Glossary

PAM

Privileged Access Management: the discipline and tools for securing, controlling, and monitoring access to privileged accounts, the powerful admin and service accounts attackers prize, through vaulting, just-in-time access, and session control.

PAM Program Governance

The oversight structures that keep a privileged access management program effective, ownership, policies, scope, approval workflows, and review, so privileged access stays controlled and accountable over time rather than degrading.

PAM Program Metrics

Measures that show how well a privileged access management program is working, coverage of privileged accounts, use of just-in-time access, session recording, vaulted credentials, so the program's effectiveness is visible and improvable.

PAM SIEM Integration

Feeding privileged access management activity, session logs, credential checkouts, access grants, into the SIEM, so privileged-account use is monitored, correlated, and alerted on alongside other telemetry.

PAM Vault Architecture

The design of the secure vault at the heart of a PAM system, where privileged credentials are stored, encrypted, rotated, and access-controlled, so privileged secrets are protected and brokered rather than held by users.

PASTA Methodology

Process for Attack Simulation and Threat Analysis: a risk-centric, seven-stage threat-modeling methodology that ties technical threats to business impact, producing attacker-informed, prioritized findings.

PAT

Port Address Translation: a form of NAT that lets many devices share one public IP address by mapping each connection to a different port, common on networks and relevant to interpreting addresses in traffic.

PBAC

Policy-Based Access Control: an access model where access decisions are driven by centrally defined policies (often using attributes and context) rather than static role assignments, enabling fine-grained, dynamic authorization.

PBKDF2

Password-Based Key Derivation Function 2: a widely used function that derives a cryptographic key (or password hash) from a password by applying a hash many times with a salt, deliberately slow to resist brute-forcing.

PCI Audit Cycle

The recurring assessment cycle for PCI DSS compliance, annual validation (by self-assessment or external assessor) plus ongoing requirements, that organizations handling payment-card data must complete to stay compliant.

PCI DSS

The Payment Card Industry Data Security Standard: a mandatory set of security requirements for organizations that handle payment-card data, aimed at protecting cardholder information and reducing card fraud.

PCI DSS Cloud Architecture

Designing a cloud architecture that meets PCI DSS requirements for handling cardholder data, with the segmentation, encryption, access control, logging, and scope reduction needed to protect the cardholder data environment.

PCI DSS Requirements

The specific control requirements that make up PCI DSS, spanning network security, data protection, access control, monitoring, and testing, that organizations map to and implement to protect cardholder data.

PCI Merchant Levels

The tiers that classify organizations by payment-card transaction volume, determining how rigorously they must validate PCI DSS compliance, from self-assessment for smaller merchants to full external assessment for the largest.

PCI-DSS Cloud

Meeting PCI DSS in cloud environments, addressing how the standard applies when cardholder data is processed in the cloud, including shared responsibility, scope, and provider attestations within the cloud compliance landscape.

PEAK Hunting Framework

A structured threat-hunting framework (Prepare, Execute, Act with Knowledge) that organizes hunts into clear phases, emphasizing preparation, hypothesis-driven execution, and turning findings into lasting knowledge and detections.

PIM Implementation for Meridian

A capstone exercise implementing Privileged Identity Management for the fictional organization Meridian, designing how privileged roles are granted just-in-time, approved, and monitored as part of building its identity program.

PKCE

Proof Key for Code Exchange: an OAuth 2.0 extension that protects the authorization code flow from interception, especially for mobile and single-page apps, by binding the code to a secret only the legitimate client holds.

PKI

Public Key Infrastructure: the system of certificate authorities, certificates, and trust relationships that binds public keys to identities, enabling trusted use of public-key cryptography for TLS, signing, and authentication.

PMapper Analysis

Using the PMapper tool to analyze a cloud account's IAM and discover privilege-escalation paths, building a graph of identities, permissions, and connections to surface routes an attacker could chain to gain higher access.

PaaS

Platform as a Service: a cloud model where the provider manages the underlying infrastructure and platform (OS, runtime, scaling) and the customer focuses on their applications and data, sitting between IaaS and SaaS in shared responsibility.

Packet

The unit of data routed across networks at the network layer, carrying a payload plus addressing (IP) so it can travel from source to destination. Packets are fundamental units defenders inspect and analyze.

Parameterized Queries

A coding technique that separates SQL code from user-supplied data by using placeholders bound to values, so input cannot be interpreted as commands, the primary defense against SQL injection.

Parent Process

The process that created another process. Parent-child relationships are crucial context for defenders, since unusual parentage (like a document spawning a command shell) is a strong indicator of malicious activity.

Pass-the-Hash

An attack that authenticates using a stolen password hash directly, without cracking it to the plaintext password, letting an attacker move laterally using captured credential hashes on Windows networks.

Pass-the-Hash Detection

Detecting pass-the-hash attacks by spotting the abnormal authentication patterns they create, such as logons using hashes in ways or from places that legitimate authentication would not, mapped to ATT&CK techniques.

Pass-the-Ticket

An attack that reuses stolen Kerberos tickets to authenticate as a user without their password, letting an attacker access resources and move laterally in Active Directory using captured or forged tickets.

Passkey Adoption

The practice and challenges of rolling out passkeys to users in a consumer identity context, driving uptake of phishing-resistant passwordless credentials while supporting fallback and diverse devices.

Passkeys

Phishing-resistant, passwordless credentials based on FIDO/public-key cryptography that let users sign in with a device or biometric instead of a password, syncable across devices for a smooth, secure experience.

Password Hashing Function

A specialized, deliberately slow hash function (like bcrypt, scrypt, or Argon2) designed for storing passwords, so that even if the hash store is stolen, cracking the passwords is computationally expensive.

Password Reset

The flow that lets users regain access by setting a new password, a security-critical web feature, since weak reset flows are a common way attackers take over accounts by bypassing authentication.

Password Spraying

An attack that tries a few common passwords across many accounts to avoid lockouts.