# Glossary

> PAM SIM is an independent educational simulator. It is not affiliated with, endorsed by, or derived from any commercial privileged access management product, and it is not a substitute for one. It never connects to a real system, never executes a real command, and never stores a real password. Every account, host, identity and credential named in it is invented. It uses the standard vocabulary of the field because that is the vocabulary a real deployment and a real interview use.

219 terms. Where a vendor uses a different name for the same thing, the definition says so.

## Security and identity — the discipline the platform belongs to

- **PAM** (Privileged Access Management) — The discipline of securing, controlling and auditing accounts that hold elevated rights over systems and data. One of the three pillars of IAM, alongside IGA and AM.
- **IAM** (Identity and Access Management) — The umbrella discipline, usually split three ways: IGA for the identity lifecycle, AM for authenticating ordinary users, and PAM for privileged credentials. At a bank each is normally a separate team, and PAM is a subset of IAM rather than a synonym for it.
- **AM** (Access Management) — The authentication pillar: single sign-on, multi-factor, federation over SAML and OIDC, adaptive or risk-based access, and session management for ordinary users. AM decides whether you are who you say you are; PAM decides what you may do once you hold elevated rights. PAM SIM does not simulate AM — there is no sign-in at all, and the identity switcher is a demo convenience rather than authentication.
- **IGA** (Identity Governance and Administration) — The lifecycle pillar: joiners, movers and leavers, provisioning and deprovisioning, access review campaigns, recertification and segregation-of-duties rules. IGA decides whether an identity should have access at all, and asks again periodically. A leaver process that fails to strip safe membership is an IGA failure that surfaces on the privileged side.
- **SSO** (Single sign-on) — Authenticating once and reaching many applications without re-entering credentials. An AM function. Relevant to privileged access because the portal itself usually sits behind it — so an SSO outage stops privileged work even though the vault is healthy.
- **MFA** (Multi-factor authentication) — Requiring more than one kind of evidence — something known, held or inherent. Delivered by AM rather than by the PAM platform, though privileged access policy commonly requires it and can refuse identities that have not enrolled.
- **Federation** — Trusting another organisation's or service's authentication rather than holding your own credential for the user, carried over SAML or OIDC. It is how a workforce identity provider signs users into the privileged portal, and the same mechanism a CI pipeline uses to authenticate a workload without a stored secret.
- **JIT** (Just-in-time access) — Granting privilege only for the moment it is needed and removing it automatically afterwards.
- **ZSP** (Zero Standing Privileges) — A model in which no identity holds privileged entitlements at rest; all privilege is granted dynamically and expires.
- **TEA** (Time, Entitlements, Approvals) — The three variables that bound a dynamic privilege grant: how long, over what, and authorised by whom.
- **Least privilege** — Granting an identity the minimum rights required to perform its function, and no more.
- **Standing privilege** — Permanent membership of a privileged group — convenient, and the main enabler of lateral movement after a compromise.
- **Golden ticket** — A Kerberos ticket-granting ticket forged with the krbtgt account's key, letting an attacker mint credentials for any identity in the domain. Remediation is to reset krbtgt twice with replication allowed to finish in between — one reset leaves the previous key valid.
- **Pass-the-hash** — Authenticating with a stolen NTLM hash without ever knowing the password. Over-pass-the-hash extends it by exchanging the hash for a Kerberos ticket, which is how a single compromised host becomes domain-wide access.
- **Lateral movement** — Using access on one system to reach another, typically with credentials found in memory on the first. Rotating credentials and brokering sessions both exist to break this chain.
- **Hardcoded credential** — A privileged password written into a config file, script or source repository. It never rotates, because rotating it breaks the application — so it is old, widely copied, and outside every control the vault provides. Removing these is what application credential management is for.
- **Workload identity** — Proving what a non-human consumer is without giving it a secret first. The platform vouches: Kubernetes signs a service-account token, AWS confirms which role signed a request, an OIDC provider signs a token for one pipeline run. This is the answer to the bootstrapping problem.
- **SIEM integration** — Forwarding privileged events and detections to the enterprise SIEM. The division of labour: the analytics component understands privileged context and detects, the SIEM correlates that with endpoint and network evidence.
- **SoD** (Segregation of duties) — The requirement that no single person can both request and authorise the same privileged access. The control that makes dual control meaningful rather than procedural.
- **Risk score** — A numeric summary of exposure, computed here from privilege level, password age, usage, session anomalies and policy violations.
- **RBAC** (Role-Based Access Control) — Assigning permissions to roles and roles to users, rather than granting permissions to individuals directly.
- **Session risk score** — A 1–100 score for a session or an individual command: 70–100 High, 30–69 Medium, 0–29 Low. A session takes the score of its riskiest activity.
- **Tier 0** — The class of assets whose compromise means the whole environment is compromised: domain controllers, the identity provider, backup infrastructure, hypervisors — and the vault itself. Tier 0 systems are administered only from equally trusted hosts, which is why a privileged access workstation exists.
- **4624** (An account was successfully logged on) — The Windows Security event recording a successful authentication, with the account, source address and logon type. What a brokered session produces on the target — and what it is missing is the point: the target sees the shared administrative identity, not the person. A 4624 with no matching vault retrieval is privileged access that bypassed the vault.
- **4625** (An account failed to log on) — A failed authentication, carrying a status code that says why: bad password, disabled account, expired password. After a rotation, a repeating 4625 from one host is how you find the stale dependency nobody mapped.
- **4672** (Special privileges assigned to new logon) — Written when a logon holds sensitive privileges such as SeDebugPrivilege or SeBackupPrivilege. It pairs with the 4624 immediately before it, and it is the efficient filter when you want administrative logons rather than all logons.
- **4740** (A user account was locked out) — The lockout event, written on the domain controller that processed it. The caller computer name is the field that matters — it names the host still authenticating with the old password, which is what you must fix before reconciling, or the lockout cycle simply restarts.
- **4724** (An attempt was made to reset an account's password) — A password reset performed by another account rather than changed by the account itself. What a CPM change or reconcile looks like from the target's side — and a 4724 against a managed account with no matching CPM job means someone reset it outside the platform and the vault is now out of sync.
- **4728** (A member was added to a security-enabled global group) — Group membership changed; 4732 is the local-group equivalent and 4756 the universal one. This is how privilege is actually granted in Active Directory and how it quietly accumulates. An unexpected addition to Domain Admins is an incident until proven otherwise.
- **4688** (A new process has been created) — Process creation, with the parent process and — where command-line auditing is enabled — the full command line. What turns 'someone had an administrative session' into 'here is what they ran'. Off by default, so its absence is a common gap between what an investigation needs and what exists.
- **1102** (The audit log was cleared) — Somebody cleared the Security log. It cannot be suppressed and is written even when the rest of the log is gone. Close to self-evidently malicious on a production server — and much less effective than the person doing it expects, if sessions are recorded and logs are forwarded off-host.
- **Logon type** — The field on a logon event saying how the authentication happened: 2 interactive at the console, 3 network (a service or a remote share), 10 RemoteInteractive (RDP). It is what separates a person at a keyboard from a service account authenticating in the background.
- **Kerberos** — The default Windows domain authentication protocol. A domain controller issues a ticket-granting ticket at logon, which is exchanged for service tickets to reach individual services. PAM cares because the tickets and the signing keys are exactly what the well-known attacks steal.
- **TGT** (Ticket-granting ticket) — The Kerberos ticket issued at logon and exchanged for service tickets. Forging one with the krbtgt key is the golden ticket attack, which is why krbtgt is the single most sensitive password in a domain.
- **Kerberoasting** — Requesting a service ticket for an account with an SPN and cracking it offline. It needs no special privilege, so it is one of the first things an attacker with any domain foothold tries. Long random passwords, group managed service accounts and vaulting are the answers.
- **NTLM** — The legacy Windows authentication protocol, still present as a fallback. Relay- and hash-replay-prone, which is what makes pass-the-hash possible. Where NTLM still fires, that exposure is live — so finding out where it is still used is a real piece of work.
- **DCSync** — Abusing directory replication rights to ask a domain controller for password hashes, including krbtgt, without ever touching the box. It looks like legitimate replication traffic, which is why the detection is about who is asking rather than what is being asked.
- **Silver ticket** — A forged service ticket signed with a single service account's key, granting access to that one service. Quieter than a golden ticket because it never contacts a domain controller — and correspondingly harder to spot.
- **CIA triad** (Confidentiality, integrity, availability) — Prevent unauthorised disclosure, prevent unauthorised modification, keep systems and data there when needed. Privileged access mostly defends the first two — and the disaster recovery vault exists because the platform is itself an availability dependency.
- **Tokenization** — Replacing a sensitive value with a non-sensitive stand-in mapped elsewhere. Together with masking — hiding part of a value for display — it shrinks where real data lives, and with it the scope an auditor has to test.
- **Hashing** — A one-way transformation with no decryption, which is what separates it from encryption. Salting adds unique random data before hashing so identical passwords do not produce identical hashes and precomputed tables do not work.
- **Encryption at rest** — Protecting stored data, as opposed to encryption in transit, which protects data crossing a network over TLS. Name both when asked how data is protected — answering with only one is the tell.
- **PEDM** (Privilege Elevation and Delegation Management) — The category name for elevating specific actions rather than granting standing administrative rights. Vaulting protects shared credentials; this is what handles the everyday local-administrator problem.
- **Authentication** — Establishing who you are. Distinct from authorisation, which is what you may do once that is settled. Signing in to the privileged portal is authentication; being permitted to reach the Windows production safe is authorisation — and naming which one a failure belongs to is half of diagnosing it.
- **Authorisation** — Deciding what an authenticated identity may do. In privileged access it is expressed twice over: the role decides what kind of action is possible at all, and safe membership decides which resources it applies to. Both must permit.
- **Phishing resistance** — The dividing line between factors, and it is not the form factor. Push and one-time codes are phishable: a relay proxy captures and replays them in real time, and a push approval carries no information about where the request came from. A hardware one-time-password fob is hardware and still phishable. Number matching mitigates blind approval without binding to origin.
- **MFA fatigue** — Repeated push prompts until the user approves one out of irritation. Mitigated by number matching, rate-limiting prompts and alerting on repeated denials — and solved, for privileged identities, by moving them to phishing-resistant factors entirely.
- **ABAC** (Attribute-Based Access Control) — Deciding access from attributes of the identity, resource, environment or context rather than from role alone. In practice enterprises combine the two: the role sets a baseline and context such as device, location, sensitivity or time modifies the final decision.
- **Zero Trust** — Never trusting an identity merely because it is inside the corporate network: every access is authenticated and authorised on identity, context and policy. NIST SP 800-207 explicitly rejects implicit trust based on network location.
- **Device posture** — What the endpoint attests about itself — disk encryption, patch level, endpoint agent present, certificate, domain membership — used alongside identity to grade access. It is a point-in-time attestation from the endpoint, so it complements controls on the target rather than replacing them.
- **PASM** (Privileged Account and Session Management) — The vault half of the category: storing credentials, rotating them, and brokering, isolating and recording sessions. Most programmes that call themselves privileged access management are only this, which leaves the endpoint problem untouched.
- **Enterprise Access Model** — The successor to the three-tier administration model, organising access by control plane, management plane and data plane across cloud and on-premises rather than by server tier. Same principle — credentials do not flow downwards — with a scope that includes the cloud control plane.
- **ESAE** (Enhanced Security Administrative Environment) — The retired hardened-forest design, commonly called the red forest. It protected directory administration well and did nothing for the cloud control plane, which is where the most valuable access now sits — which is why it was retired and why knowing that distinguishes recent knowledge from knowledge learned once.
- **LSASS** (Local Security Authority Subsystem Service) — The Windows process holding credential material in memory, and therefore the target of credential-dumping tools. Session brokering exists partly because of this: if the secret never reaches the user's endpoint, there is nothing on that endpoint to harvest.
- **TGS** (Ticket Granting Service) — The Kerberos service that issues tickets for individual services once you hold a ticket-granting ticket. A ticket it issues for an account with a service principal name is what gets attacked offline in Kerberoasting.
- **AS-REP roasting** — Attacking accounts that have Kerberos pre-authentication disabled: the authentication service response can be requested without credentials and cracked offline. The fix is to stop disabling pre-authentication, which is usually a legacy accommodation nobody revisited.
- **NTLM relay** — Capturing a legacy authentication attempt and replaying it against another service rather than cracking it. Why finding where the legacy protocol still fires is real work rather than housekeeping.
- **Pass-the-ticket** — Reusing a stolen Kerberos ticket rather than a password or hash. The sibling of pass-the-hash, and the reason session brokering matters — a ticket cannot be stolen from an endpoint that never held one.
- **MITRE ATT&CK** — The public catalogue of adversary tactics and techniques. Useful for mapping an answer — credential access and lateral movement are the two tactics privileged access controls exist to interrupt — and best used to sharpen a point rather than as decoration.
- **PBAC** (Policy-Based Access Control) — Deciding access from centrally expressed policy rather than from roles or raw attributes, so the rule lives in one reviewable place. The third model alongside role-based and attribute-based control, and the one that scales when the other two collide.

## Components — the moving parts of the platform and the estate around it

- **SAML** (Security Assertion Markup Language) — The older of the two federation standards, XML-based, still dominant for enterprise workforce single sign-on. An AM concern rather than a PAM one, but the portal's own login usually depends on it.
- **OIDC** (OpenID Connect) — The modern federation standard, built on OAuth 2.0 and issuing signed JSON tokens. Worth knowing on the privileged side too: it is how a CI pipeline proves what it is to a secrets manager without holding any credential.
- **Vault** — Hardened, encrypted repository that stores privileged credentials and enforces authorisation and audit on every access.
- **EPV** (Enterprise Password Vault) — The vault component itself. Runs on a hardened, single-purpose server with its own firewall and proprietary protocol, deliberately not domain-joined — so compromising the domain does not compromise the vault. Usually paired with a DR vault replicating from it.
- **Server key** — The key protecting the vault's own key hierarchy, held outside the database. Without it the database files decrypt to nothing, which is why backup of the database alone is not a usable copy of the vault.
- **PVWA** (Password Vault Web Access) — The web portal through which users search for accounts, request access, retrieve credentials and launch sessions.
- **CPM** (Central Policy Manager) — The component that automatically changes, verifies and reconciles privileged credentials according to platform policy.
- **PSM** (Privileged Session Manager) — A gateway that brokers privileged connections so they can be isolated from the endpoint, monitored live and recorded. Runs on Windows and is reached over RDP on 3389.
- **PSMP** (Privileged Session Manager for SSH) — The SSH counterpart to the PSM, covering SSH, SCP, SFTP and Rsync. A transparent proxy rather than a jump server, so the native ssh client still works — you connect as ssh user@target-account#target-host@psmp-host. Runs on Linux, reached on port 22, and supports SSH key authentication.
- **PTA** (Privileged Threat Analytics) — The analytics component that turns privileged activity into named detections — suspected credential theft, PSM bypass, golden ticket, over-pass-the-hash, unmanaged privileged account, irregular hours or source, excessive access. It combines vault records, session activity and directory telemetry, and can rotate a credential automatically on a severe detection.
- **AAM** (Application Access Manager) — The answer to hardcoded credentials in application code and scripts. The application asks for its secret at runtime and is authenticated by its own properties — path, hash, OS user — rather than holding a password in a config file.
- **CCP** (Central Credential Provider) — The agentless form of application credential retrieval: the application calls a REST endpoint instead of running a local provider. Useful where an agent cannot be installed — containers, appliances, hosts rebuilt from an image — at the cost of a network dependency on the retrieval path and identity that rests on a client certificate rather than process inspection.
- **CP** (Credential Provider) — The agent form: installed on the application server, called locally, and able to inspect the calling process directly — OS user, executable path, executable hash. It caches, so a retrieval does not depend on the network being up, which is why it suits anything that must start during an outage.
- **Secrets manager** — The consumer model for workloads rather than people or classic applications. Identity is borrowed from the platform, and secrets may be minted per request with an expiry rather than stored and rotated. Complements the vault rather than replacing it — a target that cannot mint credentials on demand stays static.
- **authn-jwt** (JWT authenticator) — Authenticating a workload with a signed OIDC token. The issuer claim is the trust anchor, the subject identifies the workload — for a pipeline, the repository and branch — and the audience stops a token minted for one service being replayed against another.
- **authn-k8s** (Kubernetes authenticator) — Identity from the pod's service-account token, checked against namespace, service account and cluster. The token is mounted by the kubelet and signed by the cluster, so nothing had to be distributed for it to work.
- **Secretless** — An injection pattern where the application never receives the secret at all: a broker holds the credential, opens the connection, and the application talks to a local socket. There is nothing to leak, log or commit — the strongest answer to credentials appearing in stack traces and repositories.
- **ISPSS** (Identity Security Platform Shared Services) — The unified multi-service portal model in which privileged access, identity administration, audit and intelligence are delivered as one platform.
- **SIA** (Secure Infrastructure Access) — The component providing agentless, ZSP-oriented access to cloud and infrastructure targets. The Access space is the surface built on it — the two are not alternatives.
- **Access space** — The part of the platform people use to reach assets, organised by target rather than by credential. Covers both vaulted and just-in-time access.
- **DR Vault** (Disaster recovery vault) — A replica of the vault kept for failover. It matters more than it sounds: privileged access is an availability dependency, so losing the vault mid-incident makes every other recovery harder. Untested failover is the finding — the day you need it is the wrong day to discover the replica has been lagging for months.
- **Vault protocol** — The vault's own proprietary protocol on TCP 1858. Naming the port is a small signal that the connectivity check you describe is a real one rather than a recited list.
- **WEF** (Windows Event Forwarding) — Native collection of selected events from many hosts to a collector. Why it matters to privileged access: evidence that lives only on the host does not survive the host, and clearing a local log is an anti-forensic move that forwarding defeats.
- **LDAP** (Lightweight Directory Access Protocol) — Directory lookups on 389, or 636 for the TLS-protected form, LDAPS. The vault, the identity provider and the network access layer all lean on the directory, which is why a directory problem shows up first as three unrelated-looking failures.
- **REST API** — The programmatic interface to the platform, exposed through the web portal's application. Everything done by hand in the portal — creating accounts, safes and members, triggering rotations, extracting evidence — can be done through it, which is what makes onboarding at scale and scheduled reporting possible.
- **SIEM** (Security Information and Event Management) — Centralised collection of security logs, with correlation, alerting, investigation and historical search. Splunk, Microsoft Sentinel and QRadar are the names to recognise. Privileged events are forwarded there for two reasons: correlation with endpoint and network telemetry, and retention beyond what the platform holds natively.
- **CEF** (Common Event Format) — A structured log format widely used to ship security events into a SIEM, usually over syslog. What 'forward the vault events to Splunk' concretely means.
- **DLP** (Data Loss Prevention) — Controls detecting and preventing sensitive information leaving approved environments — email, cloud storage, removable media, web uploads and the endpoint itself. Adjacent to privileged access rather than part of it, and expected knowledge for a role with 'data security' in the title.
- **EPM** (Endpoint Privilege Manager) — Removes standing local administrator rights from workstations and elevates per application instead, with application control and credential-theft protection alongside. The endpoint half of privileged access — the problem vaulting alone never touches.
- **Conjur** — The secrets manager for containers and pipelines: policy as code, machine identity, and short-lived secrets fetched at runtime instead of held statically. Named separately from the vault because the model differs — identity is borrowed from the platform, and many secrets are minted per request.
- **Privilege Cloud** — The hosted deployment model, as opposed to self-hosted. It removes the vault infrastructure, high-availability and upgrade burden, and in exchange gives up control over upgrade timing, network placement and data residency — which regulated banks often want and sometimes need.
- **OAuth 2.0** — Delegated authorisation: it issues an access token letting an application act on a resource on your behalf. It is not an identity protocol, and the classic mistake is using it alone for login — an access token proves access was granted, not who the person is. Relevant to privileged access because newer deployments accept it for API authentication.
- **SCIM** (System for Cross-domain Identity Management) — The provisioning standard: pushing identity and group lifecycle between systems, deprovisioning included. Preferred over just-in-time provisioning wherever an application supports it, precisely because it covers the removal half.
- **FIDO2** — Public-key authentication where the private key never leaves the device and the credential is bound to the origin, so it will not sign for a lookalike domain. That origin binding is what makes it genuinely phishing-resistant rather than merely strong, and it is why privileged populations are moved to it first.
- **PingID** — A multi-factor service common in banks, partly because its federation component can run on-premises and hybrid. Methods span mobile push, time-based codes, FIDO2 keys and biometrics, desktop login, RADIUS for legacy infrastructure, and SMS and voice — which rank last, because of SIM swap and interception.
- **RADIUS** — The protocol by which multi-factor authentication gets in front of legacy infrastructure — VPN concentrators, network devices — that cannot speak modern federation. The standard answer to "how do you put MFA in front of an old VPN?".
- **Entra ID** — Microsoft's cloud identity service, named alongside privileged access tooling in most bank stacks. The chain worth holding: directory roles, resource-level access control, Conditional Access, MFA, privileged identity management, service principals and managed identities, then the sign-in and audit logs.
- **PIM** (Privileged Identity Management) — Time-bound, eligible-rather-than-active assignment of cloud administrative roles, with activation optionally requiring justification, approval and multi-factor. The cloud expression of reducing standing privilege — and a complement to governance, not a substitute for it.
- **ZTNA** (Zero Trust Network Access) — Brokering a user to one specific application rather than placing them on a network. Connectors beside the application dial outward, so there is no inbound rule and nothing internet-facing to scan — which removes by design the lateral movement a VPN grants by design.
- **PACLI** (Privileged Account Command Line Interface) — The scripting interface to the vault, older than the REST API and still present. Where you meet it in practice is legacy automation somebody wrote years ago that nobody has migrated.
- **ASCP** (Application Server Credential Provider) — The third form of application credential retrieval, plugging into Java application servers so a connection pool obtains its credential from the vault rather than from a datasource configuration file. Named alongside the agent and agentless providers because the three cover different deployment shapes.
- **PAReplicate** — The vault's backup utility. Backup is a dedicated tool rather than a file copy, because the encrypted store is not something you preserve by copying a directory — and a copy without the server key decrypts to nothing regardless.
- **PARestore** — The vault's restore utility, and the half people never exercise. A backup that has never been restored is a belief; the recovery path is the control, not the backup job.
- **Distributed vault** — A satellite vault serving a geographically separate part of the estate, so credential retrieval does not cross a continent to complete. Distinct from a disaster recovery replica, which exists for failover rather than for locality.
- **Password Upload Utility** — The bulk-import tool for onboarding accounts from a file. One of three routes alongside manual onboarding and the API — and at any real scale, onboarding rules plus the API is the only sustainable choice.
- **CIEM** (Cloud Infrastructure Entitlement Management) — Managing permission sprawl in cloud estates, where the unit of privilege is a role that can be assumed rather than an account with a password. The fourth part of the category alongside account and session management, endpoint elevation, and secrets management.
- **ITDR** (Identity Threat Detection and Response) — Detecting and responding to attacks on the identity infrastructure itself — the directory, the identity provider, the tokens — rather than on endpoints or networks. The analytics end of the maturity arc.
- **DSPM** (Data Security Posture Management) — Discovering and classifying sensitive data at rest so access decisions have something factual behind them. Adjacent to privileged access rather than part of it, and expected vocabulary for a role with data security in the title.
- **CI/CD** (Continuous Integration and Continuous Delivery) — The build and deployment pipelines that hold their own privileged secrets — deployment credentials, registry tokens, cloud roles. A pipeline is a privileged identity, and treating it as infrastructure rather than as an identity is how secrets end up in build logs.
- **PAW** (Privileged Access Workstation) — A hardened, single-purpose machine used only for administration — no email, no general browsing — so Tier 0 credentials are never typed on a machine exposed to the usual initial-access routes. Also written SAW, for secure admin workstation.
- **Jump host** — A controlled intermediate machine through which administrative sessions to a target estate are made, so the target is not reachable directly. A session gateway is a jump host with credential injection and recording built in — which is why brokering and tiering are the same argument rather than two.
- **WebAuthn** (Web Authentication) — The browser-facing half of the modern authentication standard, paired with the client-to-authenticator protocol that talks to the device. Together they are what makes a security key origin-bound and therefore phishing-resistant.
- **U2F** (Universal 2nd Factor) — The earlier second-factor standard that preceded the current one. Still supported by most keys, and worth recognising as the ancestor rather than a competitor.
- **OATH** (Initiative for Open Authentication) — The body behind the open one-time-password algorithms, which is why tokens from different vendors interoperate. Not to be confused with OAuth, which is a delegated authorisation protocol and entirely unrelated — the near-collision of names is itself a small interview hazard.
- **TOTP** (Time-based One-Time Password) — A rotating code derived from a shared seed and the current time, which is why clock drift matters. Stronger than a code delivered by message and still phishable, because a relay can capture and replay it inside its validity window.
- **HOTP** (HMAC-based One-Time Password) — The counter-based sibling of the time-based algorithm: the code advances when used rather than with the clock. Its failure mode is counter desynchronisation rather than clock drift.
- **SecurID** — The classic hardware one-time-password fob. A seed record shared at manufacture, a rotating code, and a passcode formed from a PIN plus that code. The operational details that come up are clock drift and next-tokencode mode — and that despite being hardware, it is still phishable.
- **PIV** (Personal Identity Verification) — The certificate-based smart card standard, with the defence equivalent known as the common access card. The card holds the private key and a PIN unlocks it, and it brings a full certificate lifecycle with it — issuance, renewal, revocation, and a certificate authority that is itself Tier 0.
- **SASE** (Secure Access Service Edge) — The convergence of networking and security delivered from the cloud rather than from appliances in a data centre. Appears constantly in job descriptions, so being unable to expand it is a small avoidable stumble.
- **SSE** (Security Service Edge) — The security half of that convergence on its own: secure web gateway, cloud application broker, zero trust network access and data loss prevention. The distinction from the full convergence is that this half omits the networking.
- **SWG** (Secure Web Gateway) — The proxy that filters and inspects outbound web traffic — URL filtering, encrypted traffic inspection, sandboxing. The outbound counterpart to zero trust access, which handles inbound to private applications.
- **CASB** (Cloud Access Security Broker) — Visibility and control over how cloud applications are used, including what data leaves through them. Often delivered as part of the outbound gateway rather than as a separate product.
- **App Connector** — The component deployed beside a private application that dials outward to the access service. Because both sides dial out and are stitched together in the middle, there is no listening port and nothing inbound to allow — and what a connector can reach defines what can be published, making its placement an access-control decision.

## Objects — the things the platform manages

- **Safe** — Logical container inside the Vault that groups accounts and carries the permission grants for them.
- **Account** — A managed privileged credential, identified by username, target address and platform.
- **AppID** (Application identity) — The registered identity an application presents when asking for a credential. On its own it is only a claim; the authentication rules attached to it are what turn the claim into proof.
- **Application dependency** — Something that will break when a credential rotates. In this simulator an application registration is a dependency: before rotating a service account, you check what is provisioned against it.
- **Lease** — The record of an issued dynamic secret and its expiry. The unit of management: you do not rotate a dynamic secret, you let its lease expire — and to contain an incident you revoke it, because there is no stored value to change.
- **Safe member** — A user granted a specific permission level on a safe: Use, Manage, Approve, Audit or Full.
- **Service account** — A non-human account used by an application or service, typically with a long-lived password and wide dependencies — a classic rotation challenge.
- **Reconciliation account** — A highly privileged account used solely to reset other credentials that have drifted out of sync with the Vault.
- **Password version** — A previous value of a managed credential, kept so a failed change can be rolled back, history depth enforced, and an investigator can establish which value was live when.
- **Temporary version** — The intermediate value a reconcile sets with the reconciliation account before settling on the final one. Usually hidden from the version list.
- **Logon account** — A second account used to open the door when the managed account cannot log in to change its own password — common on Unix, where the target account may not be permitted to SSH in directly. It establishes the session; the managed account's password is then changed inside it. Distinct from a reconciliation account, which is for recovery rather than routine change.
- **SPN** (Service principal name) — The identifier that maps a service to the account running it, so clients can request a ticket for it. A service account with an SPN is Kerberoastable: any domain user can request a ticket encrypted with that account's password and attack it offline — which makes service-account password strength a real control, not a formality.
- **gMSA** (Group managed service account) — A service account whose password Active Directory generates and rotates by itself, with authorised hosts retrieving it as needed. The modern answer to the service-account problem where the application supports it — no dependency mapping, because nothing is holding a copy.
- **Privileged group** — Domain Admins, Enterprise Admins, Schema Admins, the local Administrators group and the operator groups. Membership must be minimal, monitored and alerted on. Nesting is where privilege accumulates unnoticed — a shadow administrator is usually two group memberships deep.
- **Bearer token** — The session token returned by authentication and sent in the Authorization header on every subsequent call. Anyone holding it is the caller, which is why it belongs in memory rather than in a log, a config file or a URL.
- **krbtgt** — The account whose key signs every Kerberos ticket in a domain, and therefore the most sensitive password in it. Compromise yields a golden ticket. Remediation is to reset it twice with replication allowed to complete in between — one reset leaves the previous key valid.
- **SYSDBA** — Oracle's highest database privilege, able to start, stop and recover the instance and to act regardless of ordinary permissions. One of the privileged account classes people forget to inventory because it is not in the directory.
- **sa** (system administrator) — SQL Server's built-in administrative login. Frequently shared, frequently ancient, and frequently the account an application connects with — which makes it a rotation dependency problem as much as a privilege problem.
- **root** — The Unix superuser, which bypasses permission checks entirely. Often cannot log in directly by policy, which is exactly why a logon account exists for changing its password.
- **sudo** (superuser do) — Delegated, command-level elevation on Unix — the native form of privilege elevation rather than credential vaulting. Its configuration is where over-broad grants hide, because a rule permitting a shell is a rule permitting everything.

## Workflows — the sequences people and the platform perform

- **Change** — A CPM job that replaces a privileged password with a new policy-compliant random value and stores it in the Vault.
- **Verify** — A CPM job that confirms the password held in the Vault still authenticates against the target, detecting drift.
- **Reconcile** — A CPM job that uses a separate privileged reconciliation account to forcibly reset a credential that is out of sync with the Vault.
- **Dual control** — A requirement that a second authorised person confirms a request before privileged access is granted.
- **Break glass** — Emergency access to a last-resort privileged account, wrapped in compensating controls such as mandatory recording and automatic post-use rotation.
- **Discovery** — Scanning targets and directories for privileged accounts that are not yet under management. What it finds is the gap between the accounts you know about and the accounts that actually exist.
- **Dynamic secret** — A credential generated when it is requested and destroyed when its lease ends: a short-lived STS token, a database user created with the right grants and dropped afterwards. Nothing exists between uses, so there is no rotation to schedule and nothing standing for an attacker to find.
- **Policy as code** — Defining workloads, secrets and grants declaratively in version control rather than through a console. Access changes become reviewable commits, the estate is diffable, and rebuilding an environment is a load rather than an afternoon of clicking.
- **Vault synchronisation** — Replicating static secrets between the vault and the secrets manager so one credential has one source of truth across the classic and cloud-native estates. Without it the same password drifts in two places.
- **Session recording** — Capture of a privileged session as a replayable and searchable timeline of commands, window activity and statements.
- **Onboarding** — Bringing a discovered privileged account under vault management: assigning it to a safe and a platform, and taking over its credential.
- **Credential retrieval** — The audited act of obtaining a privileged secret from the Vault. In mature deployments it is replaced by session brokering so the human never sees the value.
- **Vaulted access** — A stored, long-lived credential is injected into the connection. The control surface is the vault: rotation, approval, recording.
- **JIT access** (Just-in-time access) — No standing credential exists; an entitlement is created for the session and removed when it ends. There is nothing to rotate and nothing to steal in between.
- **Request Timeframe** — The explicit from/to window a requester asks for, rather than only a duration — so access can be requested ahead of a scheduled change.
- **Multiple access** — A request option allowing repeated connections within the approved window, as opposed to a single one-time connection.
- **Monitor** — Opening a copy of a live session to watch it or take co-control. Distinct from suspend and terminate: it observes rather than intervenes, and the owner is notified.
- **Onboarding rule** — A rule that automatically brings discovered accounts matching stated criteria under management, assigning safe and platform without a human doing it one at a time. At any real scale, rules plus the API are the only workable route.
- **Account lockout** — Locked, expired and disabled are three different states with three different fixes. Locked means too many bad passwords — find the source before unlocking, or you restart the cycle. Expired means the password aged out. Disabled means somebody turned it off, and why matters before you turn it back on.
- **400** (Bad Request) — The request itself is wrong: malformed JSON, a missing required field, an invalid value, a filter the API cannot parse. Nothing on the server will change this, so retrying unchanged is pointless. Compare the payload against the schema field by field.
- **401** (Unauthorized) — Authentication failed, or the token is missing, expired or invalid. You never got in. Do not troubleshoot safe permissions on a 401 — that is the mistake this status exists to catch, and it costs the first twenty minutes of an incident.
- **403** (Forbidden) — Authenticated and not authorised: the caller lacks the vault authority or safe permission the endpoint requires. Regenerating the token achieves nothing, because the token was fine. And do not fix it by making the automation identity an administrator.
- **404** (Not Found) — The endpoint or the object does not exist — or it exists and is invisible to this caller, which in a permission-scoped API looks identical. If an administrator can see the object and you cannot, it is a visibility problem wearing a 404.
- **409** (Conflict) — A well-formed request the current state refuses, usually a duplicate. For a re-runnable onboarding script this is a success case, not a failure — and generating a new name to get past it is how estates end up with svc-app01, svc-app01-2 and svc-app01-new.
- **429** (Too Many Requests) — Throttling. Bulk jobs reach it long before anything else breaks. Back off exponentially and honour Retry-After; retrying immediately extends the window you are being throttled in.
- **5xx** (Server error) — A server-side failure that nothing in your request will fix. Correlate the timestamp with the component and server logs, retry with bounded backoff, and stop — a component that is already failing does not need your loop on top of it.
- **Idempotency** — The property that running an operation twice leaves the same result as running it once. It is what makes a bulk onboarding script safe to re-run after a partial failure, and the reason a 409 on create should usually be treated as success.
- **Pagination** — Returning results in pages with a cursor or offset rather than all at once. The difference between a script that works on a demo estate and one that works on forty thousand accounts — a caller that reads the first page and stops silently reports a fraction of the truth.
- **Test of design** — Would this control work if it ran? Answered by inspecting configuration: safe permissions, Master Policy settings, platform rotation schedules. A design failure is rare and severe, because everything downstream of it is invalid.
- **Test of operating effectiveness** — Did the control actually operate throughout the period? Answered by sampling, sized to how often the control runs: rotation logs across the year, a recording for a selected session, sign-offs for each quarterly review. The common finding is a control that passes design and fails here — the policy was right, and rotation had been failing on thirty accounts for four months.
- **Access review** — Periodic recertification: does everyone who can reach a privileged credential still need to? Deliberately boring work whose value is what it catches — leavers who still hold membership, people who moved teams two years ago, and temporary grants nobody removed. It depends entirely on being able to enumerate the population.
- **Change control** — Privileged changes ride an approved, scheduled, validated and evidenced process. Emergency access is a designed exception with alarms, tickets and post-use review — never an undocumented bypass. The distinction is what keeps break glass from quietly becoming routine.
- **SPL** (Search Processing Language) — Splunk's query language. The working set is search, stats, tstats, where, eval, bin, dedup, table and sort. Prefer statistical aggregation to transaction where you can; tstats is the faster route over indexed fields and accelerated data models.
- **Clock skew** — Disagreement between the clocks on the systems you are correlating. It matters more than it sounds: one skewed source can invert a timeline and make the response look like the cause. Normalise to UTC and verify before drawing conclusions from ordering.
- **Incident response lifecycle** — Preparation, detection and identification, containment, eradication, recovery, lessons learned. For a privileged credential the middle expands: contain access, preserve evidence before cleaning anything, rotate or reconcile, review sessions and authentication activity, determine scope, remediate, monitor for recurrence.
- **Vendor access** — Third-party privileged access without a VPN or an agent on their device. A common real requirement and a frequent audit finding, because the default answer in most estates is a shared account somebody emailed.
- **JIT provisioning** — An application creating a user's account at their first successful single sign-on, from attributes in the assertion. Convenient, and it only ever creates — nothing tells the application somebody has left, so the account stays. That hits two audit controls at once: termination timeliness, and the access review you cannot run on a population you cannot enumerate. Do not confuse it with JIT elevation, which grants temporary privilege; provisioning creates lasting access, elevation grants temporary access.
- **STAR** (Situation, Task, Action, Result) — The structure behind a competency answer. Worth extending with two more beats for a security role: the risks you considered and mitigated, and how you validated or communicated the outcome. That extension is what separates a story from evidence of judgement.
- **Upgrade order** — Vault first, then the portal, then the credential manager, then the session managers, with cross-component version compatibility checked. Validate behaviourally afterwards — run a rotation to completion and open a brokered session. An upgrade that leaves rotation silently failing is worse than no upgrade, because nothing alerts.
- **JML** (Joiner, Mover, Leaver) — The identity lifecycle, and the governance pillar's core process. The leaver half is the one that produces findings: access that should have been removed and was not shows up on the privileged side as membership of a safe nobody withdrew.
- **Log streaming** — Pushing access-service events into the enterprise security monitoring platform. Those logs are evidence: who reached which application, when, from what device — the network half of the record that the vault's audit trail completes.

## Policy — the rules above the workflows

- **Connection component** — The driver that actually establishes a brokered session for a given protocol — PSM-RDP, PSM-SSH, PSM-WinSCP, PSM-SQLPlus and so on. A platform lists the ones its accounts may use, which is what makes a policy executable rather than aspirational.
- **Platform** — Policy template that defines password complexity, rotation intervals, verification, reconciliation, connection method and session rules for a class of accounts.
- **TTL** (Time to live) — How long an issued credential remains valid. Short enough that a leaked value is stale before it is useful, long enough that the workload is not re-authenticating constantly. A max TTL caps how far a renewal can extend it.
- **Compliance status** — Whether an account currently satisfies its platform policy, principally the password change and verification intervals.
- **Master Policy** — The organisation-wide rules that sit above every platform: require dual control, enforce exclusive access, one-time passwords, demand a reason or a ticket, mandate session recording. Exceptions are granted per platform — which is why 'make this one system stricter' is usually a platform exception rather than a new safe.
- **Exclusive access** — Check-out and check-in: only one person may hold a credential at a time, and it rotates on check-in. This is what turns a shared administrative account into an individually attributable one, and it is close to mandatory on shared privileged accounts in a bank.
- **One-time password** — A credential rotated immediately after a single use, so the value a person saw is dead before they could reuse it. The strongest form of exclusive access, and the reason a retrieval does not become a standing credential.
- **Use without Retrieve** — The safe permission combination that lets someone connect through the session manager without ever seeing the password. The goal state for most users, and one of the fastest ways to demonstrate you have actually administered a vault rather than read about one.
- **Audit policy** — The Windows settings that decide which security events are recorded at all. Advanced audit policy subcategories are the modern form. The nuance worth saying out loud: an event ID only helps if the policy producing it was enabled and the log retained — 'we were not recording that' and 'it did not happen' produce identical empty searches.
- **Group Policy** — How password policy, lockout thresholds, audit policy and user rights actually reach machines. When an account behaves differently on one host, a Group Policy scoping difference is the standard suspect.
- **Rate limiting** — The server refusing calls beyond a rate, answering 429. Any automation touching thousands of objects needs backoff and paging designed in from the start, because discovering this in production looks exactly like an outage.
- **SOX** (Sarbanes-Oxley Act) — The US law behind financial-reporting controls. Section 404 is the one that reaches IT: management and auditors must assess the controls over financial reporting, and the systems that hold financial data inherit that scrutiny. In a bank, privileged access is not a security preference — it is the control set behind an audit domain.
- **ITGC** (IT General Controls) — The control domains an IT audit is grouped into by convention: Access to Programs and Data, Program Changes, Program Development, and Computer Operations. Worth phrasing as audit practice rather than statute — the law does not legislate the domains.
- **Access to Programs and Data** — The ITGC domain privileged access lives in. Its controls: authorised provisioning with approval, periodic access review and recertification, termination timeliness, segregation of duties, privileged and generic account management, authentication configuration, and logging of privileged activity. Privileged access is the highest-risk slice, because one account can alter financial data and its own audit trail.
- **IPE** (Information Produced by the Entity) — Any report you hand an auditor is itself evidence whose completeness and accuracy you must be able to prove. A screenshot with no provenance is not evidence. Keep the source system, the query or report logic, the parameters, the timestamp and the reconciliation alongside the output.
- **Termination timeliness** — The control that access is removed within a defined window of somebody leaving. Measured, sampled and commonly failed. It is an IGA responsibility that surfaces on the privileged side as membership of a safe that should have been stripped.
- **Control deficiency** — The first rung of the ladder: a control that does not operate as intended. It escalates to a significant deficiency and then to a material weakness according to the likelihood and potential magnitude of a misstatement. Remediation fixes the deficiency going forward — it does not by itself reclassify what already happened.
- **Material weakness** — The top of the deficiency ladder: a reasonable possibility that a material misstatement would not be prevented or detected in time. Effective compensating controls can lower where a gap lands, which is why they are documented in advance rather than discovered during the assessment.
- **Compensating control** — A different control reducing the same risk to an acceptable level where the intended one cannot be implemented — an application that cannot rotate, compensated by exclusive access, brokered sessions, tighter monitoring and alerting on every use, recorded as accepted risk with a named owner and a review date.
- **Preventive control** — Stops the bad thing happening: vaulting, rotation, dual control, Use without Retrieve, session isolation, MFA. The auditor's question is 'could it have happened?'.
- **Detective control** — Finds it afterwards, fast enough to matter: session recording, analytics detections, SIEM correlation, access reviews, reconciliation reports. The auditor's question is 'would you have known?'.
- **PCI DSS** (Payment Card Industry Data Security Standard) — The card-data standard. Requirements 7 and 8 are the privileged access ones — restricting access by business need to know, and identifying and authenticating every user, including the rule that shared and generic accounts must be individually attributable. That last one is exactly what exclusive access delivers.
- **GLBA** (Gramm-Leach-Bliley Act) — The US financial privacy law. Section 501(b) reaches banks through the Interagency Guidelines Establishing Information Security Standards, enforced by the banking agencies — not through the FTC Safeguards Rule, which covers non-bank financial institutions. Getting that distinction right is a small credibility marker in a bank interview.
- **FFIEC** (Federal Financial Institutions Examination Council) — Publishes the IT Examination Handbook that US bank examiners work from, including risk-based layered security and authentication commensurate with risk. Its Cybersecurity Assessment Tool was sunset on 31 August 2025, so cite that as history rather than as current practice.
- **OCC** (Office of the Comptroller of the Currency) — The regulator of national banks, whose heightened standards set governance and risk-management expectations for large institutions. Relevant because it is one of the bodies whose examiners ask to see the evidence a privileged access programme produces.
- **NIST SP 800-53** — The US federal control catalogue, and the vocabulary most control language borrows from. AC-6 is the least-privilege family — including the requirement to log the use of privileged functions — and the AU family covers audit and accountability.
- **Data classification** — Public, internal, confidential, personal, financial. It drives which controls apply, and an access decision made without it is a guess. Pairs with ownership: somebody has to answer for the data and approve access to it.
- **Step-up authentication** — Challenging again at the moment of privilege — retrieving a Tier 0 credential, launching an administrative session — with a stronger factor than the one used at login, not a repeat of it. The principle: a sensitive operation deserves its own gate, not just the front door.
- **Adaptive authentication** — Policy evaluating signals — geovelocity, address reputation, new device, network zone, device posture — and stepping challenges up or waiving them accordingly, so friction is proportional to risk. For privileged identities, set a floor rather than letting a low risk score waive the challenge.
- **Bypass code** — A temporary credential issued when somebody cannot use their enrolled factor. A legitimate necessity and a standing risk, so it needs single use, short expiry, alerting on issue and use, out-of-band identity verification before issuing, and review of who uses them — repeat users mean the process has become a workaround.
- **Conditional Access** — The policy engine evaluating signals and deciding whether access is granted, blocked or challenged. The sign-in log exposes which policy applied and why — which is where you look when a privileged user says multi-factor is blocking them, rather than reaching for an exclusion.
- **AAL** (Authenticator Assurance Level) — How strongly the authenticator proves possession, on a three-level scale. The top level effectively requires a hardware authenticator, which is the standards-based way to justify buying security keys for privileged users. Its companions are identity assurance, for how strongly the person was proofed, and federation assurance, for how strongly an assertion is protected.
- **COSO** (Committee of Sponsoring Organizations of the Treadway Commission) — The internal-control framework financial-reporting controls are assessed against. Worth recognising as the framework behind the audit rather than something you work with directly.
- **PCAOB** (Public Company Accounting Oversight Board) — The body regulating the external auditors of public companies, and therefore the reason those auditors test what they test and how. When an audit approach seems oddly specific, this is usually why.
- **CIS Controls** (Center for Internet Security Controls) — A prioritised set of safeguards, of which account management and access control management are the two that bear directly on privileged access. The same body publishes the hardening benchmarks estates are measured against.