Aruba Network Security Professional key terms

A framework that verifies who a user or device is, determines what resources they may use, and records what they did. Network access servers apply these three functions in sequence for each connection attempt.

A UDP-based client-server protocol that carries authentication, authorization, and accounting data between a network access device and a central policy server. Messages are protected by a shared secret between the two peers.

The network device, such as a controller, switch, or access point, that acts as a RADIUS client and enforces access decisions for connecting endpoints. It forwards credentials to the policy server and applies the returned attributes.

A flexible framework for carrying authentication methods inside other protocols such as RADIUS or 802.1X. It defines message exchange types but leaves the actual credential verification method to specific EAP methods.

An EAP method in which both the client and the server present X.509 certificates to authenticate each other. It provides strong mutual authentication and is resistant to password theft but requires a certificate infrastructure.

An EAP method that first establishes a TLS tunnel using a server certificate, then authenticates the client inside that tunnel with another method such as MS-CHAPv2. It protects user credentials in transit without requiring client certificates.

An IEEE standard for port-based network access control that uses EAP exchanges to authenticate a supplicant before granting network access. Until authentication succeeds, the port or wireless association is restricted.

The client software on an endpoint that responds to 802.1X authentication requests and supplies credentials. It initiates the EAP exchange with the network's authenticator.

In 802.1X, the network device that controls access to the network and relays EAP messages between the supplicant and the authentication server. It enforces the final allow or deny decision on the port.

An Aruba network access control platform that centralizes authentication, authorization, and device profiling. It evaluates policy rules against collected attributes and returns enforcement decisions to network devices.

The process of attaching a named role to a user or device session based on policy evaluation results. The role then drives which firewall policies, VLANs, or access rights apply to that session.

An access model in which permissions are granted to roles rather than to individual users or devices. Subjects are mapped to roles, and the role's policy determines allowed traffic and resources.

A policy step that determines which role a connecting endpoint receives, typically by evaluating attributes such as group membership, device type, or location. The mapped role is then used for enforcement.

A set of actions returned by the policy server to the network device when a session is authorized, such as VLAN assignment, role assignment, or downloadable access control lists. It translates policy decisions into device configuration.

An Aruba component that provisions devices with certificates so they can authenticate using certificate-based methods. It automates enrollment and distribution of client credentials for managed endpoints.

An Aruba endpoint agent that checks health and posture conditions such as patch level, antivirus status, and firewall state before or after network access is granted. Results feed into policy decisions.

The evaluation of an endpoint's security state, including software versions and protective controls, against a defined policy baseline. Noncompliant endpoints may be quarantined or remediated before full access.

The process of bringing a noncompliant endpoint into compliance, such as installing updates or enabling required software. Access may be limited to remediation resources until the endpoint meets policy.

A restricted network segment to which endpoints are placed when they fail authentication or posture checks. It typically allows only remediation or registration traffic and blocks normal corporate resources.

The dynamic placement of an authenticated session into a specific virtual LAN based on policy results. It segments traffic so that different user or device classes reach only their permitted network resources.

The identification of an endpoint's type and operating system by inspecting characteristics such as DHCP options, MAC address organizationally unique identifiers, and user agent strings. Profiles inform access policy for unknown or unmanaged devices.

An access method that uses a device's MAC address as its credential, typically for devices that cannot run 802.1X supplicants. Because MAC addresses can be spoofed, it is usually combined with profiling or other controls.

An Aruba wireless feature that lets different clients or device groups use distinct pre-shared keys on the same SSID. Each key can map to a separate role and set of permissions, improving segmentation over a single shared key.

A static secret shared among wireless clients to derive encryption keys during association. It provides no per-user identity, so compromise of the key affects every device using it.

The password-based authentication handshake used in WPA3-Personal that resists offline dictionary attacks and provides forward secrecy. It replaces the older four-way handshake key derivation used with WPA2 pre-shared keys.

A Wi-Fi security certification that adds stronger password-based authentication, protected management frames, and improved encryption for open networks. It supersedes WPA2 for new deployments.

A Wi-Fi feature that cryptographically protects certain management frames against forgery and spoofing. It mitigates deauthentication and disassociation attacks that disrupt client connections.

A denial-of-service technique in which forged management frames terminate client associations with an access point. Repeated disconnections can force clients onto attacker-controlled networks or disrupt service.

A fraudulent access point that imitates a legitimate SSID to lure clients into connecting. Once associated, victims may be subjected to credential capture or traffic interception.

An unauthorized access point connected to an organization's network without approval. It can bypass perimeter controls and expose internal resources to unauthorized wireless clients.

Monitoring of the radio spectrum for suspicious wireless activity such as rogue devices, spoofed SSIDs, and attack signatures. Alerts help security teams investigate and respond to wireless threats.

A system that detects wireless threats and can automatically take countermeasures, such as containing a rogue device. It extends detection with active response capabilities.

An active defensive action in which access points send spoofed frames to disrupt a rogue or unauthorized wireless device. It is used cautiously because it can affect nearby legitimate clients.

The validation of server certificates presented during EAP-TLS or PEAP exchanges to confirm the authentication server's identity. Without it, clients may be tricked into trusting an impostor server.

A preconfigured value known to both a RADIUS client and server that protects message integrity and authenticates the peers. Weak or reused secrets undermine the trust of the authentication exchange.

An authentication approach in which a digital certificate issued by a trusted authority proves a party's identity. It avoids transmitting reusable passwords and supports strong mutual verification.

A security principle that gives users and devices only the access necessary to perform their intended tasks. Applying it limits the impact of compromised accounts or endpoints.

A security model that treats no network location as inherently trusted and verifies every access request. It emphasizes continuous authentication, least privilege, and microsegmentation rather than perimeter-only defenses.

The division of a network into isolated zones to limit how far traffic and threats can spread. Enforcement may use VLANs, roles, or firewall policies between zones.

Fine-grained segmentation that isolates individual workloads or user sessions rather than broad network zones. Policies are typically applied close to the endpoint or session using identity-based rules.

A class of attacks against the WPA2 four-way handshake that can force reuse of encryption keys and allow traffic decryption. Patching clients and access points mitigates the vulnerability.

The recording of session activity such as start time, stop time, and data volume for authenticated users. These records support auditing, billing, and forensic investigation.

A standard protocol for forwarding log messages from network devices to a central collector. Centralized logs aid correlation, retention, and incident investigation across many devices.

A platform that aggregates, correlates, and alerts on log and event data from many sources. It helps analysts detect patterns and investigate security incidents across the environment.

The structured process of preparing for, detecting, containing, eradicating, and recovering from security incidents. Lessons learned afterward feed back into improved controls and procedures.

A typed value carried in RADIUS messages that conveys identity, authorization, or session information. Vendors define custom attributes to pass role, VLAN, or policy details to network devices.

A RADIUS mechanism that lets the policy server push updated authorization to a device mid-session. It can re-role or disconnect a client when posture or policy changes.

A web-based login page presented to clients before network access is granted. It can collect credentials, display policy notices, or trigger device registration workflows.

A controlled network service for visitors that provides limited connectivity after registration or sponsorship. It is typically isolated from internal resources and time-limited.

A TCP-based protocol that separates authentication, authorization, and accounting and is commonly used to control administrative access to network devices. It encrypts the full payload of each message.