Glossary of common terms used in the Authentication, Authorization and Identity Management industry.
|
|
Web certificate errors occur in modern web browsers when some aspect of identity information is out of sync with the web site that is being browsed via HTTPS. |
|
Web Security for the Enterprise is usually accomplished via URL filtering, taking into account domain reputation and also scanning for potential malware and scripts. |
|
An Authentication Server is a piece of software and/or hardware that contains information and intelligence to determine if users are genuine and what rights that user has to use governed resources. |
|
Federated Identity is a system of credentials that are honored across web service and domain boundaries. Federation can form across business boundaries or within a business across service boundaries. |
|
Client Authentication usually refers to the act of authentication the client machine to a network service. Typically a user's machine would have an X.509 certificate installed for the user to ensure bidirectional authentication. Practically, users never purchase or install client side certificates due to cost and operational complexity. This is one of the major disappointments of the HTTPS protocol. |
|
A Man In The Middle (MITM) attack is a sophisticated attack where a fraudster hijacks a link from a user to a known web service such as retail banking web site. The fraudster relays information from the user to the web service and from the web service back to the user in such a manner that neither side knows that anything is wrong. |
|
Public Key Infrastructure (PKI) is classicly the best security available to the general public. |
|
Web Application Security refers to policies and procedures used to protect a web based asset from compromise, theft of data or defacement. |
|
Token-Authentication refers to one of two methods of authentication, hardware based multifactor or passing tokens across a network link that are derived from a shared secret. |
|
SecureID is the quintessential One Time Password token generator from RSA. A hardware key fob is issued to each user which rotates through new passwords periodically (eg once a minute). These are known to be subject to Man-In-The-Middle attacks, are expensive and operationally complex. Many older security experts still regard these as the gold standard, however. |
|
Identity-management refers to the lifecycle of managing one's identity with respect to an particular service or federated group of services. |
|
Secure-login describes the process of presenting authentication credentials to a web site to establish the identity of a user and to validate the authorization level of access that particular user is entitled to. |
|
|
|
|
|