Security runs on acronyms. Here is what ours mean.

Authentication is how a user proves who they are before reaching a resource or a service. It happens in two stages:

• Primary authentication opens the workstation itself, by password, smart card, contactless card, biometrics or a mobile factor.
• Secondary authentication happens afterwards, each time that open session reaches an application, whether it is web, client-server, local or external.

Whether a method counts as single-factor or multi-factor comes down to how many of three questions it asks: what you have, what you know, and who you are.

Identity and Access Management is the set of processes that govern a user's identity on the network, and it is broader than the one discipline it often gets confused with: it covers primary authentication, access management, privileged access management and identity governance and administration together. Its functional scope reaches every capability that:

• Authenticates users on the network, through primary authentication.
• Manages authorisations, identity lifecycles and the accounts behind them.
• Keeps both the rights held and the actions taken by or on a user traceable.

In practice it is what lets employment status and job function decide, in real time, which applications someone can open, with the decision applied to the information system automatically.

Identity as a Service is identity and access management delivered as a cloud service. Functionally it covers two halves:

• Identity governance and administration: the directory of users, and the provisioning of accounts and authorisations into the information system.
• Access management: single authentication to applications in every form it takes, from simple to multi-factor to federated, whether those applications run in your own datacentre or as SaaS.

Most deployments are hybrid, pairing cloud services with on-premise components for the provisioning half, and they cover an organisation's own employees alongside the people at its customers, partners, suppliers and service providers. That is what makes them a common route to just-in-time provisioning and to a zero trust policy of least privilege.

Identity Governance and Administration is the management of users' identities and of the authorisations attached to them, keeping every access right in line with what the business currently needs: someone who leaves should lose their applications the same day. It brings identity and access governance together with account and credential management, and rests on three parts:

• Identity provisioning: the repository of identities, for people or for applications, and the accounts deployed from it across the infrastructure.
• Access governance: the repository of rights, granted by group, by role (RBAC), by attribute (ABAC) or by organisation (OrBAC).
• Entitlement analytics: the tooling that discovers, analyses and monitors what has actually been configured, so deviations from security policy and regulation surface.

That last part is what answers the questions an audit asks: who has access to what, is it compliant, and can it be proven? Role mining, segregation of duties and rights certification all fall out of it.

Operational Technology is the category of computing made up of the hardware and software that monitors and controls industrial machinery and processes, in every sector. Gartner's definition: “Operational Technology (OT) is hardware and software that detects or causes a change, through the direct monitoring and/or control of industrial equipment, assets, processes and events”. In practice that means industrial control systems, including SCADA and distributed control systems. OT is older than the term, which arrived with automation in industry. IT and OT resemble each other but answer to different concerns:

• IT answers to the CIO, and is concerned with infrastructure, security and governance. It handles information and data.
• OT is concerned with yield, quality and efficiency. It handles machines and processes.

The two are converging: OT equipment now sits on IT networks and is exposed to the internet, and third-party remote maintenance opens it further. Controlling access to it matters as much as it does because the consequences are physical.

Privileged Access Management is the area of cybersecurity dedicated to controlling, monitoring and auditing the use of privileged accounts: the ones held by system and database administrators, network and cloud engineers, and the outside contractors who maintain or support the estate. Unlike a standard account, a privileged one has elevated permissions and can make critical changes to IT systems, networks, and sensitive data: install software, change configuration, reach confidential information and override security settings, which makes it both the first thing an attacker looks for and a standing risk from the inside. A PAM solution answers with:

• Credential vaulting: privileged credentials held in encrypted vaults, passwords rotated automatically, and none of them left hard-coded in scripts.
• Just-in-time access: privileged rights granted only when they are needed, and only for as long as they are needed.
• Session monitoring: detailed logs and video recordings of privileged sessions, watchable as they happen.
• Strong authentication: multi-factor and approval workflows, with policies that read the context of the request.
• Auditing: a trail complete enough to demonstrate compliance with GDPR, PCI DSS, ISO 27001 and HIPAA.
• CyberElements PAM also offers a unique feature on the market: AI-powered Lens, an analytical and decisional layer that senses weak abnormal signals and blocks suspicious activity automatically.

It applies to internal users and external ones alike, on site or remote.

Key benefits

• Reduce the attack surface
• Detect and respond to threats and compromised accounts
• Meet traceability and compliance requirements
• Lower the insurance bill
• Control remote and third-party accesses

Single Sign-On is the identity and access management technology that lets a user authenticate once and then reach many of an organisation's applications without entering credentials again. There are two ways to implement it:

• Credential injection: client software retrieves credentials from a vault and fills the application's own login form, once a user has taught the system those credentials on first use, without disclosing them.
• Identity federation: the application delegates authentication to a trusted identity provider, which verifies the user and issues a token the other applications recognise. The protocols behind it are SAML, OAuth 2.0, OpenID Connect and Kerberos.

Key benefits

Either way the effect is the same:

• fewer passwords to reuse or weaken,
• one place to enforce policy and add multi-factor authentication,
• far fewer reset tickets,
• a workforce that spends its time working rather than logging in.

A Virtual Private Network is a technology that simulates a local area network between two trusted networks, so that workstations, servers, printers and anything else on them can talk to each other without sitting in the same physical network. Because that traffic crosses a public network on the way in most cases, a VPN wraps it in security mechanisms so no third party in between can intercept it. It was built for organisations spread across several sites that need to share computer resources, and IT departments later stretched it to remote work by treating a remote worker's machine as an extension of the corporate network, even though that machine is not part of a trusted one.

A work from home solution is a tool, most often software, that an organisation provides so its people can work remotely. Three kinds are common:

• Collaborative work platforms.
• Remote access to enterprise networks and applications.
• Video conferencing.

Few of them are limited to remote work at all, since the same tools carry communication between departments on site, and they can be deployed on-premise, in the cloud or as a mix of the two. For one to be adopted widely it has to feel like the environment people already know, deploy at scale without pain, and hold security up while it does so. Climate, societal and health pressures have all pushed organisations towards them, for the agility and the business continuity they buy.

Zero Trust Network Access names the products that apply a zero trust, or least privilege, policy to access from outside the network. The point is to give an external user strictly the access their work requires and nothing beyond it, since any superfluous right or route is a risk to the information system. Access policy is decided on two things:

• The user's identity, reinforced where needed by two-factor authentication.
• The conditions of the connection, such as where it is coming from and the health of the device making it.

That granularity applies to a remote employee and a service provider alike, and it sharply narrows the ways an intrusion or an infection can reach the information system.