CIIM flashcards
CIIM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Orphaned account
- An account with no active authoritative owner, typically left after a leaver event or failed reconciliation. It is a governance metric because nobody certifies its access.
- Segregation of duties conflict
- A combination of entitlements letting one identity both perform and approve or conceal a sensitive transaction. Preventive controls block assignment; detective controls flag existing conflicts.
- Access certification campaign
- A time-bound review where managers or application owners confirm, revoke, or remediate each identity's entitlements, producing audit evidence of periodic access validation.
- Role mining
- Analysis of existing entitlement assignments to derive candidate roles. Results are validated through role engineering to ensure least privilege before adoption.
- Authoritative source
- The trusted system of record for an identity population, such as HR for employees or a contractor registry, from which downstream directories reconcile identity attributes and lifecycle state.
- Entitlement creep
- Accumulation of access rights when an identity changes roles and retains previous entitlements. Mover-triggered re-certification and periodic reconciliation counter it.
- Attribute-based access control
- A policy model evaluating subject, resource, action, and environment attributes at request time. It is more dynamic than static roles but depends on trustworthy attribute sources.
- FIDO2 WebAuthn
- A public-key authentication standard where the private key stays in the authenticator and signatures are bound to the origin, making credential phishing ineffective.
- OAuth 2.0 authorization code flow
- A delegation flow where the client receives an authorization code and exchanges it for tokens. With PKCE it is the recommended choice for public clients.
- OpenID Connect ID token
- A signed JWT issued alongside OAuth tokens that carries authentication claims, including the subject identifier and how and when the user authenticated.
- SAML assertion
- A signed XML statement from an identity provider to a service provider containing authentication, attribute, or authorization statements, validated against the IdP certificate and conditions.
- Authenticator assurance level
- A NIST SP 800-63B tier: AAL1 single-factor, AAL2 multi-factor with replay resistance, AAL3 hardware cryptographic authenticator with verifier impersonation resistance.
- Privileged access management
- Controls for administrative accounts including credential vaulting, just-in-time elevation, session brokering, and session recording, reducing standing privilege exposure.
- Continuous access evaluation
- A zero-trust mechanism that re-evaluates active sessions on new signals such as credential revocation or device posture change, rather than waiting for token expiry.
- Session fixation defense
- Rotating the session identifier at authentication and privilege change prevents an attacker who pre-set a session ID from hijacking the authenticated session.
- Envelope encryption
- A scheme where a data encryption key encrypts data and a key encryption key wraps that key, so rotating the KEK avoids re-encrypting the full dataset.
- Tokenization
- Replacing a sensitive value with a non-sensitive token mapped in a protected vault. Unlike encryption, the token has no mathematical relationship to the original value.
- Password hashing with Argon2id
- A salted, memory-hard key derivation function for storing passwords, resisting GPU cracking. Plain fast hashes such as SHA-256 are unsuitable for password storage.
- Pseudonymization
- Replacing direct identifiers with pseudonyms so data can be re-linked only with additional information. Under GDPR it remains personal data.
- Data loss prevention
- Policy enforcement inspecting content and context across data in motion, at rest, and in use, using regex, fingerprints, or classifiers to block or alert on sensitive transfers.
- Crypto-shredding
- Destroying encrypted data by irreversibly deleting its keys, making ciphertext unrecoverable. It is used for verifiable disposal in cloud and distributed storage.
- TLS for data in transit
- Transport encryption using TLS 1.2 or 1.3 with certificate validation and HSTS, protecting data between client and server from interception and tampering.
- Impossible travel
- A risk signal flagging two authentications from locations whose distance divided by elapsed time exceeds plausible travel speed, suggesting credential compromise.
- Step-up authentication
- Raising authentication assurance at the moment of elevated risk, for example challenging a single-factor session for a second factor, instead of blocking access outright.
- User behavior analytics
- Modeling each identity's normal access patterns and scoring deviations. High scores trigger step-up authentication, session restriction, or investigation.
- Identity risk score
- A normalized value combining likelihood and impact, typically from signal severity, identity privilege level, and asset sensitivity, mapped to thresholds that trigger defined responses.
- Credential exposure monitoring
- Comparing identity identifiers against breach corpora to detect leaked credentials. A match triggers forced password reset and credential re-enrollment.
- Dormant account policy
- A rule disabling identities after a defined inactivity period, such as 90 days, and deleting them later, reducing attack surface from unused credentials.
- Credential stuffing
- Automated reuse of breached username and password pairs across many sites. Defenses include breached-password screening, rate limiting, bot detection, and MFA.
- Account takeover chain
- The sequence from credential acquisition through validation, access, persistence such as MFA enrollment, and monetization. Controls should disrupt each stage.
- Identity proofing IAL2
- A NIST SP 800-63A level requiring evidence collection and verification plus either biometric comparison or address verification, typically performed remotely or in person.
- MFA fatigue attack
- Repeated push notifications hoping the user approves one. Number matching, rate limiting, and phishing-resistant authenticators mitigate it.