Delinea Secret Server flashcards
Delinea Secret Server · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Secret Template
- Defines the fields, launcher, and password requirements for a class of secrets; every secret is created from exactly one template and inherits its field structure.
- Data Encryption Key
- A per-secret key that encrypts the secret's sensitive fields; the DEK is itself protected by master key material, which the application key protects.
- Application Key
- A file generated at install that protects master key material; it is required to decrypt the database and must be backed up separately from it.
- Secret Policy
- Enforces settings such as password complexity, rotation interval, and heartbeat behavior across folders or the site; the most specific applicable policy wins.
- DoubleLock
- An optional second encryption layer requiring an additional password to reveal a secret, independent of the user's normal login credentials.
- Folder Inheritance
- Child folders inherit parent ACLs unless inheritance is explicitly broken; breaking it replaces inherited grants with the child's own ACL.
- List Permission
- Lets a user see that a folder and its secret names exist without revealing secret values; View permission is required to see a value.
- Effective Access
- The intersection of a user's role permissions and the folder or secret ACL grants; a user needs both a permitting role and an object grant.
- Secret Check-Out
- Locks a secret to one user for a configured period; other users see it as checked out until check-in or expiry.
- Require Approval Workflow
- Routes access requests to designated approvers; the requester gains temporary access only after all required approvals, expiring per configured duration.
- Session Recording
- Captures screen video and keystrokes for sessions launched through Secret Server; recording depends on using a proxied launcher.
- Remote Password Changing
- Rotates a credential on the target system via a dependency, updating the stored secret; heartbeat separately verifies the stored password still works.
- Dependency
- Defines how Secret Server changes a password on a specific target system type; a mismatch between dependency and target causes rotation failure.
- Credential Injection
- Passes the password to the target during a proxied session so the user never sees it, reducing exposure and credential sharing.
- Audit Log
- Records events such as secret views, edits, check-outs, permission changes, and logins, capturing user, timestamp, action, and target.
- Heartbeat
- A scheduled check that verifies the stored credential still authenticates to the target; failures flag secrets as stale for rotation.
- AD/LDAP Synchronization
- Maps directory users and groups into Secret Server; group sync drives role and folder membership, and broken sync stalls access changes.
- Disaster Recovery Backup
- Requires both the database backup and the application key; restoring without the key leaves secrets unreadable.
- Secret Versioning
- Retains prior values of a secret for recovery and audit; viewing history is a permissioned action and each view is audited.
- Distributed Engine
- A component that reaches target systems to perform password changes and heartbeat; it shares the database and must use the same application key.
- Folder Owner
- Grants administrative control of a folder's ACL and contents, distinct from site-wide admin roles; enables delegated administration.
- Secret-Level Exception
- A per-secret permission override that can grant or deny access differently from the folder; review these during access reviews.
- Group-Based Grants
- Folder access granted to directory or local groups rather than individuals; simplifies reviews and removes access automatically when membership changes.
- Proxied RDP Session
- An RDP session routed through Secret Server so it can be recorded; direct RDP sessions bypass recording entirely.
- SSH Proxy
- Routes SSH sessions through Secret Server, injecting target credentials so the user does not type the password and the session can be recorded.
- Active Sessions Report
- Shows current proxied sessions and check-outs with user, target, and start time, supporting oversight and incident response.
- Recording Access Permission
- A permission separate from secret access that lets auditors review session recordings without the ability to reveal live secrets.
- Password Change Status Report
- Identifies secrets whose last rotation failed or is overdue; acting on failures prevents lockouts and stale credentials.
- SIEM Export
- Sending audit data to a SIEM for retention beyond the in-product window and correlation with other systems.
- Role Permission
- A site-wide capability such as administering users, roles, or configuration; it is separate from folder ACLs and both are needed for access.
- Recycle Bin
- Where deleted secrets go before permanent deletion; restoration is possible, and permanent deletion requires permission and is audited.
- Password-Type Field
- The template field designated to hold the password; Remote Password Changing and heartbeat operate only on this field.