Terminology Index

Glossary

2953 terms

IAM Program Assessment

Evaluating an entire identity and access management program, its capabilities, controls, maturity, and risks, to judge how well it is working and where it needs improvement, as a capstone view of an identity program.

IAM Program Design

Designing the overall identity and access management program, its capabilities, processes, controls, roadmap, and governance, so identity is managed coherently across the organization rather than as disconnected tools and tasks.

IAM Program Governance

The oversight structures that keep an identity program aligned, accountable, and effective, ownership, policies, access reviews, metrics, and decision-making, so identity management is governed rather than left to drift.

IAM Program Value

IAM program value is the demonstrated reduction of unjustified access and authentication risk together with faster, more reliable delivery and removal of approved access.

IAM Risk Prioritization

IAM risk prioritization orders identity weaknesses by likely misuse, privilege, exposure, affected assets, evidence, and the speed and safety of containment.

IAM Roles vs Users (Cloud)

The distinction between cloud users (long-lived identities for people, with standing credentials) and roles (assumable identities granting temporary credentials), a core cloud-IAM concept where roles are preferred to avoid static, leakable keys.

IAM Threat Detection

Detecting attacks against identity and access systems, anomalous logins, privilege escalation, suspicious entitlement changes, and credential abuse, since identity is a primary target and effective perimeter in modern environments.

ICMP

Internet Control Message Protocol: a network protocol used for diagnostics and error messages (such as ping and unreachable notifications). Defenders watch it because attackers can abuse it for scanning, tunneling, or covert channels.

ID Token

In OpenID Connect, a token the identity provider issues to prove a user's identity to an application, containing claims about who the user is and how they authenticated. It is how a relying party learns the user is authenticated.

An ID token is a signed token (typically a JWT) issued after authentication in OpenID Connect, carrying claims such as the user's identifier, when and how they authenticated, and the issuer. The application verifies it to confirm the user's identity, distinct from an access token, which authorizes API calls. Understanding the ID token clarifies how federated login conveys authentication, and why verifying its signature and claims matters for security.

Introduced in: Identity and Access Management

Examples

An app reading an ID token's claims to learn who just signed in.
Verifying an ID token's signature to trust the identity provider's assertion.
Distinguishing an ID token (who you are) from an access token (what you can do).

Federated Identityrelates_to Authorization Code Flowrelates_to Access Tokenrelates_to Authorization Code Flowrelates_to Federated Identityrelates_to Identity Providerprerequisite_of Identity Federationrelates_to JWTrelates_to

IDOR

An insecure direct object reference where a user can access another user's object by changing an identifier.

IGA Control Metrics

IGA control metrics measure verified coverage, freshness, timeliness, quality, failures, exceptions, remediation, and unresolved risk with defined denominators and data health.

IGA Implementation Patterns

Proven approaches for rolling out identity governance and administration, such as phased deployment, starting with high-risk applications, or focusing first on access certification, that help an IGA program succeed rather than stall.

IGA Implementation Realities

The practical challenges of implementing identity governance and administration, messy data, complex application integrations, organizational resistance, and scope creep, that make IGA projects hard and often longer than expected.

IGA Implementation Scope

IGA implementation scope states the populations, sources, targets, identity and entitlement types, workflows, controls, evidence, operations, exclusions, and acceptance criteria in a release.

IGA Platform Functions

The core capabilities an identity governance and administration platform provides, access request and provisioning, access certification, role management, separation-of-duties enforcement, and identity analytics, that automate and govern access at scale.

IGA Platform Landscape

The market of identity governance and administration products and their differences, helping practitioners understand the available platforms, their strengths, and how to choose one suited to the organization's needs.

IGA Program Metrics

The measures used to track an identity governance program's health and value, such as certification completion rates, access-request turnaround, orphaned-account counts, and separation-of-duties violations, showing whether governance is working.

IGA Program Operations

The ongoing running of an identity governance program, executing access certifications, processing requests, maintaining roles, resolving violations, and reporting, so governance is sustained day to day rather than a one-time setup.

IGA Program Roadmap

An IGA program roadmap sequences data, connector, policy, role, review, SoD, analytics, staffing, privacy, resilience, and modernization work by risk, readiness, dependencies, and measurable exit criteria.

IGA Purpose and Boundaries

IGA purpose and boundaries define which identity-governance facts and decisions a system coordinates, which target systems enforce access, and how outcomes are independently verified.

IMAP

Internet Message Access Protocol: a protocol email clients use to retrieve and manage messages stored on a mail server. Defenders care about it because attackers abuse IMAP access, often via stolen credentials, to read or exfiltrate mailboxes.

IOC

An indicator of compromise: an observable value or condition associated with potentially malicious activity whose meaning depends on source, time, confidence, and local context.

IOC Operationalization

Turning indicators of compromise into active defensive use, loading them into detection tools, blocklists, and hunts, so intelligence indicators actually catch or block the threats they represent rather than sitting unused.

IP Address

An IP address is a network address used to identify a device or service so traffic can be routed to it.

IP Addresses

Numeric labels assigned to devices on a network that identify them and enable routing of traffic to and from them. They are fundamental to networking and a key data point in detection, investigation, and access control.

IPv4

Internet Protocol version 4: the long-dominant IP addressing scheme using 32-bit addresses written as four numbers (like 192.168.1.1). Its limited address space led to NAT and the development of IPv6.

IPv6

Internet Protocol version 6: the newer IP addressing scheme using 128-bit addresses to vastly expand address space beyond IPv4. Defenders must account for it because it is often enabled by default and can create overlooked attack surface.

IR Evidence Preservation for Litigation

Handling incident evidence so it remains legally sound, preserving integrity, chain of custody, and completeness, in case the incident leads to litigation, regulatory action, or prosecution, a key concern of incident response leadership.

IR Execution

Carrying out the incident response in practice, coordinating investigation, containment, eradication, and recovery actions under pressure, a capstone skill of running a real response end to end rather than knowing the steps in theory.

IR Mental Demands

The psychological strain of incident response work, pressure, uncertainty, long hours, high stakes, and on-call stress, that responders must manage to stay effective and avoid burnout over a career.

IR Skill Profile

The mix of competencies an effective incident responder needs, technical depth (forensics, systems, networking), structured analytical thinking, communication, and composure under pressure, that together define the role's requirements.

IR-SOC Boundary

The dividing line and handoff between SOC operations and the incident response function, defining when an issue stops being SOC triage and becomes an incident IR owns, so the transition is clear and nothing falls between them.