identity acsc-glossary
Authentication
Prove who is knocking. Users, services, and devices all count. A username is a claim, not a proof.
Knowledge
AllIRacsc-glossaryau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkpractitionerprivacythreat-intelvulnerability
38 entries
identity acsc-glossary
Authorisation
What the proven identity is allowed to do. Authn is who. Authz is how far.
network hardening identity
Bastion host
Jump host. The one box allowed to administer the rest. Harden it like it holds the keys.
identity acsc-glossary
Brute force
Try all the guesses until one works. Rate limits, MFA, and long secrets make this expensive. Shame is free.
identity IR acsc-glossary
Business email compromise
Email fraud aimed at an organisation's money or data. Invoice redirection is the local dialect.
identity acsc-glossary
Credential stuffing
Reuse leaked username/password pairs on other sites. Your 'unique' login was the same as the breach last year.
identity hardening acsc-glossary
DMARC, DKIM, and SPF
Three DNS records. Receivers use them together so your domain is harder to wear.
identity hardening acsc-glossary
Default passwords
The password the vendor shipped. Fine for unboxing. Malpractice if it is still there at go-live.
identity acsc-glossary
Dictionary attack
Guessing with a list of likely passwords instead of every possible string. 'Password1' is in the book. Yours should not be.
identity acsc-glossary
Identity and access management
Join, move, leave. Who you are, how you prove it, what you may do, and how that ends when the job does.
identity acsc-glossary
Identity theft
Someone uses your personal details to commit fraud. The cleanup outlasts the incident ticket.
identity IR acsc-glossary
Insider threat
Harm from someone who already had the keys — malice, negligence, or a very bad accident. The badge was valid.
malware identity acsc-glossary
Keylogger
Software (or hardware) that records typing. Credentials and payments are the usual prize. This desk does not document how to build one.
detection IR identity
Lateral movement
After the first box, they walk. Credentials, remote admin, and trust you already granted.
identity hardening acsc-glossary
Least privilege
Only the access required, only for as long as required. Standing admin is standing blast radius.
identity detection
MFA fatigue
Bombard the user's phone with push prompts until they tap Allow. MFA still on. Judgement off.
identity acsc-glossary
Multi-factor authentication
Two or more different factor types: know, have, or are. SMS counts. So does intercepting it. Aim for phishing-resistant.
crypto network identity hardening
Mutual TLS (mTLS)
TLS where both sides present a certificate. The server is not the only one who has to prove who they are.
identity hardening acsc-glossary
Need-to-know
Access only to the data the role actually requires. Broad file shares are a rumour mill with NTFS.
identity
OpenID Connect
OIDC. Identity layer on OAuth 2.0. ID tokens for who the user is. Access tokens for APIs.
identity acsc-glossary
Passphrase
A string of words used as a secret. Longer beats clever. Unique beats reused.
identity acsc-glossary
Password
A character string used as a secret. Reuse is how one breach becomes twelve logins.
identity acsc-glossary hardening
Password manager
Generates unique secrets and stores them in a vault. One strong unlock. Not a spreadsheet called passwords_final.
identity acsc-glossary
Password spraying
A few common passwords, a lot of accounts. Misses lockout, hits whoever used SeasonYear!.
identity acsc-glossary
Pharming
Traffic sent to a fake site by tampering, not by a clicked lure. The URL bar can still lie if DNS or the host file does.
identity concepts acsc-glossary
Phishing
A bulk lure: fake message, urgency, a credential or a hostile file. Training helps. Phishing-resistant MFA and mail authentication help more.
identity hardening
Privileged access management
PAM the program: vault the admin passwords, broker the sessions, record them. Not the same as Linux PAM, the Unix login modules. People say both.
identity hardening acsc-glossary
Privileged user
Someone who can change or sidestep security controls. Developers who can bypass a guardrail count.
network identity acsc-glossary
Remote access
Coming in from outside the organisation's network, usually through a gateway. Treat it as privileged even when the user is not.
identity
SAML
Security Assertion Markup Language. XML assertions from an identity provider so a service can skip local passwords.
identity acsc-glossary
Smishing (SMS scam)
Phishing that arrives as a text. Postage, ATO, missed-parcel energy. The link is the problem.
identity concepts acsc-glossary
Social engineering
Manipulate a person, skip the software flaw. Phishing, vishing, BEC, and the helpdesk reset are all this family.
identity acsc-glossary
Spear phishing
Phishing with a name on it. Aimed at a person or a small group, usually with enough context to look like Tuesday.
identity network acsc-glossary
Spoofing
A message or identity dressed as a trusted source. Email, SMS, caller ID, and websites all do this cheaply.
identity acsc-glossary
Two-factor authentication (2FA)
MFA with exactly two proofs. Better than a password. Still not the ceiling.
identity acsc-glossary
Vishing
Social engineering on a phone call. They are not Microsoft, the ATO, or your bank's fraud team.
identity acsc-glossary
Whaling
Spear phishing aimed at senior executives. The invoice looks like their job. The bank details do not.
network identity concepts
Zero trust
Never trust, always verify. A VPN badge is not a day pass. Identity, device, path, and data each get asked again.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary