Glossary - Apono

A

Attack Surface

An attack surface in permissions management refers to the sum total of all potential vulnerabilities that an unauthorized entity could exploit to gain access to a system or data.

Attribute-based Access Control (ABAC)

Attribute-based Access Control (ABAC) is a sophisticated and dynamic access control model that grants or denies user access to resources based on the evaluation of attributes. These attributes can pertain to the user, the resource, the environment, or even the action being requested. Attributes are essentially characteristics that define entiti…

Azure AD

Azure Active Directory (Azure AD) is a cloud-based service that offers identity and access management capabilities. With Azure AD, your employees can securely access various external resources, including Microsoft 365, the Azure portal, and numerous other Software-as-a-Service (SaaS) applications. Additionally, Azure Active Directory facilitat…

Access Management

Access management, also known as access control or identity and access management (IAM), refers to the processes, policies, and technologies implemented by organizations to control and regulate who can access their digital resources, systems, applications, and data.

Advanced Threat Protection

Advanced Threat Protection (ATP) refers to a set of security solutions and strategies designed to defend against sophisticated and evolving cyber threats that are capable of bypassing traditional security measures.

Access Control

Access control refers to the process of controlling and regulating who can access specific resources, data, systems, or functionalities within an organization’s digital environment. This management ensures that only authorized individuals or entities have the appropriate level of access, while unauthorized users are prevented from accessi…

Authentication versus Authorization

Understanding the distinction between authentication and authorization is fundamental to grasping the mechanisms that protect sensitive data and systems. While these terms are often used interchangeably, they refer to distinct processes in the security framework, each serving a specific purpose in safeguarding digital assets. Authentication is …

Access Management Workflows

Access management workflows are structured processes and procedures designed to manage and control access to resources, systems and data within an organization. These workflows are crucial for ensuring security, compliance, and efficiency. They help organizations grant and revoke access to employees, partners, customers and other stakeholders w…

Anomaly Detection

Anomaly detection in cybersecurity is a technique used to identify unusual or suspicious patterns of behavior within a computer system or network that may indicate the presence of security threats or incidents. The goal of anomaly detection is to identify deviations from normal, expected behavior, which could be a sign of malicious activity, sy…

AWS IAM Roles vs Policies

Navigating the complex landscape of Amazon Web Services (AWS) can be a daunting task, especially when it comes to understanding IAM Roles and Policies. Both components are crucial for ensuring robust security and streamlined access management, they serve distinct purposes and functions. While IAM Roles facilitate granular, temporary permissions…

Active Directory

Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is used to manage and store information about network resources and application-specific data from a centralized location. Here are some key features and components of Active Directory: Domain Services: AD DS (Active Directory Domai…

Authentication

Authentication in cybersecurity is a critical process that verifies the identity of users, devices, or systems attempting to access digital resources. This fundamental security measure acts as the first line of defense against unauthorized access, ensuring that only legitimate entities can interact with sensitive data and systems. In today&#821…

B

Blast Radius

In the context of DevOps, the term “blast radius” refers to the potential impact and extent of damage that a failure or error can have within a system or infrastructure. It refers to the scope of the consequences and how far they can propagate. The concept is closely related to the principle of fault isolation and system resilience….

Brute force Attack

What is a brute force attack? A brute-force attack is a type of cyberattack in which an attacker systematically attempts all possible combinations of passwords or encryption keys until the correct one is discovered. The goal of a brute-force attack is to gain unauthorized access to a system, application, or encrypted data by guessing the correc…

Break-glass Scenarios

Break-glass scenarios refer to emergency situations where access controls or security protocols need to be overridden to address a critical threat, maintain system integrity, or ensure business continuity. These scenarios are typically a last resort, used when normal security measures have failed or are unavailable. Break-glass procedures shoul…

Birthright Access

Birthright access in permissions management refers to a standardized set of access rights granted to users upon their onboarding within an organization. This concept is grounded in the principle that certain roles and responsibilities inherently require a specific baseline level of access to systems, applications, and data to perform their func…

Bastion Host

A bastion host, also known as a jump server, is a critical component in network security architecture designed to provide a secure entry point into a private network from an external, untrusted network such as the internet. This specialized server acts as a gateway or proxy, strategically positioned between the public-facing network and the pro…

C

California Consumer Privacy Act

California Consumer Privacy Act (CCPA) is a state-wide law regulating companies that use Californians’ data. CCPA law applies to any for-profit business which falls under one or all of the following categories: The entity collects data from 50,000 California residents, It has a gross annual revenue of $25 million, and The organization earns …

Centralized Authentication

Centralized Authentication refers to the system where user authentication is managed through a single, unified platform. Instead of maintaining separate login credentials for different systems, a centralized server (or authentication mechanism) controls access to all integrated applications or systems.

Cloud Access Policies

Cloud Access policies manage user devices and protect cloud data access. You can set access policies to block access to service uploads. For instance, configured policies can be set up to get a step-up authentication before downloading a file.

Context-Based Access Control

Context-based access control provides access decision and enforcement that is based on a dynamic risk assessment or confidence level of a transaction. Context-based access uses behavioral and contextual data analytics to calculate risk.

Connecting IdPs with Databases

Managing identities and permissions for your databases is made easier with native, custom identity provider connections because they leverage your existing identity provider to simplify authentication and managing permissions.

Connect Azure AD with Elasticsearch

Integrating Azure AD with Elasticsearch allows you to provide access in Elasticsearch’s databases and schemas according to users and groups from Azure AD.

Connect Azure AD with MariaDB

Integrating Azure AD with MariaDB allows you to provide access in MariaDB databases and schemas according to users and groups from Azure AD.

Connect Azure AD with Mongo Atlas

By connecting Azure AD with MongoDB Atlas, you can grant access to MariaDB databases and schemas based on users and groups from Azure AD. However, the challenge lies in integrating the authentication and authorization mechanisms of the Identity Provider (IDP) with the database. This often requires complex mapping of IDP groups to database roles…

Connect Azure AD with MongoDB

Having Azure AD connected with MariaDB allows you to provide access in MongoDB databases and schemas according to users and groups from Azure AD.

Connect Azure AD with MySQL

Connecting Azure AD with MySQL allows you to provision access in MySQL databases and schemas according to users and groups from Azure AD.

Connect Azure AD with PostgreSQL

Connecting Azure AD with PostgreSQL allows you to provide access in PostgreSQL databases and schemas according to users and groups from Azure AD.

Connect Google Workspace with Elasticsearch

Connecting Apono with Google Workspace enables organizations to manage permissions at a granular resource level, automating database access based on Google Workspace users and groups authentication. It facilitates the creation of on-call and break-glass automated access workflows by integrating with tools like PagerDuty, Opsgenie, or VictorOps,…

Connect Google Workspace with MariaDB

Connecting Apono with MariaDB allows organizations to streamline and automate their database access management. By integrating with MariaDB, Apono enables granular control of user permissions, ensuring that only authorized personnel can access specific databases or tables.

Connect Google Workspace with Mongo Atlas

Connecting Google Workspace with MongoDB Atlas allows organizations to streamline and enhance their database access management by leveraging Google Workspace’s user and group authentication.

Connect Google Workspace with MongoDB

Connecting Google Workspace with MongoDB allows organizations to streamline access management and improve security across their databases. By integrating MongoDB with Google Workspace, administrators can manage user authentication and permissions more efficiently, synchronizing MongoDB access controls with Google Workspace’s user and grou…

Connect Google Workspace with MySQL

Integrating Google Workspace with MySQL allows you the ability to provide access in MySQL’s databases and schemas according to users and groups from Google Workspace.

Connect Google Workspace with PostgreSQL

Integrating Google Workspace with PostgreSQL allows you the ability to provide access in PostgreSQL’s databases and schemas according to users and groups from Okta.

Connect Jumpcloud with Elasticsearch

Integrating Jumpcloud with Elasticsearch allows you the ability to provide access in Elasticsearch’s databases and schemas according to users and groups from Jumpcloud.

Connect Jumpcloud with MariaDB

Integrating Jumpcloud with MariaDB allows you the ability to provide access in MariaDB’s databases and schemas according to users and groups from Jumpcloud.

Connect Jumpcloud with Mongo Atlas

Integrating Jumpcloud with Mongo Atlas allows you the ability to provide access in Mongo Atlas’ databases and schemas according to users and groups from Jumpcloud.

Connect Jumpcloud with MongoDB

Integrating Jumpcloud with MongoDB allows you the ability to provide access in MongoDB’s databases and schemas according to users and groups from Jumpcloud.

Connect Jumpcloud with MySQL

Integrating Jumpcloud with MySQL allows you the ability to provide access in MySQL’s databases and schemas according to users and groups from Jumpcloud.

Connect Jumpcloud with PostgreSQL

Integrating Jumpcloud with PostgreSQL allows you the ability to provide access in PostgreSQL’s databases and schemas according to users and groups from Jumpcloud.

Connect Okta with Elasticsearch

Integrating Okta with Elasticsearch allows you the ability to provide access in Elasticsearch’s databases and schemas according to users and groups from Okta.

Connect Okta with MariaDB

Integrating Okta with MariaDB allows you the ability to provide access in MariaDB’s databases and schemas according to users and groups from Okta.

Connect Okta with MongoDB

Integrating Okta with MongoDB allows you the ability to provide access in MongoDB’s databases and schemas according to users and groups from Okta.

Connect Okta with MySQL

Integrating Okta with MySQL allows you the ability to provide access in MySQL’s databases and schemas according to users and groups from Okta.

Connect Okta with PostgreSQL

Integrating Okta withPostgreSQL allows you the ability to provide access in PostgreSQL’s databases and schemas according to users and groups from Okta.

Connect Okta with Mongo Atlas

Integrating Okta with Mongo Atlas allows you the ability to provide access in Mongo Atlas’ databases and schemas according to users and groups from Okta.

Connect Onelogin with MySQL

Integrating Onelogin with MySQL allows you the ability to provide access in MySQL’s databases and schemas according to users and groups from Onelogin.

Connect Onelogin with PostgreSQL

Integrating Onelogin with PostgreSQL allows you to provide access in PostgreSQL’s databases and schemas according to users and groups from Onelogin.

Connect Onelogin with Elasticsearch

Integrating Onelogin with Elasticsearch allows you the ability to provide access in Elasticsearch’s databases and schemas according to users and groups from Onelogin.

Connect Onelogin with MariaDB

Integrating Onelogin with MariaDB allows you the ability to provide access in MariaDB’s databases and schemas according to users and groups from Onelogin.

Connect Onelogin with Mongo Atlas

Integrating Onelogin with Mongo Atlas allows you the ability to provide access in Mongo Atlas’s databases and schemas according to users and groups from Onelogin.

Connect Onelogin with MongoDB

Integrating Onelogin with MongoDB allows you the ability to provide access in MongoDB databases and schemas according to users and groups from Onelogin.

Cloud-native Application Protection Platform

A Cloud-native Application Protection Platform (CNAPP) is a specialized cybersecurity solution designed to secure and protect applications that are developed and deployed in cloud-native environments.

Cloud Security Posture Management (CSPM)

Cloud Security Posture Management (CSPM) is a set of practices, tools, and processes aimed at ensuring the security of cloud computing environments by assessing and maintaining a strong security posture. A security posture refers to the overall security status or condition of an organization’s IT infrastructure, applications, and data. In…

Cloud Workload Protection (CWP)

What is Cloud Workload Protection (CWP)? Cloud Workload Protection (CWP) is a set of cybersecurity practices, tools, and technologies designed to secure the workloads (applications, services, and processes) running in cloud environments. The term “workload” refers to the individual components of software applications or services, su…

Cloud Security

The cloud offers scalability, flexibility, and efficiency. Because of these benefits, nearly 94% of enterprises now rely on cloud services to run their servers, host applications and to store critical data. But the cloud also introduces significant security risks. In fact, data breaches remain one of the most significant risks in the cloud. As …

Cloud PAM

Cloud Privileged Access Management (CPAM) is the practice of managing and securing privileged access to cloud resources and services. Privileged access refers to the permissions and credentials that grant users or applications elevated levels of control and access within a cloud environment. These privileges could allow users to manage critical…

Cloud Access Security Broker (CASB)

A Cloud Access Security Broker (CASB) is a security solution or service that acts as an intermediary between an organization’s on-premises infrastructure and cloud services, helping to secure and manage data and applications that are hosted in the cloud.

CI/CD Pipeline

CI/CD stands for Continuous Integration and Continuous Delivery (or Continuous Deployment), and it represents a set of practices and tools used in software development to automate the process of building, testing, and deploying software changes to production environments.

Credential Stuffing

Credential stuffing is a cyberattack method in which an attacker uses previously stolen usernames and passwords to gain unauthorized access to user accounts on various online platforms or websites. It relies on the fact that many people reuse the same usernames and passwords across multiple online services. Here’s how credential stuffing …

Continuous Adaptive Risk Trust Assessment (CARTA)

Continuous Adaptive Risk Trust Assessment is a security framework and strategy developed by Gartner. CARTA represents a modern approach to cybersecurity that adapts to the evolving threat landscape and the changing needs of organizations. It emphasizes a dynamic, risk-based approach to security rather than a traditional, static, and perimeter-f…

Credentials Rotation

Credentials rotation, also known as credential rotation or password rotation, is a cybersecurity practice that involves regularly changing and updating access credentials such as passwords, API keys, and other authentication tokens. The primary goal of credentials rotation is to enhance the security of systems and applications by minimizing the…

Cloud Infrastructure Entitlement Management (CIEM)

Cloud Infrastructure Entitlement Management (CIEM) is a set of practices, tools, and solutions designed to help organizations manage and control access permissions and entitlements within their cloud computing environments. It’s a critical aspect of cloud security and governance, particularly in multi-cloud and hybrid cloud setups, where …

Cloud Access Management

Cloud Access Management (CAM) is a crucial facet of modern IT infrastructure that ensures secure and efficient access control to cloud resources. As organizations increasingly migrate their operations to cloud environments, safeguarding sensitive data and managing user access becomes paramount. CAM encompasses a set of practices, policies, and …

Cloud Privileged Access Management

Cloud Privileged Access Management (CPAM) represents a critical component within the broader landscape of cloud security and identity management. It is a specialized approach focused on controlling, monitoring, and securing access to critical resources and infrastructure within cloud environments. CPAM is designed to address the unique challeng…

Credential Theft

Credential theft is a critical security threat that targets the unauthorized acquisition of someone’s personal or corporate login information. This encompasses a range of sensitive data, including usernames, passwords, banking details, and access keys to various online services and platforms. The primary aim behind this nefarious activity…

Context-Based Access Management

Context-Based Access Management (CBAM) is an advanced security framework that tailors access control policies based on the contextual information surrounding user requests. Unlike traditional access management systems that rely solely on static attributes such as roles or user IDs, CBAM integrates dynamic contextual factors to make more granula…

Cloud Access Management

In today’s rapidly evolving digital landscape, where data is the lifeblood of organizations, cloud access management has emerged as a crucial cornerstone of cybersecurity. As an IT professional or cloud security specialist, you’re likely aware of the challenges posed by the increasing adoption of cloud services. But have you truly g…

Cloud Governance

As organizations increasingly migrate their operations to the cloud, cloud governance has become a critical aspect of managing digital infrastructure. Cloud governance encompasses the policies, procedures, and controls necessary to ensure secure and efficient use of cloud resources. It plays a crucial role in data management, access controls, a…

D

DevOps vs DevSecOps

DevOps and DevSecOps are both approaches to software development and deployment that aim to improve collaboration, automation, and efficiency within an organization. However, they have different primary focuses and goals, with DevSecOps emphasizing security as an integral part of the development and operations processes. Here are they key diffe…

Data Access Management

Data Access Management (DAM) is a critical component of an organization’s overall data governance strategy, designed to control and regulate who can access specific data within an organization and under what circumstances. It encompasses a broad range of activities and technologies that together ensure only authorized users can interact w…

DevSecOps

DevSecOps, short for Development, Security, and Operations, represents a paradigm shift in the software development lifecycle. This innovative approach seamlessly integrates security practices into the agile DevOps framework, ensuring that security is no longer an afterthought but a fundamental aspect of the entire development process. For IT p…

E

Ephemeral Certificates/Ephemeral Access

Ephemeral certificates are short-lived access credentials that are valid for as long as they are required to authenticate and authorize privileged connections

F

Federated Access

Any system that acts as a standalone identity gateway is known as federated access. Google, by far, is one of the notable examples of federated identity access. With Federated identity management (FIM), users don’t need new credentials to access applications that have federated agreements with Google, for instance, YouTube, Upwork, and nu…

Fedramp Compliance

FedRAMP, which stands for the Federal Risk and Authorization Management Program, is a U.S. government-wide program that standardizes the approach to security assessment, authorization, and continuous monitoring for cloud products and services. This initiative aims to ensure that cloud services used by federal agencies meet rigorous security sta…

G

General Data Protection Regulation (GDPR)

The General Data Protection Regulation is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. The GDPR is an important component of EU privacy law and of human rights law, in particular Article 8 of the Charter of Fundamental Rights of the European Union.

Google Workspace

Google Workspace is a collection of cloud computing, productivity and collaboration tools, software and products developed and marketed by Google.

Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, is a landmark piece of legislation in the United States that significantly altered the regulatory landscape for financial institutions. The Act was enacted to remove barriers in the market among banking companies, securities companies, and insuran…

Group Based Access Control (GBAC)

Group Based Access Control (GBAC) is an advanced mechanism for managing and enforcing access policies within various types of organizations and systems. It operates on the fundamental principle of assigning permissions and rights not to individual users, but to groups, which individual users become members of. This approach offers a streamlined…

H

Honeypot

In the ever-evolving landscape of cybersecurity, “honeypots” have emerged as a crucial tool for IT professionals seeking to enhance their network security strategies. A honeypot is a deliberately vulnerable system or network component designed to attract and trap potential attackers, serving as both a decoy and an early warning syst…

HIPAA compliance

HIPAA compliance is a critical aspect of modern healthcare operations in the United States. The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, sets the standard for protecting sensitive patient data. It requires healthcare providers, health plans, healthcare clearinghouses, and their business associates to impleme…

I

Identity and Access Management (IAM)

Identity and access management (IAM) ensures that only relevant people with certain organizational roles can access tools that they require to complete their jobs. IAM allows organizations to control employee apps without logging into them as an administrator.

IGA (Identity Governance Administration)

Identity Governance Administration (IGA) is a critical aspect of cybersecurity and information technology management that focuses on managing digital identities and their access within an organization. It encompasses a comprehensive suite of processes and technologies designed to ensure that the right individuals have the appropriate access to …

Identity Governance

What is identity governance and administration (IGA)? Identity governance and administration (IGA), often known as identity security, is a collection of policies that enable businesses to reduce cyber risk and adhere to legal requirements to safeguard sensitive data. By ensuring that the authorized workers only access data when necessary, these…

Identity Provider (IDP)

Identity providers, often abbreviated as IdPs, play a pivotal role in the digital ecosystem by managing and authenticating user identities. These entities are responsible for the creation, maintenance, and management of identity information while providing authentication services to applications and services. By centralizing user identities, id…

Identity-as-a-Service (IDaaS)

What is Identity-as-a-Service? Identity-as-a-Service (IDaaS) is a cloud-based service that provides organizations with a comprehensive and centralized solution for managing user identities and access to various applications, systems, and resources. It’s a subset of the larger Identity and Access Management (IAM) field, which focuses on en…

Identity Governance Administration

Identity Governance and Administration (IGA) is a comprehensive framework and set of technologies used by organizations to manage and govern digital identities, access rights, and permissions for their users. The primary goal of IGA is to ensure that users within an organization have appropriate and secure access to the resources they need, whi…

IT Security Policy

An IT Security Policy is a formal document that outlines guidelines, rules, and procedures related to the protection of an organization’s information technology (IT) assets and data. It serves as a comprehensive framework for managing security risks and ensuring the confidentiality, integrity, and availability of information within an org…

Incident Response

also known as IR, Incident Response is a structured approach to addressing and managing the aftermath of a cybersecurity breach or attack. It involves a series of activities and processes designed to detect, contain, eradicate, and recover from security incidents effectively. The primary goal of incident response is to minimize damage, reduce r…

Insider Threats

An insider threat in Privileged Access Management (PAM) refers to risks posed by individuals within an organization who have legitimate access to critical systems and sensitive data. These individuals typically include employees, contractors, or business partners who possess elevated permissions, allowing them to access, modify, or manage cruci…

Identity Sprawl

Identity sprawl refers to the proliferation and dispersion of digital identities across various platforms, applications, and services. In today’s interconnected world, individuals and organizations often manage multiple user accounts, each with its own set of credentials, security measures, and access permissions. This fragmentation can l…

Identity Threat Detection and Response (ITDR)

In today’s interconnected digital landscape, our identities have become our most valuable assets. But with great value comes great risk. Enter identity threat detection and response (ITDR) – a cutting-edge cybersecurity approach that’s revolutionizing how we protect our digital selves. What is Identity Threat Detection and Respons…

J

Just-in-Time Access (JiT)

Just-in-Time Access (JIT) is a vital security protocol where permission to access applications or systems is only for a preset limited timeframe on an as-needed basis. This prevents the risks associated with standing privileges that hackers or fraudulent insiders can exploit.

Jumpcloud

JumpCloud is reimagining the on-prem directory as a cloud-based platform that secures identities, manages devices, and provides safe access to all types of IT resources — on-prem, in the cloud, across Windows, Mac, or Linux.

L

Lateral Movement

Lateral movement in cybersecurity refers to the technique used by attackers or malicious actors to move horizontally across a network once they have gained initial access to a single system.

Log Analysis Management

Log analysis management, also known as log management or log analysis, is the process of collecting, storing, analyzing, and managing log data generated by computer systems, networks, and applications. Logs are records of events, activities, and system status that are automatically generated by various software and hardware components. These lo…

Least Privilege Principle

The Least Privilege Principle is a fundamental concept in the realm of cybersecurity, information security, and IT management. It denotes a minimalistic approach towards access rights and permissions, ensuring that users, systems, and programs have only the essential privileges necessary to perform their tasks or functions, and nothing more. Th…

Lightweight Directory Access Protocol (LDAP)

Have you ever wondered how large organizations manage thousands of user accounts seamlessly? Enter Lightweight Directory Access Protocol (LDAP), the unsung hero of directory services in the digital world. 🌐 LDAP is like a high-tech phonebook for your network, but instead of just storing names and numbers, it’s a powerhouse of informati…

M

Multi-Factor Authentication (MFA)

Multi-factor Authentication (MFA) is an authorization method that requires a user to provide one or more verification details to gain access to a resource such as an online account, application, or VPN.

Man-in-the-Middle Attack

A Man-in-the-Middle (MitM) attack is a type of cyberattack where an attacker secretly intercepts and possibly alters communication between two parties without their knowledge. In this attack, the attacker positions themselves between the two communicating parties, making it appear as though they are communicating directly with each other, while…

Multi-cloud Security

Multi-cloud security refers to the strategic implementation of security measures across multiple cloud service providers to protect data, applications, and infrastructure from various threats. As organizations increasingly adopt multi-cloud environments to leverage the unique benefits and capabilities of different cloud platforms, the complexit…

O

Observability

Observability is a management procedure that focuses on keeping the relevant, crucial, and vital issues at or near the top of an operations process flow. This post will discuss the details of the observability.

Okta

Okta is an enterprise-grade, identity management service, built for the cloud, but compatible with many on-premises applications. With Okta, IT can manage any employee’s access to any application or device.

Onelogin

OneLogin is a cloud-based identity and access management provider that develops a unified access management platform to enterprise-level businesses and organizations.

Open Authorization (OAuth)

OAuth, which stands for “Open Authorization,” is an open standard and protocol for granting secure access to resources on the internet. It provides a framework for allowing applications to access resources on behalf of a user without sharing the user’s credentials or passwords. OAuth is commonly used for enabling third…

On-call Access Management

On-call access management is a process or system that allows organizations to control and regulate access to their systems, data, and infrastructure on an as-needed basis. It typically involves providing certain employees or third-party service providers with temporary or conditional access rights to specific resources during designated on-call…

P

Principle of Least Privilege

In information security, the principle of least privilege (PoLP), AKA the principle of minimal privilege (PoMP) or the principle of least authority (PoLA), requires that in users in the organization should only be granted resources according to the immediate requirement of the task at hand.

Privileged Access Management (PAM)

Privileged Access Management (PAM) is an information security (infosec) process that uses special access or capabilities (beyond the scope of regular users) to protect identities. Like any infosec solution, PAM works across a combination of people, systems, and technology.

Privilege Elevation and Delegation Management (PEDM)

Privilege Elevation and Delegation Management (PEDM) is a subset of Privileged Access Management (PAM) that aims to deliver more granular access restrictions than Privileged Account and Session Management (PASM) tools ordinarily do.

Privileged Account and Session Management (PASM)

Privileged account and session management (PASM) gives users an “all-or-nothing” temporary administrative access to privileged business environments. An organization’s risk management and cybersecurity plan should include PASM solutions to manage, control, and monitor privileged accounts.

Permissions Management

What is Permissions Management? Permissions management, also known as access control or authorization, is the process of controlling and regulating the access and actions that users or entities have within a system, application, network, or digital environment. It involves defining and enforcing rules and restrictions that determine who can acc…

Phishing

Phishing is a type of cyberattack in which attackers attempt to deceive individuals into revealing sensitive information, such as login credentials, personal information, or financial details, by impersonating a trustworthy entity. Phishing attacks typically involve fraudulent emails, messages, or websites that appear legitimate but are actuall…

Privileged Session Management

Privileged session management, also known as privileged session recording or privileged access session management, is a cybersecurity practice that involves monitoring and recording the activities of users who have privileged access to critical systems, applications, and data within an organization’s IT environment.

Policy-Based Access Control

Policy-based access control (PBAC) is a security mechanism used in computer systems and networks to regulate and manage access to resources based on predefined policies or rules. It’s a way of ensuring that only authorized users or entities are allowed to access specific resources, while unauthorized access is prevented.

Policy-as-Code

Policy-as-code (PaC) is an approach in the field of DevOps and cloud computing that involves defining and enforcing policies through code. These policies are rules, guidelines, or best practices that organizations want to implement to ensure the security, compliance, and efficient operation of their systems, applications, and infrastructure.

Privileged Access Governance (PAG)

Privileged Access Governance (PAG) is a comprehensive framework and set of practices that organizations use to manage, control, and monitor access to privileged accounts and resources within their IT infrastructure.

Permission Control

Permission control is the process of defining and regulating the specific actions or operations that individuals or entities are allowed to perform within a system, application, network, or physical space. It is a fundamental aspect of access control, which is essential for maintaining security, privacy, and compliance in various environments, …

PAM vs IAM

Identity and access management (IAM) and privileged access management (PAM) are two related but distinct concepts that organizations use to manage their security policies and user access rights. IAM focuses on controlling access to a broader range of resources, such as applications, data, and services, for all types of users within an organiza…

Privileged Access Management as a Service (PAMaaS)

Privileged Access Management as a Service (PAMaaS) is a cloud-based service that provides organizations with a comprehensive solution for managing and securing privileged accounts and access to critical systems and data. Privileged accounts are typically associated with administrators, IT staff, and other individuals who have elevated access pr…

Password Vaulting

Password vaulting, also known as password management or password storage, is a security practice that involves securely storing and managing passwords and other sensitive authentication credentials. The primary purpose of password vaulting is to enhance security by providing a centralized and secure repository for storing passwords,…

Privileged Identity Management (PIM)

Privileged Identity Management (PIM) is a security solution and a set of practices designed to manage and control access to privileged accounts within an organization’s IT environment. Privileged accounts are those that have elevated access rights and permissions, often with the ability to make significant changes to the IT infrastructure…

Privilege Creep

Privilege creep, in the context of access management or identity and access management (IAM), refers to the gradual accumulation of access rights or permissions beyond what an individual or system actually needs to perform their job responsibilities. This phenomenon can occur over time as individuals change roles within an organization, or as n…

Password Spraying

Password spraying is a type of cyberattack where an attacker attempts to gain unauthorized access to a large number of user accounts by systematically trying a few commonly used passwords. Unlike traditional brute-force attacks that target a single account with numerous password attempts, password spraying targets many accounts with a limited s…

PCI Compliance

Payment Card Industry (PCI) Compliance is a critical aspect of modern IT infrastructure that cannot be overlooked by professionals in the field. This set of security standards, designed to ensure that all companies processing, storing, or transmitting credit card information maintain a secure environment, has become increasingly vital in our di…

R

Role-based Access Control (RBAC)

One of the primary methods of advanced access control is Role-based access control (RBAC) – a system that restricts network access solely based on a person’s role within the organization. The roles refer to individual access to a network.

Resource-based Policies

Resource-based policies are a type of authorization mechanism used in computer security to define and manage access control for specific resources, such as files, databases, APIs, and cloud services.

Relationship-Based Access Control (ReBAC)

Relationship-based access control (ReBAC) represents a paradigm shift in how organizations manage and secure digital resources. Unlike traditional role-based or attribute-based models, ReBAC leverages the complex web of relationships between users, objects, and contexts to make nuanced access decisions. At its core, this approach recognizes tha…

S

Service Organization Control 2 (SOC2)

Information security threats remain a significant concern for all organizations, including those which outsource essential business operations to third-party service providers such as SaaS or cloud-computing vendors. But why is that? Well, it’s due to mishandling sensitive data, which ultimately makes enterprises vulnerable to cybercrimes…

Single Sign-On (SSO)

Single Sign-On (SSO) is an authentication method that enables a user to log in with a single identity to any of several related, yet independent, applications and databases. Or in other words: log in once and access services without answering authentication challenges.

Service Accounts

Operating systems frequently utilize service accounts to execute applications or run programs. They are used either in the context of system accounts or a specialized user account, which is created manually or during software installation. Furthermore, they may also run programs and are frequently referred to as init or inetd on Unix and Linux….

Standing Privileges

Standing privileges grant users unrestricted access to resources without the need for authorization, regardless of their location or time. In some cases, these privileges may not even require users to authenticate their identity before granting access to a system. Although this convenience benefits users, standing privileges pose a significant …

Secrets Management

Secrets management refers to the practice of securely storing, managing, and controlling access to sensitive information, often referred to as “secrets,” within an organization’s IT infrastructure.

Shadow Access

Shadow access is unauthorized and often unnoticed access to computer systems, networks, or data. It is a concept commonly associated with cybersecurity and information technology. Shadow access can take several forms, including: Unauthorized User Access: When an individual gains access to a system or network without proper authenticati…

System for Cross-domain Identity Management (SCIM)

System for Cross-domain Identity Management (SCIM) is an open standard protocol that is designed to simplify the management of user identities across different systems and domains. SCIM is particularly useful in the context of identity and access management, where organizations need to manage user accounts, roles, and other identity-related inf…

Security Assertion Markup Language (SAML)

Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider (IdP) and a service provider (SP). SAML is primarily used for single sign-on (SSO) and web-based authentication in a secure and standardized way. Here’s h…

Security Information and Event Management (SIEM)

Security Information and Event Management (SIEM) represents a comprehensive approach to security management that combines two critical aspects: Security Information Management (SIM) and Security Event Management (SEM). This integrated approach provides an overarching view of an organization’s information security, delivering real-time ana…

Spear Phishing

Spear phishing represents a highly targeted and sophisticated form of phishing attack, wherein cybercriminals aim to deceive specific individuals or organizations. Unlike generic phishing attempts that scatter a wide net seeking any victim, spear phishing meticulously researches and customizes the fraudulent communication to increase the probab…

SAML

Security Assertion Markup Language (SAML) is a critical open standard for exchanging authentication and authorization data between parties, particularly in the realm of web-based single sign-on (SSO). This XML-based framework enables secure communication between identity providers (IdPs) and service providers (SPs), streamlining user access acr…

T

Task-Based Access Control (TBAC)

Task-based access control (TBAC) is a flexible security system deployed in workflow management processes on a large scale. In TBAC, permissions are granted to tasks, and users can only access the permissions during the task’s execution.

Trunk-based Development

Trunk-based development is a software development approach where all developers work on a single branch (often called the “trunk” or “mainline”) of a version control system, such as Git. In trunk-based development, developers commit their changes directly to this mainline branch without creating long-lived featur…

U

User Provisioning

User provisioning, also known as identity provisioning or account provisioning, is the process of creating, managing, and maintaining user accounts and their associated access rights within an organization’s information technology (IT) systems and digital resources.

V

Vendor Privileged Access Management (VPAM)

Vendor Privileged Access Management (VPAM) is a specialized tool designed to ensure least privilege access for vendor employees, while simultaneously monitoring their activities.

Vulnerability Management

Vulnerability management in cybersecurity is a comprehensive process aimed at identifying, assessing, prioritizing, mitigating, and monitoring vulnerabilities in computer systems, networks, applications, and other IT infrastructure components.

Z

Zero Trust Network Access

Zero Trust is a tactical approach to securing an organization from cybersecurity threats through elimination of implicit trust and continuous validation at each stage of digital interaction.

Zombie Accounts

Zombie accounts, also known as dormant accounts or orphaned accounts, refer to user accounts that are still present in a system or application but are no longer actively used or managed.