Terminology Index

Glossary

2953 terms

Authentication

Authentication is the process of proving that a user, device, service, or system is who it claims to be.

Authentication Alert

An alert about sign-in, credential, authenticator, session, token, recovery, or access-policy behavior that requires identity and context validation.

Authentication Alerts

SOC alerts triggered by login and identity events, such as failed-login bursts, impossible travel, or logins from unusual locations or devices. They are a frequent and high-value alert category because attackers often start by abusing credentials.

Because so many attacks begin with stolen or guessed credentials, authentication alerts are central to a SOC's daily work. Triaging them means gathering context, the user, location, device, and prior behavior, to decide whether the activity is benign or a sign of account compromise.

Introduced in: SOC Analyst Fundamentals

Examples

An impossible-travel alert when a user logs in from two distant places minutes apart.
A burst of failed logins suggesting password guessing.
A successful login from a country the user has never used before.

Dispositionrelates_to Cloud Alertsrelates_to Benign True Positiverelates_to Endpoint Alertsrelates_to Context Gatheringprerequisite_of Authentication Anomaly Detectionprerequisite_of Cloud Alertsrelates_to Data Access Alertsrelates_to Email Alertsrelates_to Endpoint Alertsrelates_to

Authentication Anomaly Detection

Detections that flag logins deviating from normal patterns, such as unusual times, locations, devices, or velocity, rather than matching a fixed signature. They catch credential abuse that looks technically valid.

Authentication Architecture Review

Assessing how a system proves who users are, examining the design of login flows, multi-factor authentication, session handling, token issuance, and federation, to find design weaknesses before they are exploited.

Authentication Context Detection

Authentication context detection evaluates identity, authenticator, protocol, source, target, device, application, session, privilege, and prior behavior around an authentication event.

Authentication Coverage Assessment

An authentication coverage assessment measures which sign-in paths actually enforce the required authentication strength, including exclusions, recovery routes, legacy protocols, and local application accounts.

Authentication Factor

A category of evidence used to authenticate an identity, commonly something known, possessed, or inherent; two items from one category do not constitute two-factor authentication.

Authentication Factors

The categories of evidence used to prove identity: something you know (a password), something you have (a phone or token), and something you are (a fingerprint or face). Combining factors from different categories is what makes multi-factor authentication strong.

Authentication Flow Assessment

Authentication flow assessment tests sign-up, invitation, sign-in, federation, MFA, verification, recovery, step-up, lockout, session creation, logout, device trust, and support-assisted changes.

Authentication Flow Testing

Authentication flow testing verifies the server-side states and transitions for registration, invitation, sign-in, federation, verification, step-up, recovery, authenticator change, logout, and suspension.

Authentication Policy Silos

Authentication policy silos group high-value Active Directory users, computers, and managed service accounts so policies can constrain their Kerberos authentication relationships and ticket lifetimes.

Authentication Protocols

The standardized methods systems use to verify identity and exchange authentication information, such as Kerberos, SAML, OAuth, OpenID Connect, and RADIUS. Each has its own trust model and security considerations.

Authentication Service

An authentication service verifies an identity with approved authenticators and returns a trustworthy authentication result to a relying system.

Authentication Testing

Systematically evaluating an application's login and identity mechanisms during a security assessment to find weaknesses, such as weak session handling, missing MFA enforcement, or flaws in password and reset flows.

Authenticity

Authenticity is confidence that data, users, systems, or messages are genuine and not impersonated or altered.

Authoritative DNS Server

A DNS server that answers from the records delegated to a zone it serves rather than recursively resolving the name through other servers.

Authoritative DNS Servers

The DNS servers that hold the official, definitive records for a domain and answer queries about it. When a resolver needs the true address for a name, the answer ultimately comes from the domain's authoritative server.

Authoritative Identity Source

The designated system trusted to originate a defined identity population or attribute, with ownership, correlation, reconciliation, and lifecycle rules explicitly documented.

Authoritative Identity Sources

Authoritative identity sources supply approved identity facts for a defined population or attribute under a named data owner.

Authorization

Authorization is the decision about what an authenticated user, service, or system is allowed to do.

Authorization Architecture Review

Assessing how a system decides what an authenticated user is allowed to do, examining the design of its access model (such as RBAC or ABAC), enforcement points, and default-deny posture, to find gaps that allow excess access.

Authorization Boundary Testing

Authorization boundary testing verifies server-side permission decisions across users, roles, tenants, object ownership, actions, fields, collections, exports, background jobs, and administrative routes.

Authorization Code Flow

The standard OAuth 2.0 and OpenID Connect flow for web and mobile apps, where the app receives a short-lived authorization code and exchanges it server-side for tokens. It keeps tokens off the browser front channel, making it the recommended secure flow.

Authorization Engine

An authorization engine evaluates policy and context to decide whether an authenticated identity may perform a requested action on a resource.

Authorization Model

A structured method for deciding permitted actions, such as role-, attribute-, relationship-, policy-, discretionary-, or mandatory-based access control.

Authorization Models

The different schemes for deciding what an authenticated user may do, such as role-based access control (RBAC), attribute-based access control (ABAC), and relationship-based models. Each balances simplicity, flexibility, and manageability differently.

Authorization Policies

In cloud-native environments, the rules that define which services, workloads, or users may access which resources, often expressed declaratively and enforced by a service mesh or admission controller. They implement least privilege between components.

Authorization Testing Methodology

A structured approach to testing whether an application correctly enforces what users are allowed to do, checking for broken access control such as accessing other users' data or reaching admin functions without rights.

Authorized Detection Validation

Authorized detection validation uses approved synthetic events, replay, emulation, simulation, or red-team procedures within explicit environment, safety, data, time, and impact boundaries.

Authorized Keys

On Linux and Unix systems, the file listing public SSH keys permitted to log into an account without a password. Because it grants direct access, attackers abuse it as a stealthy persistence mechanism by adding their own key.

Auto-Remediation

Automatically correcting an insecure cloud configuration as soon as it is detected, without waiting for a human, for example re-enabling logging or removing a public access setting that violates policy.