IM-CCM key terms

A digital representation of a person, service, or device that a system can recognize and act upon. It typically consists of attributes and a unique identifier used during authentication and authorization decisions.

Any entity that can be authenticated and granted access, such as a user account, service account, application, or device. Access policies are evaluated against the principal making a request.

The process of verifying that a claimed identity is genuine, usually by checking a credential such as a password, certificate, or biometric. It answers the question of who the requester is.

The process of deciding what an authenticated identity is permitted to do, based on policies, roles, or attributes. It answers the question of what access should be granted.

A principle stating that identities should receive only the minimum access needed to perform their duties, for only as long as needed. It reduces the potential damage from compromised or misused accounts.

A control that divides sensitive tasks among multiple identities so no single person can complete a high-risk action alone. It prevents fraud and errors by requiring independent approval or execution.

A system that creates, maintains, and authenticates identities and issues assertions about them to other parties. It is the authoritative source of authentication for federated applications.

An application or system that relies on an identity provider to authenticate users and receives identity assertions from it. It trusts the identity provider's assertions to grant access.

An arrangement where separate organizations or systems trust each other's authentication and share identity information using standards. Users can access resources across domains without separate credentials.

An authentication capability that lets a user log in once and access multiple applications without re-entering credentials. It improves usability but concentrates risk if the primary session is compromised.

Authentication that requires two or more independent evidence types, such as something you know plus something you have. It reduces risk from stolen passwords by requiring additional proof of identity.

A technique that requests stronger or additional authentication when a user attempts a higher-risk action or accesses sensitive resources. It applies extra verification only when context demands it.

An approach that adjusts authentication requirements based on contextual signals such as device, location, time, and behavior. Higher-risk signals trigger stronger verification while low-risk access stays frictionless.

An access model where permissions are assigned to roles and identities receive access by being placed in roles. It simplifies administration by managing entitlements at the role level rather than per user.

An access model that grants or denies access based on attributes of the user, resource, action, and environment evaluated against policies. It supports fine-grained, context-aware authorization decisions.

The component that evaluates access policies and returns an authorization decision, such as permit or deny. It is consulted by enforcement components before access to a resource is allowed.

The component that intercepts access requests and enforces the decision returned by the policy decision point. It sits between the requester and the protected resource.

A specific permission or access right granted to an identity for a resource, such as read access to a folder. Entitlements are collected, reviewed, and revoked as part of access governance.

The stages an identity passes through from creation to deactivation, including provisioning, maintenance, review, and termination. Managing the lifecycle ensures access stays accurate as people change roles or leave.

The process of creating accounts and granting entitlements to identities, often automated from an authoritative source. Deprovisioning removes access when it is no longer needed.

The trusted system of record that holds the master data about identities, such as an HR system. Provisioning and governance processes rely on it to determine who should have access.

A periodic review where managers or resource owners confirm that identities still need their existing access. Unconfirmed or inappropriate entitlements are flagged and revoked to maintain least privilege.

The policies, processes, and technologies that ensure access rights are appropriate, auditable, and compliant throughout the identity lifecycle. It includes reviews, approvals, and reporting on who has what access.

A set of controls for securing accounts and credentials with elevated or administrative rights. It typically includes vaulting, session monitoring, and just-in-time elevation to reduce misuse and breach impact.

An account with elevated permissions that can change system configurations, access sensitive data, or administer other accounts. These accounts are high-value targets and require stricter controls than standard user accounts.

A secured repository that stores and controls access to passwords, keys, and secrets, often with check-out and rotation features. It limits exposure of credentials by keeping them hidden from users and applications.

A model that grants elevated permissions only for a limited period when needed, then automatically removes them. It reduces standing privilege and the window for misuse of administrative rights.

A non-human account used by an application, service, or automated process to access resources. These accounts often have long-lived credentials and need careful ownership and rotation management.

The practice of securely storing, distributing, rotating, and auditing secrets such as API keys, tokens, and passwords. It prevents hard-coded or exposed credentials from becoming security weaknesses.

The scheduled or event-driven replacement of credentials and keys to limit the useful life of a compromised secret. Automation helps rotate secrets without disrupting dependent applications.

A signed XML statement from an identity provider that conveys authentication and attribute information about a user to a service provider. It is a common basis for federated single sign-on.

An identity layer built on OAuth 2.0 that lets clients verify a user's identity and obtain basic profile information via an ID token. It is widely used for federated login and single sign-on.

An authorization framework that lets applications obtain limited access to resources on behalf of a user using tokens, without sharing passwords. It is about delegated authorization, not user authentication.

A credential issued to a client that grants access to protected resources for a defined scope and lifetime. It is presented to resource servers to authorize API requests.

A long-lived credential used to obtain new access tokens without requiring the user to authenticate again. Because it is powerful, it must be stored securely and protected against theft.

A defined set of permissions requested by or granted to a client in an authorization protocol. Scopes limit what an access token can do, supporting least privilege for delegated access.

A configured link in which one system accepts identity assertions or credentials from another. Trust relationships underpin federation and must be carefully scoped and monitored.

An access decision approach that considers environmental factors such as device health, location, and network when granting access. It enables dynamic, risk-aware enforcement beyond static roles.

Authentication that varies its strength according to an assessed risk score for the login attempt. Low-risk sessions face fewer challenges, while suspicious activity triggers additional verification.

A chronological record of security-relevant events such as logins, access grants, and configuration changes. It supports investigation, accountability, and evidence of compliance with controls.

A compliance-oriented control ensuring conflicting responsibilities are assigned to different identities to prevent undetected errors or fraud. It is assessed during access reviews and role design.

A documented evaluation of whether identities hold appropriate access, performed periodically or after significant changes. Findings drive remediation such as revocation and policy updates.