Security

The identity backbone of enterprise Windows: directory, Kerberos authentication, and Group Policy — and the highest-value target on any corporate network.

A simple shared secret string that identifies and authorizes an application (not a user) calling an API — easy to use, easy to leak, and often misused for the wrong job.

Authorization decided by policies over attributes — user, resource, and context — rather than static roles. Vastly more expressive, meaningfully harder to reason about.

The recommended OAuth 2.0 flow for browser and mobile apps — Authorization Code with PKCE adds a dynamic proof that stops an intercepted authorization code from being usable by an attacker.

A developer-focused identity platform (now part of Okta) for adding login, SSO, and user management to your own apps — customer identity (CIAM) via APIs and SDKs, so you don't build auth from scratch.

A security auditing service that records AWS API calls, user actions, and resource changes.

Managed storage, rotation, and audited retrieval of credentials — the antidote to passwords in environment variables and API keys in Git.

Microsoft's cloud identity platform (formerly Azure AD, now Entra ID) — the identity provider behind Microsoft 365 and countless enterprise apps. The identity backbone of the Microsoft ecosystem.

The single hardened jump box that funnels admin access into private networks — a pattern now being replaced by session brokers that need no open ports at all.

An access token where mere possession grants access — like cash, whoever holds it can use it. Simple and ubiquitous in APIs, and dangerous if intercepted, so it lives and dies by TLS and short lifetimes.

The trusted third party that issues and vouches for TLS certificates — the root of the trust chain that lets your browser believe a site is really who it claims to be.

The OAuth 2.0 flow for machine-to-machine authentication — a service authenticates as itself (not on behalf of a user) to get an access token. No human, no browser, no user consent.

The audit log of every API call in your AWS account — who did what, when, from where. The difference between an incident report and a shrug.

AWS's managed user directory and authentication service — sign-up, sign-in, MFA, and OIDC token issuance without running your own identity stack.

How to let a principal in one AWS account securely act in another — via assumed IAM roles and temporary credentials, not shared long-lived keys. The backbone of multi-account AWS.

The browser mechanism that controls cross-origin requests — universally misunderstood as an error to disable, actually a security boundary to configure correctly.

An HTTP header security mechanism that controls browser access to resources hosted on external domains.

An attack that injects malicious JavaScript into a web page other users view — running in their browser with their privileges. Prevented by proper output encoding and CSP.

Defending against attacks that trick a logged-in user's browser into making unwanted requests to a site they're authenticated to — using the browser's own cookies against them.

The universal ID system for publicly known security flaws — a CVE number gives everyone one unambiguous name for the same vulnerability, so the whole industry can coordinate.

The 0–10 standardized severity score for vulnerabilities — a useful common language for 'how bad in theory,' but a dangerous substitute for real risk prioritization in your environment.

Defending against traffic floods designed to exhaust your capacity — absorbed at the edge, filtered by layer, and increasingly a cost problem as much as an uptime problem.

The security architecture principle that every control will eventually fail — so you layer independent controls such that no single failure is a breach.

A cryptographic signature proving an email really came from your domain and wasn't altered — one leg of the SPF/DKIM/DMARC tripod that decides deliverability.

The policy layer that ties SPF and DKIM to the visible From: address and tells receivers what to do on failure — now mandatory for bulk senders.

A set of DNS extensions that cryptographically sign DNS records so resolvers can verify answers haven't been forged — closing DNS's original lack of authentication. Powerful but underdeployed and complex.

Security testing that attacks the running application from the outside — catching the runtime and config flaws static analysis can't see, at the cost of coverage and speed.

A SAML identity assertion whose contents are encrypted, not just signed — so intermediaries can't read the personal data inside it, only the intended Service Provider can.

Encrypting stored data so a stolen disk or leaked backup is useless — nearly free, mostly a checkbox, and frequently mistaken for access control.

Protecting data as it moves between systems — table stakes on the public internet, and increasingly mandatory inside your own network too.

Letting users log into many services with one identity from a trusted provider — the basis of SSO and 'Sign in with Google.' Centralizes credentials where they can be secured.

Google Workspace's built-in user directory — the identity backbone that stores accounts and groups and acts as an identity provider for SSO across Google and third-party apps.

AWS's managed threat detection — machine-analyzed CloudTrail, VPC, and DNS signals surfacing compromised credentials and instances without agents to deploy.

Tamper-resistant hardware that performs cryptography without ever exposing the keys — the root of trust behind KMS, PKI, and payment systems.

An AWS guardrail that caps the maximum permissions an IAM entity can have — it doesn't grant access, it limits it. Key to safely letting teams manage their own IAM without granting escalation.

A JSON definition block declaring permission scopes for specific cloud resources.

An IAM identity that defines temporary credential configurations for cloud resources.

The distinction that underpins secure AWS access: users hold permanent credentials, roles grant temporary ones on assumption — and roles should be your default.

Framework for defining who can access which cloud resources and how.

The system that authenticates users and vouches for their identity to other applications — the trusted center of SSO and federated login. Compromise it and you compromise everything.

The OAuth flow that returned tokens directly in the browser URL — deprecated for a decade of good reasons, replaced everywhere by Authorization Code + PKCE.

AWS's automated, continuous vulnerability scanner for EC2, container images, and Lambda — it finds known CVEs and exposures in your workloads without you scheduling scans.

Limiting how many requests a single IP address can make in a time window — a simple, common first line of defense against abuse, brute-force, and scraping. Effective but easily evaded and prone to false positives.

A published set of public keys (as JSON) that lets anyone verify JWT signatures and lets services rotate signing keys without breaking every client.

A cryptographically signed, URL-safe data structure used to pass authentication claims between systems.

A signed, self-contained token carrying identity claims — verifiable by any service without a database call, and revocable by none of them.

AWS's managed key service — envelope encryption backed by HSMs, where the master keys never leave and every use is logged.

A defined schedule and process for regularly replacing cryptographic keys and secrets — limiting the damage window if a key is ever compromised. Only valuable if rotation is automated.

The resource policy that is the root authority over a KMS key — powerful enough to lock out even the account root, which is exactly how people brick keys.

The directory protocol under Active Directory and enterprise auth — hierarchical, fast for reads, and the backend a surprising amount of infrastructure still binds against.

Grant the minimum access required, for the minimum time — the principle every breach postmortem cites and every deadline erodes.

The free, automated certificate authority that made HTTPS universal — 90-day certificates issued via the ACME protocol, renewed by software instead of humans.

An AWS service that uses machine learning to find and classify sensitive data — PII, credentials, financial info — sitting in your S3 buckets, so you know where your risk lives.

Requiring a second proof of identity beyond the password — with a factor hierarchy that matters enormously, because SMS and phishable codes are no longer enough.

A security protocol requiring both client and server to verify each other's certificates before establishing connections.

The stateless subnet-level firewall in a VPC — numbered rules, explicit deny, and return-traffic gotchas that surprise everyone exactly once.

An authorization framework that lets apps access resources on behalf of a user without sharing passwords.

A TLS optimization where the web server fetches and 'staples' a fresh proof that its certificate isn't revoked to the handshake — so clients don't have to check with the CA, fixing OCSP's speed and privacy flaws.

Okta is a leading vendor-neutral identity provider — its whole value is connecting to everything, so 'Okta integration' means wiring an app into Okta for SSO, provisioning, and centralized access control.

An authentication layer built on top of OAuth 2.0 — it adds a standard identity token (JWT) so apps can actually know *who* the user is, not just what they can access.

An awareness document ranking the ten most critical web-application security risks — the industry's common baseline for what to defend against. A starting point for security, not a complete checklist.

An authorized simulated attack where skilled testers actively try to exploit a system's weaknesses — going beyond automated scanning to prove what an attacker could actually achieve.

Grant every user, service, and process only the minimum access it needs to do its job — nothing more. The single most important access-control principle, and the hardest to actually maintain.

Two models for deciding who can do what: RBAC grants access by assigned roles (simple, coarse), ABAC by evaluating attributes (flexible, fine-grained). Most real systems blend both.

A long-lived credential used only to obtain new short-lived access tokens — so users stay logged in without keeping a powerful long-lived access token exposed. The high-value target you must protect.

The OAuth flow where the app collects the user's password directly — formally deprecated, kept alive only by legacy systems, and the anti-pattern worth knowing by name.

Permissions granted through roles rather than to individuals — the access model that scales to thousands of users, until role explosion sends you toward ABAC.

The XML-based federation standard behind most enterprise SSO — verbose, battle-tested, and full of signature-validation traps that became real CVEs.

An AWS Organizations guardrail that caps the maximum permissions for entire accounts — an org-wide ceiling that even account admins can't exceed. It limits, it never grants.

AWS's stateful instance-level firewall — allow-rules only, return traffic automatic, and the most common place cloud exposure actually happens.

AWS's central dashboard that aggregates security findings from many AWS services and partner tools into one prioritized view, checked against best-practice standards.

A TLS certificate an entity issues to itself, with no trusted CA vouching for it — it encrypts traffic but proves no identity, which is why browsers warn on it.

Splitting a sensitive process across multiple people so no single individual can complete it alone — the control that prevents both fraud and catastrophic single-actor mistakes.

In federated login (SAML/SSO), the application the user is trying to access — it trusts an external Identity Provider to vouch for who the user is.

How long a user session stays valid before requiring re-authentication — the balance between security (short sessions limit stolen-session damage) and usability (nobody wants to log in constantly).

AWS's paid, managed DDoS protection tier — adds 24/7 response team access, cost protection against attack-driven scaling bills, and advanced mitigations over free Shield Standard.

The SSO counterpart nobody implements well: ending a user's session everywhere at once — and why 'log out of all apps' is one of identity's genuinely hard problems.

One login for many applications — the productivity win that's also a security consolidation, concentrating both convenience and risk in the identity provider.

Scanning your dependencies for known vulnerabilities and license risks — where most real-world CVEs actually live, and the least glamorous, highest-yield security tool.

A DNS record listing which mail servers are authorized to send email for your domain — one of the three pillars (with DKIM and DMARC) that stop spammers from forging your address.

An attack that smuggles malicious SQL into a query because user input was concatenated into it — decades old, still devastating, and fully preventable with parameterized queries.

The negotiation that establishes an encrypted session before any data flows — the round trips behind 'HTTPS feels slow', and why TLS 1.3 cut them.

The process of decrypting SSL/TLS traffic at a proxy to reduce cryptographic compute overhead on backend nodes.

An attack that tricks a server into making requests to targets the attacker chooses — often internal systems and cloud metadata endpoints the attacker can't reach directly.

Automated code analysis that finds vulnerability patterns before anything runs — cheap, early, and only as valuable as your triage discipline.

A structured exercise to find what could go wrong in a system before you build it — asking what you're protecting, who might attack it, and how, so you design defenses in.

Invalidating an access or refresh token before it expires — straightforward for stateful tokens, genuinely hard for stateless JWTs, and the gap attackers exploit.

Cryptographic protocol that encrypts data in transit between clients and servers.

Network-level records of accepted and rejected traffic in your VPC — the forensic and debugging layer that answers 'did the packet even arrive?'

Automated tooling that inspects systems, code, containers, and dependencies for known security weaknesses — a continuous baseline of security hygiene, only useful if its findings drive action.

An application-layer firewall that inspects HTTP requests for attacks — real value against common exploits, real limits against determined attackers, and a false-positive budget to manage.

A single TLS certificate that covers all first-level subdomains of a domain (*.example.com) — convenient for managing many subdomains, but concentrates risk in one shared private key.

A security flaw that's exploited before the vendor knows about it or has a patch — 'day zero' of the defenders' awareness. The hardest class of threat to defend against.

Security model that verifies every access request regardless of network location.