Identity Authority
LightNews LightNews
banner
identityauthority.org
Identity Authority
@identityauthority.org
38 followers 38 following 33 posts
Technical knowledge and community for identity governance, PAM, and access control.
Glossary, vendor directory and webinars at identityauthority.org
Posts Replies Media Videos
Pinned
identityauthority.org
Identity Authority @identityauthority.org · 20d
Identity Authority: Technical knowledge and community for identity governance, PAM, and access control.

Here we share terms from our glossary, plus our vendor directory and webinars.

identityauthority.org

#IAM #cybersecurity
identityauthority.org
Agent Identity Checklist: Is Your IAM Ready for Agents?

#IAM #cybersecurity
Agent Identity Checklist: Is Your IAM Ready for Agents?
This checklist guides IAM architects in shifting from static identity models to dynamic, task-based frameworks to secure autonomous AI agents effectively.
identityauthority.org
November 2, 2026 at 8:04 PM
identityauthority.org
Term of the day: Single-Factor Authentication

Single-factor authentication is the simplest form of verifying a user's identity, requiring just one credential, such as a password, to gain access to...

Full definition: identityauthority.org/glossary/single-factor-authentication

#IAM #cybersecurity
Single-Factor Authentication. Single-factor authentication is the simplest form of verifying a user's identity, requiring just one credential, such as a password, to gain access to a system, network, or website. Because it relies on only a single piece of evidence, it is generally considered less secure than methods that require additional factors.
November 2, 2026 at 4:05 PM
identityauthority.org
Passkeys Are Banking's Answer to AI-Speed Credential Theft

#IAM #cybersecurity
Passkeys Are Banking's Answer to AI-Speed Credential Theft
Banks face AI-speed credential theft risks and turn to passkeys, based on FIDO2, to enhance security by eliminating shared secrets and phishing vulnerabilities.
identityauthority.org
November 1, 2026 at 8:04 PM
identityauthority.org
Term of the day: Single Logout

Single Logout (SLO) is a feature in federated authentication that lets a user end multiple active sessions with a single logout action, rather than signing out of each application...

Full definition: identityauthority.org/glossary/single-logout

#IAM #cybersecurity
Single Logout. Single Logout (SLO) is a feature in federated authentication that lets a user end multiple active sessions with a single logout action, rather than signing out of each application separately. In most deployments it is the counterpart to single sign-on: where SSO establishes sessions across multiple applications from one sign-in, SLO attempts to terminate those sessions together. The user experience is intended to be a single action that logs them out of the identity provider session and connected applications.
November 1, 2026 at 4:05 PM
identityauthority.org
Five Myths Keeping Your Access Reviews Stuck in Q4

#IAM #cybersecurity
Five Myths Keeping Your Access Reviews Stuck in Q4
Access reviews stuck in Q4 miss risks from nonhuman identities and AI agents. Shifting to continuous governance uncovers hidden exposures and improves compliance.
identityauthority.org
October 31, 2026 at 7:03 PM
identityauthority.org
Term of the day: Signed Assertion

A signed assertion is a message from an identity provider that carries information about a user, such as who they are and what they are allowed to access, with a digital...

Full definition: identityauthority.org/glossary/signed-assertion

#IAM #cybersecurity
Signed Assertion. A signed assertion is a message from an identity provider that carries information about a user, such as who they are and what they are allowed to access, with a digital signature attached to prove it is genuine and unaltered. The signature lets the receiving application confirm the message truly came from the trusted identity provider and was not tampered with in transit. In practice this term most often refers to SAML assertions, where the assertion portion of a login message is digitally signed.
October 31, 2026 at 3:05 PM
identityauthority.org
AI Bot Impersonation: A Field Guide to Identity Verification

#IAM #cybersecurity
AI Bot Impersonation: A Field Guide to Identity Verification
AI bot impersonation threatens 48% of organizations daily. This guide covers identity verification and real-time detection to secure web apps and APIs from malicious bots.
identityauthority.org
October 30, 2026 at 7:04 PM
identityauthority.org
Term of the day: Sign-Up Flow

A sign-up flow is the sequence of steps a new user goes through to create an account with a product or service. It typically collects the information needed to establish an identity...

Full definition: identityauthority.org/glossary/sign-up-flow

#IAM #cybersecurity
Sign-Up Flow. A sign-up flow is the sequence of steps a new user goes through to create an account with a product or service. It typically collects the information needed to establish an identity and, in most deployments, guides the user from first interaction toward using the product. The design of this flow strongly affects how many users complete registration rather than abandoning it.
October 30, 2026 at 3:06 PM
identityauthority.org
Term of the day: Session-Based Access

Session-based access is a control pattern where a user's access is granted only for the length of an active session, rather than being handed out as a permanent...

Full definition: identityauthority.org/glossary/session-based-access

#IAM #cybersecurity
Session-Based Access. Session-based access is a control pattern where a user's access is granted only for the length of an active session, rather than being handed out as a permanent, standing entitlement. When the session ends, the access it enabled no longer applies. This approach can improve on static, always-on permissions by limiting how long access remains valid.
October 29, 2026 at 3:07 PM
identityauthority.org
Agent Authorization Policy Template

#IAM #cybersecurity
Agent Authorization Policy Template
This template defines authorization boundaries for autonomous agents, ensuring cryptographic identity, zero standing privilege, and human-in-the-loop triggers.
identityauthority.org
October 28, 2026 at 7:03 PM
identityauthority.org
Term of the day: Session Timeout

Session timeout is a security mechanism that ends an authenticated session after a set period, often automatically logging the user out. It is commonly triggered either by a...

Full definition: identityauthority.org/glossary/session-timeout

#IAM #cybersecurity
Session Timeout. Session timeout is a security mechanism that ends an authenticated session after a set period, often automatically logging the user out. It is commonly triggered either by a period of inactivity or by reaching a maximum overall session length, at which point the user typically must sign in again.
October 28, 2026 at 3:05 PM
identityauthority.org
Term of the day: Session Recording

Session recording is the practice of capturing what happens during a user's session so it can be reviewed later, similar to a video replay of their activity. In an identity...

Full definition: identityauthority.org/glossary/session-recording

#IAM #cybersecurity
Session Recording. Session recording is the practice of capturing what happens during a user's session so it can be reviewed later, similar to a video replay of their activity. In an identity and access management context, this typically means logging the actions a user takes during a privileged session, such as commands entered or administrative changes made. The recording provides an after-the-fact record for auditing, investigation, and accountability.
October 27, 2026 at 3:05 PM
identityauthority.org
Term of the day: Session Proxy

A session proxy is a type of proxy server that keeps the same outbound IP address for the duration of a browsing or application session, rather than switching addresses between...

Full definition: identityauthority.org/glossary/session-proxy

#IAM #cybersecurity
Session Proxy. A session proxy is a type of proxy server that keeps the same outbound IP address for the duration of a browsing or application session, rather than switching addresses between requests. This consistency helps applications that expect a user to appear from a stable network location throughout a sequence of interactions. The evidence for this term describes network-level IP and session persistence, not identity authentication or authorization functions.
October 26, 2026 at 3:06 PM
identityauthority.org
Frontline Workers Are Losing 32,400 Hours a Year to Authentication

#IAM #cybersecurity
Frontline Workers Are Losing 32,400 Hours a Year to Authentication
Frontline workers lose 32,400 hours annually due to authentication friction, leading to risky workarounds and increased social engineering risks.
identityauthority.org
October 25, 2026 at 7:04 PM
identityauthority.org
Term of the day: Session Isolation

Session isolation is the practice of keeping one session's data and activity separate from another's, so that what happens in one session cannot leak into or interfere with...

Full definition: identityauthority.org/glossary/session-isolation

#IAM #cybersecurity
Session Isolation. Session isolation is the practice of keeping one session's data and activity separate from another's, so that what happens in one session cannot leak into or interfere with another. This helps prevent one user's information or actions from affecting a different user or a different task. It is applied in contexts such as browsers, privileged administrative access, and AI systems.
October 25, 2026 at 3:05 PM
identityauthority.org
7 Billion Passkeys and No Incident Playbook

#IAM #cybersecurity
7 Billion Passkeys and No Incident Playbook
With 7 billion passkeys in use, organizations reduce credential theft risks, yet many still rely on vulnerable password fallbacks, risking security.
identityauthority.org
October 24, 2026 at 7:05 PM
identityauthority.org
Term of the day: Session Cookie

A session cookie is a small, temporary data file that a website stores in a user's browser only for the duration of their visit. Unlike cookies that persist across visits, it is...

Full definition: identityauthority.org/glossary/session-cookie

#IAM #cybersecurity
Session Cookie. A session cookie is a small, temporary data file that a website stores in a user's browser only for the duration of their visit. Unlike cookies that persist across visits, it is typically discarded when the browsing session ends, so it is often used to keep track of a user's activity in real time while they move through a site.
October 24, 2026 at 3:06 PM
identityauthority.org
FIDO Wallet Certification Readiness Checklist

#IAM #cybersecurity
FIDO Wallet Certification Readiness Checklist
This checklist helps organizations evaluate readiness for FIDO-certified digital identity wallets, focusing on phishing resistance, interoperability, and compliance.
identityauthority.org
October 23, 2026 at 7:04 PM
identityauthority.org
Gottlieb & Associates PLLC filed 55% of complaints, up from 37% in August.

#IAM #cybersecurity
September 2026 website accessibility lawsuit report
148 federal website accessibility lawsuits were filed in September 2026 across 8 states. What the complaints alleged, who was sued, where, and by whom.
www.accessibility.com
October 23, 2026 at 6:40 PM
identityauthority.org
Term of the day: Session Brokering

Session brokering is a pattern in which a control layer sits between a user and the system they want to reach, deciding where to route the user's session and connecting...

Full definition: identityauthority.org/glossary/session-brokering

#IAM #cybersecurity
Session Brokering. Session brokering is a pattern in which a control layer sits between a user and the system they want to reach, deciding where to route the user's session and connecting them to the right target. Rather than letting users connect directly, the broker acts as an intermediary that directs remote desktop, virtual desktop, or privileged access sessions to the appropriate host, desktop, or application. It is commonly used in virtual desktop infrastructure (VDI) and in modern Privileged Access Management (PAM) solutions.
October 23, 2026 at 3:06 PM
identityauthority.org
When Your CA's Private Key Is "4"

#IAM #cybersecurity
When Your CA's Private Key Is "4"
eMudhra's cryptographic failure exposed intermediate CA keys, including one as simple as '4'. This risks fraudulent certificates and impacts 30,000 valid certs.
identityauthority.org
October 22, 2026 at 7:05 PM
identityauthority.org
Term of the day: Session Broker

A session broker is a control point that sits between users and the systems they want to reach, directing each user's connection to the correct destination such as a remote...

Full definition: identityauthority.org/glossary/session-broker

#IAM #cybersecurity
Session Broker. A session broker is a control point that sits between users and the systems they want to reach, directing each user's connection to the correct destination such as a remote desktop, virtual desktop, or published application. It keeps track of active connections so that a returning user can be reconnected to their existing session rather than starting a new one.
October 22, 2026 at 3:07 PM
identityauthority.org
MFA Won't Save You From Application Credentials

#IAM #cybersecurity
MFA Won't Save You From Application Credentials
MFA protects user sign-ins but not application credentials, which can grant attackers extensive access. Secure app permissions and monitor service principals carefully.
identityauthority.org
October 21, 2026 at 7:04 PM
identityauthority.org
Term of the day: Service Principal

A service principal is a type of identity used by an application, service, or automated process rather than by a person, allowing that software to sign in and access...

Full definition: identityauthority.org/glossary/service-principal

#IAM #cybersecurity
Service Principal. A service principal is a type of identity used by an application, service, or automated process rather than by a person, allowing that software to sign in and access resources on its own. In cloud platforms such as Microsoft Entra ID, it acts as the local stand-in for an application within a specific tenant or directory. Because it belongs to software instead of a human, it is considered a non-human identity.
October 21, 2026 at 3:07 PM
identityauthority.org
Term of the day: Self-Service Password Reset

Self-Service Password Reset (SSPR) is a feature that lets users reset or change their own passwords without needing to contact IT support or a help...

Full definition: identityauthority.org/glossary/self-service-password-reset

#IAM #cybersecurity
Self-Service Password Reset. Self-Service Password Reset (SSPR) is a feature that lets users reset or change their own passwords without needing to contact IT support or a help desk. Users typically prove their identity through a registered verification method before the reset is allowed, which helps them regain access when they are locked out.
October 20, 2026 at 3:07 PM