Glossary

159 terms from MFA, Access Control and Passwords, in plain words, each with the chapter that teaches it.

Search the glossary

#

2FA (two-factor authentication): MFA that uses exactly two factors of different types, such as a password plus a code from an authenticator app.

A

AAA (Authentication, Authorization, and Accounting): The chain of steps a system uses to control access: prove who you are, decide what you may do, and record what you did. Add identification at the start and there are four steps.
acceptable use policy: A written administrative rule about how staff may use company systems. One example is "Staff may not share passwords or let others use their accounts."
access control list (ACL): An ordered list of allow and deny rules on a firewall or router. Each request is checked from the top, and the first rule that matches decides.
access control model: A method for deciding which subjects (people or programs) get which permissions on which objects, such as files, servers or apps. Common models include rule-based, role-based, time-based, mandatory, discretionary and just-in-time access, and each one differs in who or what makes the access decision.
access management: The day-to-day work of controlling who gets into which systems and what they can do there, guided by policies and checked by access reviews.
access review: A regular check, done by managers and data owners, that each person and account still needs the access it has. Alex's quarterly review found Dana's orphaned account and Sam's leftover Customer Service membership.
account auditing: Checking how accounts are set up and used. It differs from an access review, which asks whether each piece of access should still exist.
account expiration: A setting that switches a whole account off on a chosen date, such as the seasonal packers' accounts ending on December 31. It is different from password expiration, where the account keeps working.
account lockout: Locking an account after a set number of failed logins, for a set time or until an admin unlocks it. Alex set 10 attempts, a 15-minute lock and a 15-minute counter reset.
accounting: The step of recording what a user did, for example a log entry showing Sam opened the café customer list at 2:14 p.m.
Active Directory: Microsoft's directory of company accounts. Each account has settings such as Logon Hours.
administrative/business policy: A written rule set by management and enforced by people through approvals, training and consequences, such as a separation of duties rule. It is a managerial control.
API key (Application Programming Interface key): A long secret string that one program uses to prove itself to another. The shop's checkout uses one to authenticate to the payment processor.
authentication: The step where a system checks that a subject really is who it claims to be, for example with a password and an app code.
authentication factor: A type of proof of identity: something you know (password, PIN), something you have (phone, security key) or something you are (fingerprint, face).
authenticator app: A phone app, which counts as a soft token, that shows a new six-digit TOTP code every 30 seconds. You set it up by scanning a QR code. Alex moved Priya from SMS codes to one.
authorization: The decision about what an authenticated subject may do, made using an access control model. Being refused the payroll folder is an authorization decision.

B

backup code: A long random code saved ahead of time that replaces your normal second factor if it is lost. Each code works once and is then burned, as when Sam broke a phone and signed in with a printed code.
biometrics: Using a measurement of the body, or of how it behaves, as proof of identity: fingerprint, face, iris, voice and so on. It is the "something you are" factor and cannot be changed if leaked.
blocklist: A list of passwords a system refuses because they are breached, common, predictable or specific to the service. Kettle & Crane's includes "kettle", "coffee" and "passwordpassword".

C

centralized authentication: Keeping all accounts in one directory that every system asks, so there is one place to add MFA, disable a leaver and log every login.
CER (Crossover error rate): The point where a biometric system's false acceptance and false rejection rates are equal. A lower CER means a more accurate product.
chage: A Linux command that shows and sets a user's password ages: last change (-d), minimum days (-m), maximum days (-M) and warning days (-W).
challenge: A fresh random value that a website sends at login for the security key or passkey to sign. It stops an old signature from being replayed.
character classes: The four kinds of character used in complexity rules: uppercase letters, lowercase letters, digits and symbols.
chgrp: A Linux command that changes which group a file belongs to, as when Jo gave price-list.csv to the sales group.
chmod: A Linux command that sets a file's permissions. In chmod 640, 6 gives the owner read and write, 4 gives the group read, and 0 gives others nothing.
classification: In mandatory access control, the label on an object that shows how sensitive it is, such as Top Secret, Secret, Confidential or Unclassified.
clearance: In mandatory access control, the label on a subject that shows the highest classification they may read.
client data: The bundle the browser signs during a WebAuthn login. It holds the type, the challenge and the origin (the page's address), which lets the real site reject signatures made for a lookalike site.
compartment: An extra tag in a MAC label, such as "Project Harbor". You need both a high enough clearance and membership in the compartment to read the object.
compromised credential monitoring: Watching breach data for the company's own accounts so that leaked passwords can be changed. The next book in the course covers it.
conditional access: A rule in a cloud sign-in service that allows or blocks access based on conditions, such as "if the device is not managed by the company, block access to payroll".
context-aware authentication: A login system that weighs signals such as location, device, time and behavior, then allows the login, steps up to another factor, or blocks it.
credential manager: Software, such as the one built into a phone's operating system or a password manager, that stores passkeys and syncs them across your devices.
credential stuffing: An attack that takes email and password pairs leaked from one site and tries them automatically on other services. This is how a password Priya reused from a breached recipe site reached Priya's work account.

D

DAC (Discretionary access control): An access model where the owner of an object decides who may use it, as when Jo lets the Sales group read the price list, or you share a cloud document.
data owner: The person responsible for a set of data who approves and reviews who may use it.
device-bound passkey: A passkey that lives on one device, such as a FIDO2 security key, and cannot be copied out. It gives the highest assurance, but you need a spare in case the device is lost.
dormant account: An account that has an owner but has not been used for a long time. It may no longer be needed.

E

excessive permissions: More access than a job needs, such as edit rights where read would do. Access reviews look for them.

F

FAR (False acceptance rate): How often a biometric system wrongly lets an impostor in, also called a Type II error. This is the dangerous error.
FIDO2: Open login standards from the FIDO Alliance. Security keys and passkeys use them to sign a website's challenge with a private key that never leaves the device.
firewall: A system that allows or blocks network traffic using an ordered list of rules about source, destination, port and conditions such as time. It is the classic example of rule-based access.
FRR (False rejection rate): How often a biometric system wrongly turns away the real person, also called a Type I error, like the gloved packers at the stockroom door. This is the annoying error.

G

group: A named set of accounts in a directory, such as "sales". Permissions are given to the group, so it usually acts as a role. On Linux, each file also has a group with its own permissions.
Group Policy: The Windows feature that pushes technical settings, such as screen locks and password rules, to computers across a network.

H

hard token: A small physical device made only for authentication, such as an OTP key fob, a security key or a smart card. It holds a secret that is very hard to copy out.
hash: A one-way scrambled value made from data. Sites store passwords and backup codes as hashes, but a stolen file of hashes can still be cracked by guessing.
HMAC (Hash-based Message Authentication Code): A way of mixing a secret with data, such as a counter or a time window, through a hash function. OTP codes are built with it.
HOTP (HMAC-based One-time Password): An OTP made from a shared secret and a counter that goes up by one each time a code is used or the button is pressed.
HTTPS (Hypertext Transfer Protocol Secure): The secure web protocol, which normally uses port 443. The order server's firewall rules allow it.

I

identification: Claiming an identity, for example typing sam@kettleandcrane.com. A claim proves nothing until authentication.
identity proofing: Carefully checking that a person really is who they say before giving or resetting credentials. The help desk must do this before resetting MFA for someone who says "I lost my phone".
implicit deny: The final rule in a rule list: if no rule matches a request, it is denied. In nftables this is written as policy drop.
impossible travel: A login pattern that no real person could produce, such as Sam signing in from Portland and from another continent nine minutes later. It is a strong sign of a stolen password.
iris: A biometric that reads the colored ring around the pupil with a close-up camera.

J

JIT (Just-in-time access): Granting a privilege only when it is requested and approved, for a short window, and then removing it automatically, like Alex's 2-hour admin activations.
joiner, mover, leaver: Rules for changing access when people join, change jobs or leave. For example, a leaver's accounts are disabled on their last day, and a mover loses the old role's access.

K

key pair (public key / private key): Two linked cryptographic keys: a private key you keep secret and a public key anyone may see. Something signed with the private key can be checked with the public key, which is how security keys and passkeys work.

L

LDAP (Lightweight Directory Access Protocol): The protocol systems use to query a central directory of accounts, which makes centralized authentication possible.
least privilege: Giving each person or role only the access their job needs and nothing more.
libpwquality: A password-checking library many Linux systems use. It tests passwords against settings in a policy file.
liveness: A biometric sensor's check for signs of a real living person, which stops fake fingers, photos and masks.
logical/technical policy: A rule a system enforces automatically through settings, such as lockout thresholds, required MFA or a five-minute screen lock. It is a technical control.
logon hours: An account setting that limits the hours a user may sign in, such as Active Directory's "Logon Hours".
ls -l: A Linux command that lists files with their ten-character permission string, owner and group, such as -rw-r----- 1 jo sales.

M

MAC (Mandatory access control): An access model where the system decides by comparing a subject's clearance with an object's classification label. Users, even owners, cannot change or pass on access.
magic link: A one-time sign-in link emailed to you. It is passwordless but only single-factor, because it depends on the security of your inbox.
master password: The one long, unique password that unlocks a password manager's vault. It should be protected with MFA too.
maximum password age: The oldest a password may get before it expires and must be changed. Old policies used 90 days; Linux uses 99999 to mean "never".
MFA (Multifactor Authentication): Proving your identity with two or more factors of different types. A password plus a phone code is MFA; a password plus a PIN is not.
MFA fatigue: An attack where someone who already has the password sends many push login requests until a tired user taps Approve. Number matching is the fix.
minimum password age: The number of days a user must keep a new password before changing it again. It stops people from cycling through password history to get an old favorite back.
minlen / minclass / dictcheck: libpwquality settings for the minimum length, the minimum number of character classes, and whether to check passwords against a dictionary.
mutual authentication: Both sides proving themselves to each other. For example, a laptop and the company VPN server each check the other's certificate.

N

need-to-know: The rule that a person should see information only if their work requires it, even when they hold a high enough clearance.
NFC (Near-field Communication): The short-range radio used for tap-to-pay. It lets you tap a security key on a phone.
nftables: Linux's built-in firewall. The command nft list ruleset prints the rules in force, such as those protecting the order server.
NIST (National Institute of Standards and Technology): The US agency whose guides set many authentication and password rules.
NIST SP 800-63B-4: NIST's authentication guide (July 2025). It requires 15-character minimums for password-only logins, a blocklist, no composition rules, no routine expiration, and biometrics only together with a physical authenticator.
number matching: A push-login defense where the login screen shows a number, such as 47, that the user must type into the app. Someone who did not start the login has no number to type.

O

object: The thing being accessed, such as a file, folder, server, printer or app.
OpenSSH: The standard SSH remote login software on Linux. Its server log records lines such as "Failed password" and "Invalid user".
origin: The full address of the page that asked for a passkey login, such as https://shop.kettleandcrane.com. The browser signs it, so the real site can reject a signature made for a lookalike site.
orphaned account: An account that belongs to nobody current: a leaver's account that was never disabled, like Dana's, or a service account nobody is responsible for.
OTP (One-time Password): A code, usually six digits, that works for one login only. The two standard ways to make one are HOTP and TOTP, and no OTP is phishing-resistant.
OTP key fob: A small hard token with a screen that shows a new code every 30 or 60 seconds. Its code can still be typed into a fake site.

P

pam_pwhistory: A Linux module that remembers old password hashes (for example remember=24) and refuses a new password that matches one of them.
pam_time: A Linux module that limits when users may log in, using rules in /etc/security/time.conf.
passkey: A login credential that replaces a password with a key pair: the private key stays on your device and signs the site's challenge, while the site keeps only the public key. Because each passkey is bound to the real site's name, it is phishing-resistant.
passphrase: A long password made of several words in a row, ideally picked at random, such as "ladder bright pigeon harbor velvet".
password age: How long the current password has been in use. It is controlled by the minimum and maximum password age settings.
password complexity: Rules requiring a mix of character classes. They often backfire into predictable passwords like Summer2026!, and NIST now forbids them.
password expiration: Forcing users to change their password after a set number of days. NIST now says to require a change only when there is evidence of compromise.
password history: A setting that remembers a number of old passwords as hashes (up to 24 in Windows) and refuses them, which stops reuse at the same site.
password length: The number of characters in a password, and the most important thing about it, because each extra character multiplies the attacker's work. NIST asks for 15 characters for a password alone and 8 with MFA.
password manager: An app that generates, stores in an encrypted vault, and fills in unique random passwords. It fills them only on the site they belong to.
password reuse: Using the same password on more than one site, or going back to an old password at the same site.
passwordless: Signing in without typing a password, for example with passkeys, security keys, smart cards or device sign-in. It is not automatically MFA: a magic link is single-factor.
PCI DSS (Payment Card Industry Data Security Standard): The payment card security standard. Version 4.0.1 asks for 12-character passwords with letters and numbers, no reuse of the last four, and 90-day changes where a password is the only factor.
permission: What a subject may do to an object, such as read, write (change) or execute (run).
phishing-resistant: Describes a login method a fake site cannot trick into helping an attacker, such as security keys, smart cards and passkeys. OTP codes are not phishing-resistant.
PIN (Personal Identification Number): A short numeric secret, a "something you know" factor. On a device it often unlocks a key that never leaves the device.
PIV (Personal Identity Verification): The smart cards that US government staff use to sign in.
privilege creep: The slow buildup of access as a person keeps rights from old jobs, like Priya keeping refund rights after moving to Buying.
privileged access management (PAM): Tools that manage powerful accounts, often by granting admin rights just in time and logging their use. Not the same as the Linux pam_ modules such as pam_time.
Privileged Identity Management: Microsoft's cloud directory feature for just-in-time access. Users are made "eligible" for a role and activate it for a limited time (8 hours by default).
proximity badge: An RFID card held near a door reader. It is "something you have", but a simple badge sends a fixed number and is easy to clone.
push notification: A soft-token method where a phone app asks "Are you trying to sign in?" and you tap Approve or Deny.

Q

QR code (Quick Response code): A square barcode. You scan one to set up an authenticator app, and it carries the shared secret.

R

real-time phishing proxy: A fake login page that passes your password and OTP code to the real site at once. Only phishing-resistant factors stop it.
Relax minimum password length limits: A Windows setting that must be on to require a minimum password length above 14. A fine-grained password policy is the other way to get past that limit.
relying party: The website that relies on a passkey login, such as shop.kettleandcrane.com. Each passkey is tied to one relying party's name.
restricted authenticator: NIST's label for weaker methods, such as codes sent by SMS or voice call. They are allowed only if the organization accepts the extra risk and offers users a better option.
retina: A very accurate biometric that reads the pattern of blood vessels at the back of the eye. It needs special equipment.
RFC (Request for Comments): A published internet standard. TOTP is defined in RFC 6238 and HOTP in RFC 4226.
RFID (Radio Frequency Identification): A radio technology used in cards such as proximity badges.
role: A named set of permissions that matches a job, such as Sales or Shipping. People are put into roles, usually as directory groups.
role explosion: Creating so many roles for exceptions that there are more roles than people.
role-based access control (RBAC): An access model where permissions go to job roles and people are given roles. RBAC can also mean rule-based, so read the scenario.
root user: The all-powerful administrator account on Linux. SELinux's policy applies even to root.
rule-based access control: An access model where an administrator's rules about conditions (address, port, time, device state) are applied to every request, whoever the user is, as in a firewall.

S

saddr / daddr: nftables keywords for the source address and destination address that a firewall rule matches.
security key: A hard token you plug in by USB or tap by NFC. It signs a website's challenge with a private key that never leaves it, and it refuses fake sites, so it is phishing-resistant.
security question: A question such as "Your first pet?" whose answer you know. Added to a password it is two steps of the same factor, so it is not MFA.
SELinux (Security-enhanced Linux): A Linux mandatory access control system that labels every file and process and enforces its policy, even against root.
separation of duties: Splitting a sensitive task between people so one person cannot commit fraud alone. For example, Jo creates suppliers and Sam approves payments.
session timeout: Automatically signing a user out after a period with no activity, such as 15 minutes on the shop admin panel.
shared secret: A random key that the server and the token both store at setup, and from which they each compute matching OTP codes.
SIM (Subscriber Identity Module): The card in a phone that ties it to a mobile phone number.
SIM swap: An attack where someone talks the mobile carrier into moving your number to their SIM, so your SMS codes go to them.
single sign-on: One login that gives access to many apps, so people need fewer passwords. It is not the same as a password manager.
smart card: A plastic card with a chip that holds a certificate and its private key, unlocked with a PIN. It is a phishing-resistant hard token.
SMS (Short Message Service): Phone text messages. It is the weakest way to deliver OTP codes, because of SIM swaps, and NIST calls it a restricted authenticator.
social engineering: Tricking people rather than systems, for example a caller pretending to have lost a phone to get MFA reset.
soft token: A program that does a token's job on a device you already own, such as an authenticator app, a push app or a software certificate.
software certificate: A certificate and private key stored on a laptop or phone instead of on a smart card. Devices also use certificates to prove they belong.
something you do / somewhere you are: Extra signals next to the factors: behavior, such as how you type, and location, such as your network's country. They usually help a system decide rather than prove identity alone.
sshd: The OpenSSH remote login service, named in time.conf rules and logs.
step-up authentication: Asking for an extra factor when a login looks risky or before a sensitive action, such as asking for the security key again before bank details are changed.
subject: Whoever asks for access: a person, or a program acting for one.
sudo: A Linux command prefix that runs the following command with administrator rights, as in sudo nft list ruleset.
synced passkey: A passkey copied to all your devices by a credential manager, so it survives a lost phone. Its security also depends on the sync account.

T

template: The set of measured points a biometric system stores at enrollment, not a photo. New scans are compared with it, and it stays protected on the device.
threshold: The match score a biometric scan must pass. Raising it lowers FAR but raises FRR.
throttling: Adding a growing delay after each failed login, to slow down password guessing without fully locking the account.
time-based access control: Allowing access only on a fixed schedule or until a set date, using logon hours, time conditions in rules or account expiration.
time.conf: The Linux file read by pam_time. Each rule has the form services;terminals;users;times, such as login|sshd;*;sam;Wk0700-1900.
token: An object or program that proves you have something. It can be hard (a device) or soft (software).
TOTP (Time-based One-time Password): An OTP made from a shared secret and the current time in 30-second windows. Nearly all authenticator apps use it.

U

USB (Universal Serial Bus): The common computer port that security keys plug into.
use_authtok: A pam_pwhistory option that checks the new password already collected by the previous module in the chain, instead of asking the user again.

V

vault: The encrypted file where a password manager keeps passwords, unlocked by the master password. Team versions add shared vaults, like Kettle & Crane's "Shipping" vault.
VPN (Virtual Private Network): An encrypted connection over an untrusted network, such as the internet, that lets a remote device use a private company network as if it were in the office. A VPN often uses mutual authentication: the laptop checks the VPN server's certificate, and the server checks the laptop's.

W

W3C (World Wide Web Consortium): The group that writes web standards, including WebAuthn.
WebAuthn (Web Authentication): The browser side of FIDO2 that passkeys use. It signs client data containing the challenge and the page's origin.

Z

zero standing privilege: The goal that no account keeps admin rights all the time. Rights exist only during short just-in-time windows.