotiation Mechanism — a protocol used in Windows Integrated Authentication to negotiate between Kerberos and NTLM on HTTP. Enables browser-based SSO within a corporate network via the Negotiate HTTP authentication scheme.

An XML document issued by a SAML Identity Provider that contains authentication statements (the user authenticated at a specific time), attribute statements (user attributes), and authorization decision statements. Assertions are signed by the IdP and consumed by the Service Provider.

Secure Sockets Layer — the predecessor to TLS, now fully deprecated and insecure (SSLv2, SSLv3 have known critical vulnerabilities including POODLE and DROWN). The term is still colloquially used to refer to TLS certificates, but SSL itself should never be enabled.

Secure Hash Algorithm 256-bit — part of the SHA-2 family, producing a 256-bit (32-byte) fixed-length hash output. Widely used for digital signatures (certificates, JWT), file integrity verification, and password hashing (as part of PBKDF2). Considered cryptographically secure.

Secure/Multipurpose Internet Mail Extensions — a standard for public key encryption and signing of MIME data (email). Provides authentication, message integrity, non-repudiation, and encryption for email. Requires each participant to have an S/MIME certificate.

Secure Access Service Edge — a cloud architecture model (coined by Gartner) that converges network security (CASB, SWG, FWaaS, ZTNA) and WAN capabilities (SD-WAN) into a single, cloud-delivered service. Enables consistent security policy enforcement for distributed workforces.

A targeted phishing attack tailored to a specific individual or organization, using personalized information to appear credible. Much more effective than generic phishing. Requires OSINT research on the target. Used in APT initial access stages.

An attack that targets a trusted third-party component (software library, build pipeline, hardware component, managed service provider) to indirectly compromise the primary target. The SolarWinds, 3CX, and XZ Utils attacks are prominent examples.

The manipulation of people into performing actions or divulging confidential information through psychological deception rather than technical exploits. Phishing, vishing, baiting, and pretexting are common techniques. Security awareness training is the primary mitigation.

An injection attack where malicious SQL is inserted into input fields, manipulating database queries to bypass authentication, dump data, modify records, or execute OS commands. Mitigated by parameterized queries, ORMs, input validation, and least-privilege DB accounts.

Server-Side Request Forgery — a vulnerability where an attacker can make the server issue HTTP requests to internal resources, enabling access to cloud metadata services (AWS IMDS), internal APIs, and services behind firewalls. The 2019 Capital One breach exploited SSRF to reach the AWS IMDS.

Sarbanes-Oxley Act — US legislation requiring public companies to maintain accurate financial records with strong internal controls. Section 302 (CEO/CFO certification), Section 404 (management assessment of internal controls), and Section 409 require timely disclosure of material weaknesses.

AWS Organizations feature that sets permission guardrails (maximum available permissions) for accounts within an organizational unit. SCPs do not grant permissions — they restrict what can be granted. Useful for enforcing organization-wide security policies like preventing S3 public access.

The tools and processes for securely storing, accessing, distributing, and rotating non-human credentials such as API keys, database passwords, certificates, and encryption keys. Solutions: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk Conjur.

A user-facing application allowing employees to request access, reset passwords, update profile information, and manage MFA devices without IT helpdesk intervention. Reduces administrative burden and improves user experience. Must enforce approval workflows for sensitive resources.

In OAuth 2.0, a string that defines the boundaries of access an application is requesting. Scopes are space-separated (read write admin) and presented to the user in a consent screen. The authorization server may grant a subset of requested scopes.

A forged Kerberos service ticket (TGS) for a specific service, created using the service account's NTLM hash. Does not require KDC interaction, making it stealthier than a Golden Ticket. Grants access only to the specific service (e.g., a SQL server) rather than the entire domain.

A random value added to a password before hashing, ensuring that identical passwords produce different hashes in the database. Prevents rainbow table attacks and ensures each stored hash must be cracked individually rather than in bulk.

An X.509 certificate extension that specifies additional identities bound to the certificate — hostnames, IP addresses, email addresses, URIs. Modern browsers require SANs for domain validation; the Common Name (CN) field alone is no longer trusted for hostname validation.

A hardware-isolated execution environment within a processor that protects cryptographic keys and sensitive computations from the main OS. Apple's Secure Enclave protects Touch ID/Face ID biometric data and device keys. Intel SGX and AMD SEV provide similar server-side capabilities.

A security framework (Cloud Security Alliance) that makes network resources invisible to unauthorized users by requiring identity verification before the network location of resources is revealed. SDP is the precursor to ZTNA and implements a "dark cloud" approach to network access.

Security Information and Event Management — a platform that aggregates and correlates logs and events from across the environment to detect threats, support incident response, and provide compliance reporting. Modern SIEMs (Sentinel, Splunk, Chronicle) incorporate UEBA and SOAR capabilities.

Service Organization Control 2 — an auditing standard developed by the AICPA for service providers storing customer data in the cloud. SOC 2 reports assess controls against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Type II reports cover a period of time (typically 6-12 months).

A formal, high-level document that defines an organization's security objectives, principles, and expectations. Security policies are the foundation of a governance program; they are supported by more specific standards, guidelines, and procedures.

Programs that educate employees about cybersecurity threats, safe behaviors, and organizational security policies. Required by most compliance frameworks (PCI DSS, SOC 2, ISO 27001, HIPAA). Effective programs include phishing simulations, regular training modules, and metrics on click rates.

An identity representing a non-human principal (application, VM, container) in cloud IAM. In GCP, service accounts are first-class IAM principals; in AWS, EC2 instance profiles and Lambda execution roles serve the equivalent purpose. Service account keys should be avoided in favor of workload identity federation.

The practices and tooling for governing SSH key pairs used for server access — discovery of existing authorized keys, tracking key ownership, enforcing key rotation, and revoking keys for departed employees. Unmanaged SSH keys are a significant lateral movement risk.

Scenarios where SSO is circumvented, leaving gaps in identity governance — direct application logins via legacy auth protocols (basic auth, NTLM, form-based), shared credentials, or API keys that bypass the IdP. Closing bypass paths (enforcing SSO-only auth) is critical for security and UAR completeness.

Vulnerabilities in SAML implementations that allow authentication bypass — XML signature wrapping (XSW) attacks, comment injection, and parser confusion allow forging SAML assertions. Detected by XML signature validation covering the entire assertion, not just referenced elements.

System for Cross-domain Identity Management (RFC 7643/7644) — a standard REST API for automating user provisioning and deprovisioning between an IdP and SaaS applications. SCIM eliminates manual account creation; the IdP pushes create/update/delete events to the application's /Users and /Groups endpoints.

An XML document exchanged between a SAML IdP and SP to establish trust. Contains entity IDs, SSO/SLO endpoint URLs, certificate(s) for signature validation, and optional NameID format preferences. Consuming metadata files automates federation configuration and handles certificate rollover.

Security Orchestration, Automation, and Response — platforms that integrate security tools via APIs and automate repetitive investigation and response tasks using playbooks. Example: automatically locking a user account when a high-risk sign-in alert fires, enriching IoCs, and creating a ticket in ServiceNow.

Terminal Access Controller Access Control System Plus — a Cisco-proprietary AAA protocol similar to RADIUS but with full packet encryption and separate authentication, authorization, and accounting phases. Commonly used to control access to network devices (routers, switches).

A Windows privilege escalation technique where an attacker duplicates or steals an access token from a privileged process to execute code in the context of that identity. Requires SeImpersonatePrivilege. Juicy Potato and PrintSpoofer exploit this technique.

Time-based One-Time Password (RFC 6238) — an OTP algorithm that generates a short-lived numeric code using a shared secret and the current Unix time, truncated to 30-second windows. The basis of authenticator apps such as Google Authenticator and Microsoft Authenticator.

A device that has been registered and verified by an organization, exempting it from certain authentication steps (e.g., skipping MFA for recognized devices). Trust is typically based on device certificate, MDM enrollment, or a device fingerprint cookie.

An OAuth 2.0 extension (RFC 7662) allowing resource servers to query the authorization server to determine the active state, scope, and metadata of an access token. Enables opaque token validation without JWT signature verification.

An OAuth 2.0 mechanism (RFC 7009) for clients to notify the authorization server that a token is no longer needed, enabling the server to invalidate it. Supports logout and breach response scenarios.

A PAM pattern where a user's permissions are temporarily increased for a specific, time-bounded task (e.g., a change window) and automatically revoked when the time expires or the task is completed. Reduces standing privilege risk.

A proposed protocol (expired IETF draft) that cryptographically binds OAuth tokens to a TLS session using a key pair managed by the browser. Prevents token theft and replay even if tokens are intercepted. Not widely adopted; DPoP serves a similar purpose.

The successor to SSL, TLS is a cryptographic protocol providing authentication, confidentiality, and integrity for network communications. TLS 1.3 (RFC 8446) is the current standard, offering improved performance (0-RTT) and removing weak cipher suites. Required for all internet-facing services.

Replacing sensitive data (credit card numbers, SSNs) with non-sensitive surrogate values (tokens) that map to the original data in a secure vault. Tokens cannot be reversed without access to the vault. Distinct from encryption — tokens have no mathematical relationship to the original data.

A dynamic, computed risk score assigned to an access request based on signals such as device posture, user behavior, location, time, and resource sensitivity. Trust scores inform policy engines in Zero Trust architectures to grant, challenge, or deny access.

Stealing authentication tokens (session cookies, access tokens, Kerberos tickets) from a victim's device or network to impersonate them without credentials. Increasingly targeted in AiTM phishing campaigns that bypass MFA by stealing post-authentication session cookies.

Registering domain names with common misspellings of legitimate domains (gooogle.com, microsofft.com) to intercept users who mistype URLs. Used for phishing, malware distribution, and credential harvesting. Also applied to npm package names (dependency confusion).

A framework for identifying and managing risks introduced by vendors, suppliers, and partners who have access to organizational systems or data. Includes security questionnaires, contract clauses, continuous monitoring, and access reviews for vendor accounts.

An access control approach where IAM policies grant access to resources based on resource tags (e.g., Environment=Production, Team=Security). Enables dynamic, attribute-based authorization without explicit resource ARNs, but requires strict governance of tagging.

Access rights granted with an explicit expiration date, after which the access is automatically revoked without administrator intervention. Used for contractors, project teams, and temporary role elevations. Prevents access creep from assignments that were never cleaned up.

Indirect access gained by exploiting chains of trust — A has access to B, B has access to C, so A can reach C even without direct permissions. A key concept in AD attack path analysis (BloodHound) and cloud IAM policy auditing.

Terminal Access Controller Access-Control System Plus — a Cisco-proprietary AAA protocol for authenticating administrative access to network devices (routers, switches, firewalls). Encrypts the full packet body (unlike RADIUS which encrypts only the password). Separates authentication, authorization, and accounting.

An OAuth 2.0 extension (RFC 8693) that allows a client to exchange one token for another — for example, converting a SAML assertion into an OAuth access token, or exchanging an access token for an impersonation token to call a downstream service on behalf of the original user.

A secure cryptoprocessor chip embedded in devices that stores cryptographic keys, enables measured boot (TPM attestation), and performs crypto operations. Used in Windows BitLocker, device health attestation, and FIDO2 platform authenticators. TPM 2.0 is required by Windows 11.

Evidence-based knowledge about adversaries — their TTPs, infrastructure, campaigns, and indicators of compromise (IoCs). Threat intelligence is operationalized in SIEM detection rules, firewall blocklists, and incident response playbooks. STIX/TAXII are standards for sharing TI.

Tactics, Techniques, and Procedures — the behavior of an adversary. Tactics describe high-level goals (initial access, persistence); Techniques are the methods used; Procedures are the specific implementations. The MITRE ATT&CK framework catalogs TTPs across the attack lifecycle.

An authentication approach where the server issues a token (JWT, opaque token, session cookie) after verifying credentials, and subsequent requests present the token instead of credentials. Stateless JWTs embed claims; stateful tokens require server-side session lookup.

A periodic process where managers or system owners review and certify the access rights of users within their systems. Required by SOX, ISO 27001, and PCI DSS. UAR campaigns identify excessive, dormant, or unauthorized entitlements for remediation.

A login name for an Active Directory user formatted as an internet-style email address: username@domain.com. UPNs are used for authentication in modern Windows logon and ADFS. The UPN suffix can be customized and may differ from the email address.

A cloud-based identity store that consolidates user profiles from multiple sources, providing a single source of truth for identity attributes used across all connected applications. Okta Universal Directory is a prominent example.

An OIDC protected resource that returns claims about the authenticated user when called with a valid access token. Provides additional claims not included in the ID Token, such as address, phone_number, or custom attributes.

The second Zero Trust principle: limit user access with just-in-time and just-enough-access policies, risk-based adaptive polices, and data protection. Reduces the blast radius of a compromised identity.

User and Entity Behavior Analytics — security technology that uses machine learning to establish behavioral baselines for users and entities, then identifies anomalies (unusual login times, large data downloads, atypical access patterns) that may indicate insider threats or compromised accounts.

An OAuth 2.0-based protocol that allows a resource owner to control who can access their resources, including users from other organizations. The resource owner sets policies at the authorization server; requesting parties obtain access by meeting those policy conditions.

A dynamic, continuously computed score representing the likelihood that a user account or session is compromised, based on behavioral signals, threat intelligence, and peer comparison. Used by Identity Protection (Entra ID) and UEBA platforms to trigger remediation actions.

One of the three Zero Trust principles: always authenticate and authorize based on all available data points — identity, location, device health, service or workload, data classification, and anomalies. No implicit trust based on network location.

Voice phishing — a social engineering attack conducted over the phone where an attacker impersonates a trusted entity (IT helpdesk, bank, IRS) to trick the victim into revealing sensitive information or performing an action such as resetting MFA.

The continuous process of identifying, classifying, prioritizing, remediating, and verifying vulnerabilities in systems and applications. Involves asset inventory, regular scanning (Qualys, Tenable, Rapid7), CVSS scoring, SLA-based patching, and exception management.

A W3C standard for tamper-evident digital credentials (age verification, degree, employment status) that are cryptographically signed by an issuer and can be verified by any party without contacting the issuer. Used in decentralized identity ecosystems.

A Web Services federation protocol used in Microsoft environments for cross-domain SSO, particularly with ADFS. Enables identity federation between organizations. Being replaced by OIDC in modern deployments.

An identity assigned to a software workload (application, service, script, container) to authenticate and access resources. Workload Identity Federation allows external identities (GitHub Actions, Kubernetes pods) to access cloud resources without static credentials.

A WS-* web services specification for requesting and issuing security tokens. Used by ADFS and legacy enterprise federation scenarios to issue SAML tokens for WS-Federation SSO. Being replaced by OIDC in modern deployments.

An attack strategy where adversaries compromise a website frequently visited by the target audience (an industry forum, supplier portal) to deliver malware or credential harvesting pages to visitors — rather than attacking targets directly.

An X.509 certificate that covers a domain and all of its immediate subdomains using a wildcard in the CN or SAN (*.example.com covers api.example.com but not api.v2.example.com). Convenient but higher risk — a single private key compromise exposes all subdomains.

The identity assigned to a workload (container, function, VM) that enables it to authenticate to cloud services without embedded credentials. Implemented via Kubernetes Service Accounts + OIDC in GKE, Managed Identities in Azure, and instance profiles/roles in AWS.

The standard format for digital certificates (RFC 5280). An X.509 certificate contains the subject's public key, identity information, validity period, issuer, and a digital signature from the CA. Used in TLS/HTTPS, S/MIME email, and client authentication.

eXtensible Access Control Markup Language — an OASIS standard XML-based policy language and processing model for expressing and evaluating fine-grained access control policies. Defines Policy, PolicySet, Rule, Target, and Condition elements. Complex but powerful for ABAC implementations.

An ITU-T standard defining the format of public key certificates used in TLS, S/MIME, code signing, and PKI. An X.509 certificate binds a public key to a subject identity, signed by a Certificate Authority. Contains: subject, issuer, serial number, validity period, public key, extensions, and CA signature.

A security model based on the principle "never trust, always verify." ZTA eliminates implicit trust based on network location and instead continuously validates every access request using identity, device posture, and contextual signals. Defined by NIST SP 800-207.

A security posture where no identity holds persistent elevated privileges. Access is granted just-in-time for specific tasks and automatically revoked. Eliminates the risk of standing admin accounts being compromised and misused.

Zero Trust Network Access — a security model that grants access to specific applications on a per-session basis based on identity and device posture, replacing VPN-based network-level access. ZTNA provides application-level rather than network-level trust.

The application of Zero Trust principles to privileged access: verifying identity explicitly before elevation, granting just-in-time and just-enough privilege, recording all privileged sessions, and continuously assessing the risk of active privileged sessions.

A vulnerability unknown to the vendor or without an available patch. Zero-day exploits are extremely valuable to attackers and nation-state actors because defenders have no patch to deploy. The term refers to the fact that defenders have had "zero days" to prepare.