Identity & access
Definiciones en lenguaje claro del tema identity & access.
ABAC
Attribute based access control, or ABAC, is an authorisation model in which access decisions are computed at request time from attributes of the user, the resource, the action and the context, rather than read from a static role. The policy is a rule, and the answer can differ for the same person from one request to the next.
Access control
In security architecture, access control is the set of policies and mechanisms that decide who can read, modify or invoke a given resource. It is the control that most reports come back to, because almost every serious finding is ultimately a decision that was made in the wrong place or by the wrong component.
Active Directory
Active Directory is the directory service that holds the accounts, groups, computers and policies of most corporate Windows networks, and decides who may do what across all of them. In an intrusion it is the objective rather than a component: control of the directory is control of every machine that trusts it.
AD CS abuse
AD CS abuse is the exploitation of misconfigured Active Directory Certificate Services to obtain a certificate that authenticates as another account. Because the directory accepts certificate based logon, a certificate issued for a privileged user is equivalent to that user’s credentials, and it does not change when their password does.
AS-REP roasting
AS-REP roasting is an Active Directory attack against accounts that have Kerberos pre-authentication disabled. The domain controller will return an authentication response containing material encrypted with the account’s password key to anyone who asks for it, and that material is then cracked offline.
Attack path
In internal and cloud testing, an attack path is the concrete sequence of steps that connects a position an attacker can reach to a position that matters, such as an ordinary domain account to domain administrator. It is a route through relationships that already exist, not a list of vulnerabilities.
Authentication
In access control, authentication is the step that establishes who or what is making a request, using something the subject knows, has or is. It answers only that question. What the subject is then allowed to do is authorisation, a separate decision, and confusing the two is the reason many access control flaws exist.
Authorisation
In identity and access, authorisation is deciding what an already-authenticated identity is allowed to do. It runs after authentication has established who the caller is, and it is a per-request question rather than a per-session one, because the answer depends on the specific object and operation being requested.
Basic authentication
Basic authentication is the simplest way of proving who you are: a username and a password sent to a service that compares them with what it holds. In HTTP it is the Basic scheme of RFC 7617, and the name collides with something else that matters more.
Biometrics
Biometrics is the use of unique physical or behavioural characteristics to authenticate somebody: a fingerprint, a face, an iris, a voice. It is convenient, it is hard to forget, and it is the one credential that cannot be changed after a breach.
Conditional access
In cloud identity, conditional access is policy that evaluates the circumstances of a sign-in and decides what to require or refuse. Rather than a single yes or no at the password, it asks which user, from what device, in which location, to reach which application, at what assessed risk, and applies a control that fits the answer.
Credential dumping
In intrusion operations, credential dumping is the extraction of authentication material from a system an attacker already controls: password hashes, plaintext passwords, tickets and tokens. It is the step that converts control of one machine into access to others, and it is the most frequently reported technique in our internal engagements.
Kerberoasting
In an Active Directory intrusion, kerberoasting is the act of requesting a service ticket for an account that has a service principal name, then cracking the ticket offline to recover that account’s password. Any domain user can ask for the ticket, so nothing about the request itself looks abnormal.
Kerberos
In enterprise authentication, Kerberos is the ticket-based protocol that Active Directory uses to prove identity between clients and services without sending passwords over the network. Understanding its ticket exchange is a prerequisite for understanding most of what happens in an internal intrusion on a Windows estate.
Least privilege
Least privilege is the principle of granting each identity only the access it needs for its task, and nothing more. In an intrusion it is the control that decides consequences: it does not stop an attacker getting in, it decides how far the first account they compromise can take them.
Legacy authentication
Legacy authentication is any sign in protocol that sends a username and password directly to the service without supporting modern authentication, so it cannot prompt for a second factor and is not evaluated by conditional access. In Microsoft 365 estates it is the path that quietly bypasses the controls the organisation believes it has deployed.
Non-human identity
In identity security, a non-human identity is an account used by software rather than by a person: a service account, a workload identity, an API key, an automation credential or an autonomous agent. In most estates these now outnumber human accounts, and they have no manager, no starter form and no leaving date.
NTLM relay
In internal network attacks, NTLM relay is a technique where an attacker forwards a victim’s authentication attempt to a third system instead of cracking it, and is accepted there as the victim. Nothing is decrypted and no password is recovered: the authentication is genuine, and it is simply used against a destination the victim never chose.
OAuth 2.0
In API and identity security, OAuth 2.0 is an authorisation framework that lets an application act on a user’s behalf without handling their password. It does not authenticate the user: that is OpenID Connect, the identity layer built on top of it, and confusing the two is the most common design error in the ecosystem.
OpenID Connect (OIDC)
In identity, OpenID Connect (OIDC) is the authentication layer built on top of OAuth 2.0. Where OAuth delegates permission to an application, OIDC states who the user is, by adding an ID token with a defined set of claims and the rules for validating it. It is the piece that OAuth deliberately does not provide.
Pass-the-hash
Pass-the-hash is a Windows attack in which an intruder authenticates to a remote system using the stored hash of a password rather than the password itself. Nothing is cracked and nothing is guessed: NTLM proves knowledge of the hash, so the hash is the credential.
Passkey
In authentication, a passkey is a FIDO2 and WebAuthn credential: a key pair created for one specific site, where the private key stays on the user’s device and sign-in is a signature over a challenge. It is the only widely deployed consumer credential that a phishing proxy cannot capture and replay.
Password manager
A password manager stores, generates and protects the credentials a person uses across many accounts, so that each one can be different and none of them has to be memorable.
Passwordless
In authentication, passwordless describes any sign-in that does not require the user to present a memorised shared secret. In practice the term is used for two very different things, and only one of them removes the phishing problem: credentials based on public key cryptography, as against codes and links delivered over a channel.
Privileged access management (PAM)
In identity security, privileged access management (PAM) is the set of controls applied specifically to the accounts that can change a system rather than use it: vaulting their credentials, brokering their sessions, granting rights only when needed and recording what was done. It is the control that breaks the routes an internal test finds.
SAML
SAML 2.0 is an XML based federation standard used for enterprise single sign on: an identity provider issues a digitally signed assertion about a user, and a service provider trusts it. It is what most of the installed corporate estate runs on, while new development generally chooses OpenID Connect instead.
SSO
In identity management, SSO is single sign-on: one authentication event grants access to many applications, so the user proves who they are once and each application accepts an assertion instead of its own login. It is convenient, it removes a large number of passwords, and it concentrates risk into one place.