Monitoring Tools and the Identity Life Cycle

Glossary

260 terms from Monitoring Tools and the Identity Life Cycle, in plain words, each with the chapter that teaches it.

Search the glossary

#

/etc/passwd: The Linux file with one line per account, giving the username, user number, description, home folder and shell. Its companion file, /etc/group, lists each group and its members.
5-tuple: The five values that together define a network flow: source IP address, destination IP address, source port, destination port and protocol. Packets that share all five belong to the same flow.

A

Access review: A regular check of who has which access, so that permissions people no longer need can be removed. It is the main cure for permission creep.
Access token: In OAuth, a string an app presents with each request to show what it may do. It carries scopes and expires, often after an hour, and deprovisioning revokes tokens because disabling a password doesn't end access that was already granted.
Account: What an identity uses to sign in to one system, with a username and credentials. One person, such as Dana, usually has several accounts: email, the shop's admin page, the shipping software.
Account expiration: A date set on an account after which it stops working by itself. Contractors and temporary staff get one matching their last day, so deprovisioning happens even if everyone forgets.
Account recovery: Restoring access for a locked-out user, for example with a password reset or a new MFA device. Attackers often target the help desk at this step, so recovery needs proofing as strong as enrollment, such as a callback to the number on file and manager approval.
Account type: A category of account defined by who uses it and how much power it has: user, global privileged, local privileged, service, third-party or emergency access. Each type needs its own controls.
Active Directory: Microsoft's directory service, which holds the accounts and groups on most Windows networks. It speaks LDAP and uses Kerberos for single sign-on.
AES (Advanced Encryption Standard): A widely used encryption algorithm. SNMPv3 uses it to provide privacy, meaning its messages are encrypted.
Alert fatigue: What happens when a tool raises so many alerts that staff start ignoring all of them, real ones included. Clear severities, owners and tuned rules prevent it.
Alert tuning: Changing alert rules so they stop firing on things known to be harmless. Tune narrowly: for example, add an exception only for the vulnerability scanner's address during its scan window, instead of turning the rule off.
Analyzer: The NetFlow component that reads stored flow records, charts the top talkers, finds unusual traffic and can feed the SIEM.
Anomaly alert: An alert that fires when behavior differs from the normal baseline, for example when Kettle & Crane's label printer suddenly sends traffic to the internet.
API (application programming interface): A defined way for programs to talk to each other. For example, the label app reads data through the shop's order API, and an NMS can manage devices through their APIs.
API key: A secret string a program uses to authenticate to an API. An NMS stores API keys for the devices it manages, and any keys a leaver created must be changed when they go.
Assertion: The signed XML statement a SAML identity provider sends about a user, saying who they are, when and how they signed in, and facts such as their department. It is valid only for one audience and for a short time window.
Attribute statement: The part of a SAML assertion that gives facts about the user, such as email, department or group. In Alex's lab assertion it said Dana works in Wholesale.
Audience: The condition in a SAML assertion that names the one service allowed to accept it, so a stolen assertion can't be used at a different service.
Authentication: Proving who someone is, or that a message came from a known sender and wasn't changed. SNMPv3 authenticates every message with a hash, and SAML and OpenID Connect tell services who has signed in.
Authentication statement: The part of a SAML assertion that records that the user signed in, when, and with which method, such as password plus MFA.
authNoPriv: The SNMPv3 security level where messages are authenticated but sent unencrypted. It shows why "SNMPv3" on its own doesn't guarantee encryption.
Authorization: The system checking an account's permissions each time it tries an action. OAuth is an authorization framework: it decides what an app may do, not who the user is.
Authorization code: A short-lived code the OAuth authorization server sends back through the browser after the user consents. The app then exchanges it directly for an access token.
Authorization code flow: The recommended OAuth sequence: the app sends the user to the authorization server, the user signs in and consents, and the app receives a code that it swaps for an access token. Current guidance pairs it with PKCE.
Authorization server: The OAuth role that signs in the resource owner, asks for their consent, and then issues access tokens to the client app. For example, when a label app connects to Kettle & Crane's online shop, the shop platform's sign-in service is the authorization server that gives out a limited token.
authPriv: The SNMPv3 security level that both authenticates and encrypts every message. Use it unless a device can't support it.
Automated alert: A notification a tool raises by itself when data matches a rule. It is built from a data source, a rule with a condition and threshold, a severity and an action such as a phone notification.

B

Backdoor: Hidden code that gives attackers secret access to a system. In 2020, attackers hid one inside software updates for SolarWinds Orion.
Baseline: A record of what normal looks like for a value, such as traffic on a port or failed logins per hour. Readings that stray far from it can trigger an alert.
Benchmark: An agreed set of secure settings for a system, such as the CIS Benchmarks or STIGs. Many are published in SCAP format, so a scanner can check machines against them automatically.
Bind: The LDAP request an application uses to sign in to a directory as a user, which checks that user's password. A simple bind sends a DN and a password, which travel in plain text on port 389 unless TLS is used.
Biometric: A physical trait used to identify a person, such as a face photo or a fingerprint. IAL3 proofing requires at least one.
Blast radius: How much damage a stolen account can do, which depends on how many permissions it has. Least privilege keeps it small.

C

CCE (Common Configuration Enumeration): The part of SCAP that gives standard names to configuration settings.
Central log server: A server that receives copies of logs from many devices, usually by syslog, as each event happens. An attacker who deletes a device's local logs can't remove the central copies, and events can be compared across devices.
Certificate: A signed file that ties a public key to its owner, so others can use that key to check the owner's digital signatures. In federation the two organizations exchange certificates in their metadata, and LDAPS uses the directory's certificate.
chage: A Linux command that shows or changes an account's password ageing and expiry dates. Alex used chage -l to confirm that Dana's account had expired.
CIS Benchmarks: Secure-configuration guides from the Center for Internet Security, many of them published in SCAP format. Alex scanned the Linux servers against one to prove compliance to a wholesale customer.
Client (OAuth): The OAuth role for the application that wants access to a user's data, such as the shipping-label app. client_id is the value that names the app in requests.
cn (common name): An LDAP label giving the name of an entry itself. Priya's entry, for example, has cn: Priya Shah.
Collector: A server that receives and stores flow records from exporters, commonly on UDP port 2055 (IPFIX uses 4739). nfdump is an open source collector.
Community string: The shared word that SNMPv1 and v2c use in place of a password, sent in plain text. Devices often ship with "public" for reading and "private" for writing, so anyone who captures traffic can read it.
Configuration compliance: Proving that systems match a benchmark and finding the ones that have drifted from it. SCAP is the tool for this job.
Configuration management: The NMS task of backing up each device's configuration, often nightly, and reporting any change. A change with no change request behind it needs an explanation.
Consent phishing: An attack in which a harmless-looking app asks for broad OAuth scopes and tricks users into clicking Allow. No password is stolen, so a password reset doesn't remove the access; the app's tokens must be revoked.
Consent screen: The page where the OAuth authorization server asks the user to approve an app's requested scopes, for example "Label app wants to: read orders. Allow?".
Correlation alert: An alert that fires when events from different sources fit a pattern, such as a login from a new country followed by a large download. Correlating events is the SIEM's main job.
CPE (Common Platform Enumeration): The part of SCAP that gives standard names to products and versions, so a rule can say which systems it applies to.
CVE (Common Vulnerabilities and Exposures): The standard naming system for known vulnerabilities. It is part of SCAP and is also used by vulnerability scanners.
CVSS (Common Vulnerability Scoring System): The standard severity score for vulnerabilities, from 0 to 10, and part of SCAP.

D

Dashboard: A single screen that shows the most important monitoring information at a glance as widgets: counters, trends, top lists, status lights and maps. It only displays data collected by tools such as the SIEM or NMS.
dc (domain component): An LDAP label for one part of the domain name. kettleandcrane.com becomes dc=kettleandcrane,dc=com.
Deepfake: A faked video or image of a person made with AI. Liveness tests in remote identity proofing try to detect them.
Denial of service: An attack that tries to make a system or network unavailable. An NMS notices a switch under this kind of attack within minutes.
Deny (permission): An NTFS permission entry that blocks access. An explicit Deny normally overrides an Allow, which is useful for blocking one group from one folder but can also lock out people who should have access.
Deprovisioning: Removing an account's access and shutting it down when it is no longer needed. For a leaver: disable at once, end sessions and tokens, remove groups, change shared secrets, recover devices, hand over data, and delete only after the retention period.
Digital signature: A value made with a private key that proves who created a message and that it wasn't changed. If even one character of a signed SAML assertion is changed, the check with the public key fails.
Direct assignment: Giving a permission to one person by name instead of to a group. Direct assignments are easy to forget and hard to find in reviews.
Directory: A database built to store and look up information about people, groups and devices, including what is needed to sign in. Its entries are arranged in a tree.
Disable-ADAccount: The PowerShell command that disables an Active Directory account, for example Disable-ADAccount -Identity dana.
Discovery: The NMS step that scans the network ranges you give it, finds devices that answer, and records each one's name, type, address and software version. It also reveals rogue devices.
Distinguished name (DN): The unique name of an LDAP entry: its path from the entry up to the top of the tree. Priya's DN is uid=priya,ou=people,dc=kettleandcrane,dc=com.
Domain Admins: Active Directory groups, Domain Admins and Enterprise Admins, whose members control every computer joined to the domain. They are global privileged accounts.
Domain controller: A Windows server that runs Active Directory and the Kerberos KDC for a domain. It is among the most trusted, tier 0 systems.
Drill down: Clicking a dashboard widget to see the details behind it, for example going from "7 high alerts" to the list of the 7, then to the log lines behind one of them.

E

EDR (endpoint detection and response): Software on laptops and servers that detects and responds to attacks. At Kettle & Crane it showed the attacker using the local Administrator account to sign in to other laptops.
Effective permissions: Everything a person can actually do once direct assignments, every group they're in and inherited permissions are combined. Check them when access is unexpectedly allowed or refused.
Emergency access account: A highly privileged account kept aside for when every administrator is locked out, and used for nothing else. Keep at least two, stored in a safe, excluded from blocking policies, alerted on at every use and tested regularly.
ERSPAN (encapsulated remote SPAN): A port mirroring variant that wraps the copied traffic so it can cross a routed network.
Executive dashboard: A dashboard for managers and owners that updates daily or weekly and shows trends and risk in plain terms. Alex built a four-widget one for the owner's Monday check.
Exporter: The router, switch or firewall that watches traffic, builds flow records and sends them to a collector.

F

Facility: The part of a syslog priority that says which part of the system sent the message, such as kern (0), auth (4) or local0 to local7 (16 to 23).
FCAPS: A way to remember what network management covers, taken from international standards: fault, configuration, accounting, performance and security.
Federation: A trust relationship between separate organizations or security domains, so that users signed in by one can use the other's services without a second account. For example, Jo signs in to the supplier's portal with her Kettle & Crane sign-in.
Flow: A group of packets that share the same 5-tuple, such as one direction of one web visit. The exporter counts its packets and bytes and notes its start and end times.
Flow record: The short summary of one flow: addresses, ports, protocol, packet and byte counts, times and TCP flags, but no payload. Records are tiny, so months of them can be kept.

G

Get request: SNMP polling messages. A Get reads a value from an agent; a Set changes one, such as turning off a switch port, which is why a leaked write community string is dangerous.
Global Administrator: The role in Microsoft Entra ID that controls every user and setting in a company's Microsoft cloud. Microsoft recommends fewer than five per tenant.
Global privileged account: An account with administrative rights across the whole environment, such as Domain Admins, Entra Global Administrator or a cloud root user. Keep them very few and dedicated, protect them with phishing-resistant MFA and PAM, and grant them just in time.
gMSA (group Managed Service Account): A Windows service account whose long random password the domain creates and changes automatically, every 30 days by default, so no person ever knows it.
gpasswd: A Linux command for managing group membership. gpasswd -d dana sales removed Dana from the sales group.
Group assignment: Giving a permission to a group, such as "Wholesale", and making people members. Removing someone from the group removes every permission that came with it, and reviews become simple.
Group Policy: Windows' central settings tool. A setting such as "Deny log on locally" stops anyone from signing in interactively with a service account.
Guest account: A built-in account with no password, meant to give visitors temporary access to a system. It can't be traced to a named person and anyone can use it, so the usual security practice is to disable it.

H

Hardware security key: A small physical device that holds a passkey or similar credential, giving phishing-resistant MFA. Kettle & Crane's emergency accounts use keys kept in a safe.
Hash: A fixed-length fingerprint calculated from data. SNMPv3 uses a hash such as SHA-256 to prove messages weren't changed, and Windows keeps password hashes in memory, where attackers can steal and reuse them.
HTTP request: The message a browser sends to a web server, such as the GET /authorize request that starts the OAuth flow.
HTTPS: Secure web traffic: HTTP encrypted with TLS, normally on port 443.

I

IAL (identity assurance level): NIST's three levels of confidence that identity proofing gives you. IAL1 gives some confidence, IAL2 gives high confidence and resists stolen or fake evidence, and IAL3 gives very high confidence, done in person with a trained agent and a biometric.
IAM (identity and access management): The processes and tools that make sure the right people get the right access at the right time, and nobody else does, across each account's life cycle.
ID token: The signed statement of who the user is that OpenID Connect adds on top of OAuth. It is written in the JWT format.
Identity: A real person (or program) and the facts about them, such as name, job, manager and start date. One identity can have many accounts.
Identity proofing: Collecting and checking evidence to confirm a person is who they claim to be before they receive credentials, through resolution, validation and verification. It is needed again at account recovery.
Identity provider (IdP): The central system that holds accounts, checks passwords and MFA, and tells other services who the user is, such as Microsoft Entra ID, Google Workspace or Okta. It can also push accounts to services automatically with SCIM.
IDS (intrusion detection system): A tool that watches network traffic and alerts on attacks but doesn't block them. On a mirror port it receives copies of traffic.
IETF (Internet Engineering Task Force): The body that publishes RFCs. OAuth 2.1 was still an IETF draft as of November 2026.
Implicit flow: Older OAuth flows that current guidance (RFC 9700) says not to use. The implicit flow returned tokens in the browser address, and the password flow handed the user's password to the app.
Indicator of compromise: A sign that an attacker may be present. Someone signing in interactively with a service account is one.
Inform: An SNMP trap that the manager must acknowledge, so the message isn't lost.
Inheritance: In most file systems, a folder's permissions flow down to everything inside it. Granting write on "Shared" also grants write on "Shared/Payroll" unless that folder blocks inheritance.
Inline: Sitting in the path of traffic so the device can block it, as an IPS does. A tool on a mirror port isn't inline and can only detect.
Interactive sign-in: A person signing in at a keyboard or by remote desktop. Service accounts should be blocked from it, and any interactive use of one should raise an alert.
IPFIX (IP Flow Information Export): The open standard for flow data, based on NetFlow version 9 and published as RFC 7011. Its collectors use port 4739.
IPS (intrusion prevention system): A device that sits inline in the traffic path and can block attacks, not just detect them.

J

Joiner, mover, leaver: The three moments in an account's life: joining (proof and provision), moving jobs (add new access and remove old access) and leaving (deprovision completely).
Just-in-time access: Giving an admin a privileged role only for the short time a task needs it, then removing it automatically. It means a global role isn't sitting on an account waiting to be stolen.
JWT: The compact signed-token text format used for OpenID Connect ID tokens.

K

KDC (key distribution center): The Kerberos service on every domain controller. It checks the password once at sign-in and issues tickets.
Kerberoasting: An attack that requests a Kerberos service ticket for a service account and then guesses the account's password offline. Weak, never-changed passwords fall quickly.
Kerberos: The ticket-based protocol (RFC 4120, port 88) that gives single sign-on inside a Windows domain without the password ever being sent to servers. Because tickets carry timestamps, clocks must agree, within 5 minutes by default.
Knowledge-based questions: Proofing questions such as "Which of these streets have you lived on?". They are weak because the answers often leak through breaches and social media, and NIST no longer accepts them for verification.
KPI (key performance indicator): A metric tied to a goal, such as patch compliance, shown on a dashboard to track progress.

L

LAPS (Local Administrator Password Solution): A feature built into Windows that gives each computer's local Administrator account its own long random password, changes it on a schedule and stores it in Active Directory or Entra ID. It stops one stolen password from opening every PC.
Lateral movement: An attacker moving from one machine to others, for example by reusing the same local Administrator password on Sam's laptop and eight more.
LDAP (Lightweight Directory Access Protocol): The standard protocol (RFC 4511, port 389) for reading and updating a directory. Applications bind to check passwords and search for users and groups.
LDAP injection: An attack that inserts crafted input into a directory search, much as SQL injection does against databases. Validating search input prevents it.
LDAPS: LDAP over TLS on port 636, which encrypts the whole connection, binds included. Alex moved the shop's directory connection to it after passwords showed up in a capture.
ldapsearch: A command-line tool that binds to an LDAP directory and searches it. Alex used it to bind as Priya and read her name, title and email.
Least privilege: Giving each account, person or app only the access it needs for its job. It limits the damage when an account is stolen.
linkDown: The standard SNMP trap (OID 1.3.6.1.6.3.1.1.5.3) that a switch sends when a port goes down, for example when a cable is pulled.
Liveness: A check in remote proofing that a real person is present, not a photo or a deepfake video.
Local privileged account: An account with admin rights on one machine only, stored on that machine, such as the Windows local Administrator, Linux root or sudo rights on one server. A shared password across machines allows lateral movement.
logger: A standard Linux tool that sends a syslog message. Alex used it to send test messages to an rsyslog server.
Login shell: The program a Linux account runs when someone signs in, such as /bin/bash. Setting it to /usr/sbin/nologin refuses every interactive sign-in, which suits service accounts like svc-labels.

M

Managed identity: A cloud identity for a program that the provider manages, used instead of keys stored in code.
Managed service provider (MSP): An outside company that runs IT for many customers. Its staff use third-party accounts.
Management network: A separate network used only for managing devices. An NMS is placed on one, and devices accept management only from its address.
Mean time to detect: Dashboard metrics. Mean time to detect is the average time from an attack starting to someone noticing; mean time to respond is the average time from detection to containing the problem.
Metadata: What two federating parties exchange: each side's web addresses and its certificate for checking signatures.
Metric: A number measured the same way every time so it can be compared over time, such as failed logins per hour or patch compliance.
MFA (multifactor authentication): Signing in with more than one kind of proof, such as a password plus a code or a security key. Dana sets it up on her first day, and the IdP enforces it for every service.
MIB (Management Information Base): The list of values an SNMP agent can report, each named by an OID.
Microsoft Entra ID: Microsoft's cloud identity service and identity provider. Its Global Administrator role controls the whole tenant.
Monitoring: Collecting data about your systems all the time, so that problems show up early. Monitoring data travels by protocols such as NetFlow, SNMP and syslog, and becomes alerts and dashboards.

N

Net-SNMP: An open source SNMP toolkit. Its snmpget command asks an agent for values; Alex used it with SNMPv3 authPriv to read the name, uptime and location of the lab switch sw1.
NetFlow: A Cisco-created protocol that reports who talked to whom, when and how much, as flow records without content. Version 5 has fixed fields; version 9 uses templates.
Network tap: A small hardware device placed in a network cable that copies every packet passing through, including damaged ones. Unlike a mirror port, it can't be changed remotely.
nfdump: An open source NetFlow collector and query tool. Alex used it to list lab flows and filter for the SYN-only flows of a port scan.
NIST (National Institute of Standards and Technology): The US agency that publishes SCAP and the Digital Identity Guidelines used for identity proofing.
NIST SP 800-63A-4: The US standard for identity proofing, finalized in July 2025. It defines the resolution, validation and verification steps and the three IALs.
NMS (network management system): Software, such as Zabbix, LibreNMS or PRTG, that discovers, maps and polls every network device, receives traps, compares readings with baselines and thresholds, and alerts. Because it holds credentials for every device, it is a high-value target.
noAuthNoPriv: The weakest SNMPv3 security level: a username only, with no authentication and no encryption.
NTFS: The Windows file system and its permission system. Over a network share, the stricter of the share and NTFS permissions applies.
NTP (Network Time Protocol): The protocol that keeps device clocks in agreement, so events in different logs can be put in order and Kerberos tickets aren't rejected for clock skew.

O

OASIS: The standards body that published SAML 2.0 in 2005.
OAuth (Open Authorization): An authorization framework (OAuth 2.0, RFC 6749) that lets a user give an app limited, expiring, scoped access to their data at another service without sharing their password, as when the label app reads shop orders.
OID (object identifier): The dotted numeric name of a value in an SNMP MIB. For example, 1.3.6.1.2.1.1.5.0 is the device's name.
OpenID Connect (OIDC): An identity layer built on OAuth 2.0 that adds an ID token saying who the user is. "Sign in with Google" uses it.
OpenLDAP: An open source directory server that speaks LDAP. Alex used it to build the lab directory holding Priya's entry.
OpenSCAP: A free SCAP scanner. Its oscap xccdf eval command checks a machine against an XCCDF profile and reports pass or fail for each rule.
Operational dashboard: A dashboard for people who handle alerts, like Alex. It updates in near real time with details such as alerts, affected devices and addresses.
Orphaned account: An account that still works after its owner has left, like Marco's forgotten shop login. Nobody notices it being used, which makes it a favorite way in.
ou (organizational unit): An LDAP label for a branch of the directory tree, such as ou=people or ou=groups.
OVAL (Open Vulnerability and Assessment Language): The SCAP part that describes how to check each rule on a machine, for example "this line must appear in this file".

P

Packet capture: Recording the full packets on a network, content included, usually with a packet analyzer. It shows what was sent, but only from the moment it starts, and it is too big to keep for months.
PAM (privileged access management): A tool that keeps privileged passwords in an encrypted vault, hands them out on request with approval, changes them after use and records admin sessions.
Pass-the-hash: Signing in with a stolen password hash instead of the password, often taken from a computer's memory. A longer password doesn't help against it; unique local passwords and tiered administration do.
Passive: Only receiving copies of traffic, as a tool on a mirror port or tap does. It can detect and alert but can't block.
Passkey: A sign-in credential based on a cryptographic key pair, kept on a device or hardware security key, that replaces a password and can't be phished by a fake site. Alex requires passkeys for all admin roles.
passwd -S: A Linux command that shows an account's password status: L means locked, P means a usable password.
Password synchronization: Copying one password into many systems. Each system still checks the password and the user types it each time, so it isn't true SSO.
Patch compliance: The percentage of devices that have all critical updates, a common dashboard metric showing exposure to known vulnerabilities.
Payload: The actual content of packets. Flow records don't contain it, so NetFlow shows that Sam's laptop sent 2 GB but not which files.
Permission: A rule that lets an account do one action on one resource, such as read, write or modify, execute, or full control.
Permission creep: The slow build-up of access as a person changes jobs and keeps the old access, like Priya's five groups from three jobs. The cure is to remove old access at every move and to hold regular access reviews.
Phishing: Tricking someone, usually by email, into giving up a password or running malware. It is the most common attack on user accounts.
Phishing-resistant MFA: MFA that a fake site can't trick out of a user, such as a passkey or a hardware security key. It is required for global admin and emergency accounts.
Ping: A simple network test that checks whether a device answers. An NMS often uses it alongside SNMP polling.
PKCE (Proof Key for Code Exchange): An addition to the OAuth authorization code flow (RFC 7636) that stops a stolen authorization code from being used by anyone else.
Polling: An SNMP manager or NMS asking each device for values on a schedule, sent to UDP port 161. It finds slow problems; traps report sudden events.
Port: A number that names a network service, for example 443 for HTTPS, 22 for SSH, 161 and 162 for SNMP, 514 for syslog and 389 for LDAP. Switches also have physical ports where cables plug in.
Port mirroring: A switch setting that sends a copy of traffic from source ports or a VLAN to a destination port where a monitoring tool such as an IDS listens. It is passive, and copies may be dropped when the switch is busy.
Port scan: Probing many ports on a target to find open services. In flow data it shows as one source sending one SYN-only packet to many destination ports in a row.
PowerShell: Microsoft's command-line shell and scripting language, used for example to disable an Active Directory account.
Priority (syslog): The number in angle brackets at the start of a syslog message, calculated as facility × 8 + severity. <36> means facility auth (4) and severity Warning (4).
Privacy (SNMPv3): The SNMPv3 protection that encrypts messages, using AES.
Privilege escalation: An attacker taking higher access through a flaw. It differs from permission creep, which is access given over time and never removed.
Privileged access workstation: A dedicated, locked-down computer used only for admin work, so email and browsing never touch admin accounts.
Privileged account: Any account with rights beyond a normal user's, such as changing settings, installing software or managing accounts. Alex keeps a separate "alex-admin" account apart from the daily "alex" account.
Profile (XCCDF): A named group of XCCDF rules for one kind of system, such as "web servers". You choose a profile when you run a SCAP scan.
Protocol: An agreed set of rules for how two systems exchange messages.
Provisioning: Creating an account and giving it the access the job needs. It should start from a trusted source such as HR, be approved, give one named account per person with least privilege, and set an end date for temporary staff.
Public and private keys: A matched pair of keys: the private key is kept secret and creates digital signatures, and the public key, shared in a certificate, checks them. A SAML IdP signs assertions with its private key, and service providers check them with its public key.

R

Redirect URI: In an OAuth request, redirect_uri is where the authorization code is sent back, and it should match an exactly registered address. The state value protects against forged requests.
Refresh token: An OAuth token that lets the app get new access tokens without asking the user again, until the user withdraws consent.
Report-only mode: A setting that makes a sign-in policy log what it would do without enforcing it. Alex switched the broken policy to this mode during the break-glass procedure.
Resolution: The first identity proofing step: collecting enough information, such as name, date of birth and address, to tell this person apart from everyone else.
Resource owner: The OAuth role for the person who owns the data and grants consent. In the label app example, that is Alex.
Resource server: The OAuth role for where the data lives, such as the shop's order API. It checks each token's validity and scopes.
Retention period: How long company policy keeps a disabled account and its data before deletion, for example 90 days.
RFC (Request for Comments): One of the numbered documents that define internet standards, such as RFC 5424 for syslog or RFC 6749 for OAuth 2.0. The IETF publishes them.
Rogue device: A device on the network that nobody approved, such as the consumer Wi-Fi router found in a meeting room socket. NMS discovery reveals them.
Role-based access control: Assigning access through groups that match job roles. Group assignment by role is the start of it.
root: The all-powerful administrator account on a Linux machine, which is a local privileged account. Give each server its own root password, or lock root and use sudo.
Root user (cloud): The account that owns a whole cloud account, such as the AWS (Amazon Web Services) root user. It is a global privileged account, locked away and used only for the few tasks that need it.
RSPAN (remote SPAN): A port mirroring variant that sends the copied traffic to a port on another switch over a VLAN.
rsyslog: A common Linux syslog server. Alex used one to receive the lab's test messages.

S

Same sign-on: Applications all checking the same directory account and password, usually by LDAP bind, so each person has one password everywhere but still types it into each app. It differs from true SSO, where services never see the password.
SAML (Security Assertion Markup Language): An open standard for sending signed XML assertions about a user from an identity provider to a service provider through the browser. It is the most common protocol for company web SSO and federation.
SCAP (Security Content Automation Protocol): NIST's suite of standards (XCCDF, OVAL, CVE, CPE, CCE, CVSS) that lets any validated scanner check systems against published checklists and report results in a standard format. It answers "how is it set up?".
SCIM (System for Cross-domain Identity Management): The standard protocol (RFC 7643 and 7644) an identity provider uses to create and disable accounts in other services automatically. When HR marks Dana as gone, her accounts are disabled everywhere.
Scope: A specific permission carried by an OAuth access token, such as "read orders" but not "issue refunds". Least privilege applies to scopes too.
Security domain: An area run under one set of accounts and rules, such as Kettle & Crane's IdP or a supplier's portal. Federation links separate security domains.
Separation of duties: Splitting sensitive tasks, such as adding suppliers and approving payments, between two people so that fraud needs two people to agree.
Service account: An account used by a program rather than a person, such as the backup software's account. It should have least privilege, no interactive sign-in, a managed password such as a gMSA, and monitoring.
Service provider (SP): A service that relies on an identity provider to sign users in instead of checking passwords itself, such as the shipping software or a supplier's portal.
Service ticket: A Kerberos ticket for one server, obtained by showing the TGT. Kerberoasting abuses service tickets.
Session: A signed-in state that continues without re-entering the password. Deprovisioning must end active sessions because disabling a password doesn't close one already open on a phone.
Severity: How serious a message or alert is. Syslog uses 0 (Emergency, most serious) to 7 (Debug); alerts use low, medium, high or critical.
sFlow: A flow data family that works by sampling, for example looking at one packet in every 1,000.
SHA-256: A hash algorithm that SNMPv3 uses to authenticate messages.
Share permissions: Permissions on a Windows network share (Read, Change, Full Control). They are checked along with NTFS, and the more restrictive of the two applies over the network.
Shared account: One login used by several people, such as "frontdesk" or "wholesale". It breaks accountability, so replace it with named accounts.
SIEM (security information and event management): The central tool that collects logs and events from many sources, correlates and searches them, and raises security alerts. An NMS watches device health instead.
Single sign-on (SSO): Signing in once at an identity provider and then reaching many services without signing in again, while the services never see the password. Because it concentrates trust, the IdP becomes a high-value target.
SNMP (Simple Network Management Protocol): The protocol that answers "is this device healthy?" by letting a manager poll devices on UDP 161 and receive traps on UDP 162. Versions 1 and 2c identify the manager with plain-text community strings.
SNMP agent: The SNMP agent is a small program in each managed device that reports values. The SNMP manager is the monitoring server that asks questions and receives traps.
SNMPv3: The secure version of SNMP, which identifies the manager by a username and password checked on every message instead of a plain-text community string. Set to the authPriv level, it both authenticates each message with a hash such as SHA-256 and encrypts it with AES, so it is the recommended choice for monitoring device health.
SolarWinds Orion: A widely used NMS platform. In 2020, attackers hid a backdoor in its updates and used it to break into selected targets, which shows why an NMS is a high-value target.
Source of truth: The authoritative record of who works at the company, which is HR. Account requests should start there, not from a chat message.
SP-initiated flow: The common SAML sign-in where the user starts at the service provider, which redirects the browser to the IdP and receives a signed assertion back through the browser. The SP and IdP never need to talk directly.
SPAN (Switched Port Analyzer): Cisco's name for port mirroring, set up with monitor session commands that name the source and destination ports. Many people say "SPAN port" for any mirror port.
SQL injection: An attack that inserts crafted input into a database query in SQL (Structured Query Language). LDAP injection works the same way against directory searches.
SSH (Secure Shell): Encrypted remote login, normally on port 22. sshd is the SSH server program that appears in the gateway's syslog line.
StartTLS: A way to begin an LDAP connection on port 389 and upgrade it to TLS before the bind, so the password is encrypted.
State change alert: An alert that fires when a device or service changes state, such as an SNMP linkDown trap from sw1 port 5.
STIG (Security Technical Implementation Guide): US Defense Department secure-configuration benchmarks, many of them published in SCAP format.
sudo: A Linux tool that lets permitted users run specific commands as root. A narrow rule, such as letting %shop-admins only restart shop.service, limits local privilege.
Switch: A network device that sends each packet only to the port where its destination is connected, so a monitoring tool on an ordinary port sees almost nothing without port mirroring.
Syslog: The standard way to send event messages, answering "what happened?", to a central log server (RFC 5424, classically on UDP 514). Each message starts with a priority built from a facility and a severity.
Syslog over TLS: Syslog sent over TLS on TCP port 6514 (RFC 5425), which confirms delivery and encrypts and protects the messages. Alex uses it to copy logs off every server.

T

TCP (Transmission Control Protocol): A transport protocol that sets up connections and confirms delivery.
TCP flags: Markers in TCP packets: SYN opens a connection, ACK acknowledges, PSH pushes data and FIN closes. SYN-only flows to many ports suggest a port scan.
Tenant: A company's own space in a cloud service, such as Kettle & Crane's Microsoft 365 tenant.
TGT (ticket-granting ticket): The signed Kerberos pass, valid for about 10 hours, that the KDC gives a user when they sign in. Their PC uses it to get service tickets.
Third-party account: An account for someone outside the company, such as a vendor technician, contractor or MSP. It should be named, least-privilege, time-limited or disabled until needed, MFA-protected and recorded.
Threshold: The number in an alert rule's condition, such as more than 10 failed logins for one account in 5 minutes. Crossing it triggers the alert.
Tiered administration: Separating admin accounts by how trusted the systems are. Global admins sign in only to tier 0 systems such as domain controllers, so their hashes and tickets are never left on ordinary machines.
Timeticks: An SNMP value type that counts hundredths of a second, so 305 means 3.05 seconds of uptime.
TLS (Transport Layer Security): The standard protocol for encrypting and protecting network connections, used by syslog over TLS, LDAPS and StartTLS.
Token revocation: Cancelling an OAuth app's tokens so it loses access. A password change doesn't do this, which is why Alex revoked the sales-reporting app's tokens.
Topology map: An NMS picture showing which device connects to which, with each device colored by its status.
Toxic combination: Permissions that are safe alone but dangerous together, such as creating suppliers and approving payments. They break separation of duties.
Trap: A message an SNMP agent sends to the manager on UDP port 162 as soon as something happens, without being asked, such as a port going down.

U

UDP (User Datagram Protocol): A transport protocol that sends without checking delivery, so messages can be lost. SNMP and classic syslog use it.
uid (user ID): An LDAP label for a user entry's name, as in uid=priya. In (uid=priya) it is also used as a search filter.
User account: A standard account for one person's everyday work, with no administrative rights. It is the most attacked account type and needs MFA and no local admin rights.
useradd: The Linux command that creates an account, with options for the home folder (-m), shell (-s), description (-c) and expiry date (-e). The --system option creates a system account with a low user number, as used for services.
usermod: The Linux command that changes an account. -aG appends a group (without -a, other groups are removed), -L locks the password and -e 1 sets the expiry to a date long past.

V

Validation: The identity proofing step that checks the evidence is genuine and accurate, for example that a license is real and not expired. A stolen real ID passes validation.
Verification: The identity proofing step that checks the person really owns the evidence, for example that the photo matches their face. A stolen ID fails here.
Vishing: Social engineering by phone, such as a caller pretending to be Sam and asking Priya for a reset code. The defense is to call back on the number on file.
visudo: The tool that edits and checks sudo rules files for mistakes. visudo -c reported the shop-admins file as "parsed OK".
VLAN (virtual local area network): A separate network that shares the same switches. Port mirroring can copy a whole VLAN's traffic.
Vulnerability scanner: A tool that looks for known weaknesses and names and scores them with SCAP parts such as CVE, CPE and CVSS. Kettle & Crane's scanner at 10.16.0.50 trips the failed-login rule during its Sunday scans.

W

Widget: One box on a dashboard, such as a counter, trend line, top list, status light or map.

X

XCCDF (Extensible Configuration Checklist Description Format): The SCAP part that holds the checklist: the rules, their titles and severities, grouped into profiles. It says what to check; OVAL says how.
XML (Extensible Markup Language): A text format with named tags. SAML messages and assertions are written in it.
xmlsec1: A free XML signing tool. Alex used it to sign Dana's assertion and to show that a tampered copy fails verification.