IM-CCM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Identification

The act of a subject presenting a claimed identity, such as a username or email address, to a system before any proof is offered.

Authentication

The process of verifying that a subject's claimed identity is genuine, typically by validating one or more credential factors against stored data.

Authorization

The decision and enforcement of which resources an authenticated subject may access and what actions it may perform on them.

Least privilege

A principle stating each subject receives only the minimum permissions necessary for its current task, reducing the impact of compromise or error.

Separation of duties

A control that divides a sensitive process among multiple subjects so no single identity can complete a high-risk transaction alone.

Role-based access control

An access model where permissions are assigned to roles and users receive permissions by being placed into those roles.

Joiner-mover-leaver

The identity lifecycle model covering provisioning at hire, entitlement adjustment during role change, and revocation at departure.

Orphaned account

An account still active after its owner has left or changed roles, lacking a valid owner and a common audit finding.

Access certification

A periodic review in which managers or resource owners confirm that each identity's entitlements remain justified and remove those that do not.

Role mining

An analysis technique that derives candidate roles from patterns in existing entitlement assignments rather than designing roles from business functions.

Entitlement creep

The gradual accumulation of excess access as users change roles and retain old permissions, corrected by periodic review and least privilege.

Authoritative source

The system of record, often HR, that originates identity attributes which downstream applications consume rather than create independently.

Multi-factor authentication

Authentication using two or more factors drawn from different categories such as knowledge, possession, and inherence, resisting single-factor compromise.

Single sign-on

A mechanism where one authentication event establishes a session or token that grants access to multiple applications without re-entry.

Password salting

Adding unique random data to each password before hashing so identical passwords produce different hashes and precomputed tables fail.

Session timeout

A control that terminates an authenticated session after a defined idle period or absolute duration, limiting misuse of unattended sessions.

OpenID Connect

An authentication layer built on OAuth 2.0 that issues a signed identity token describing the authenticated user to the relying party.

Step-up authentication

Requiring an additional authentication factor at the moment of a sensitive action, raising assurance above the session's initial level.

Credential vaulting

Storing privileged credentials in an encrypted repository where access is checked out, time-bound, and logged rather than shared openly.

Just-in-time privilege

Granting elevated rights only for a defined window when needed and automatically revoking them afterward, reducing standing administrative access.

Break-glass account

An emergency privileged account used when normal access fails; its use should trigger alerts and mandatory post-incident review.

Service account

A non-human identity used by applications or scripts, often with non-expiring credentials and broad rights, requiring inventory and rotation.

Privileged session recording

Capturing commands and screen activity during administrative sessions to provide accountability and forensic evidence for critical systems.

Identity federation

A trust relationship where an identity provider authenticates users and a relying party accepts those assertions across organizational boundaries.

SAML assertion

A signed XML statement from an identity provider about a user's authentication and attributes, validated by the service provider before trust.

Cloud role assumption

Obtaining temporary scoped credentials by assuming a cloud IAM role, avoiding long-lived access keys stored in applications.

Workload identity federation

A method letting services or pipelines exchange platform-issued tokens for short-lived cloud credentials instead of storing static secrets.

Inherent versus residual risk

Inherent risk is exposure before controls operate; residual risk is what remains after preventive and detective controls are applied.

Control types

Preventive controls block events, detective controls identify them, and corrective controls remediate; each addresses a different point in the risk timeline.

Audit evidence

Artifacts such as access review sign-offs, logs, and approval records that are complete, timely, and attributable to support compliance conclusions.

Dormant account

An enabled identity that has not authenticated within a defined period, representing unused exposure and a frequent governance metric.

Non-repudiation

The assurance that an actor cannot credibly deny an action, supported by attributable, integrity-protected audit logs of authentication and privileged activity.