Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Cyber Wiki Learning Path

Identity, Authentication, and PKI

Learn how identities are created, authenticated, authorized, federated, monitored, and supported by certificates and cryptographic keys.

Recommended Sequence

87 connected entries

All learning paths
Identity and access concept · Intermediate

802.1X Network Access Control

802.1X Network Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

AI application security · Intermediate

AI Secrets Management

AI secrets management protects API keys, tokens, certificates, and credentials used by models, agents, pipelines, and tools.

API security · Advanced

API Token Scope Design

API token scope design grants an automation client only the operations, resources, environments, and duration needed for its approved purpose.

Authorization · Intermediate

Access Control Lists on Hosts

Host access control lists extend basic owner-group-other permissions with named user and group entries, default inheritance, and more precise authorization for shared files and directories.

Assurance practice · Intermediate

Access Reviews and Recertification

Access reviews verify that users, services, groups, roles, and privileged accounts still need the permissions they hold.

Identity and access concept · Intermediate

Access Tokens, ID Tokens, and Refresh Tokens

Access Tokens, ID Tokens, and Refresh Tokens is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Identity lifecycle practice · Intermediate

Account Deprovisioning

Account deprovisioning removes or disables access, sessions, credentials, tokens, groups, roles, and recovery methods when access is no longer authorized.

Agentic AI security · Advanced

Agentic AI Authorization

Agentic AI authorization ensures every tool call and consequential action is permitted for the initiating identity, current context, resource, and purpose.

Access control model · Intermediate

Attribute-Based Access Control

Attribute-based access control evaluates characteristics of the subject, resource, action, and environment to make a contextual access decision.

Digital identity · Foundational

Authentication Factors

Authentication factors are independent categories of evidence used to prove control of an identity, commonly something known, possessed, or inherent to the user.

Identity model · Beginner

Authentication, Authorization, and Accounting

AAA separates three connected functions: verifying identity, deciding allowed actions, and recording activity for accountability and investigation.

Security objective · Foundational

Authenticity

Authenticity provides confidence that an identity, message, device, document, or software artifact is genuine and comes from the claimed source.

Secure automation · Advanced

Automation Secret Management

Automation secret management keeps passwords, tokens, keys, and certificates out of code and logs while delivering them only to authorized jobs at execution time.

Endpoint data-protection control · Intermediate

BitLocker Drive Encryption

BitLocker is a Windows full-volume encryption capability that protects data at rest by binding volume keys to trusted startup conditions, recovery methods, and optional user authentication.

Cryptography and trust concept · Intermediate

Certificate Chain Validation

Certificate Chain Validation is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Certificate Revocation Lists and OCSP

Certificate Revocation Lists and OCSP is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Certificate Signing Requests

Certificate Signing Requests is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Emergency access control · Advanced

Cloud Break-Glass Access

Break-glass access provides a tightly controlled emergency path when normal identity, federation, or administrative mechanisms are unavailable.

Cloud identity risk · Advanced

Cloud Credential Exposure Paths

Cloud credential exposure paths include source code, build systems, images, logs, metadata services, environment variables, local files, browser sessions, and overprivileged automation.

Architecture and data-protection practice · Advanced

Cloud Data-Plane Security

Cloud data-plane security protects the operations that read, write, process, transmit, and delete workload and business data after cloud resources have been configured.

Cloud authorization practice · Advanced

Cloud IAM Policy Analysis

Cloud IAM policy analysis evaluates effective permissions, conditions, inheritance, wildcard use, trust relationships, resource scope, and paths to privilege escalation.

Cloud architecture assurance practice · Advanced

Cloud Identity Boundary Validation

Cloud identity boundary validation tests whether accounts, subscriptions, projects, tenants, organizations, roles, and trust relationships enforce the intended separation of duties and blast radius.

Identity architecture · Intermediate

Cloud Identity Federation

Cloud identity federation allows an external identity provider to authenticate users or workloads and provide trusted assertions or tokens to cloud services.

Cloud security practice · Intermediate

Cloud Identity and Access Management

Cloud identity and access management governs human and workload access to provider consoles, APIs, resources, data, secrets, and administrative functions.

Cloud cryptographic practice · Advanced

Cloud Key-Use Governance

Cloud key-use governance defines who and what may use encryption keys, for which operations, under what conditions, with what logging, and through which approval and recovery processes.

Cloud authentication practice · Advanced

Cloud Session and Token Security

Cloud session and token security governs issuance, scope, lifetime, storage, revocation, audience, refresh, and monitoring for interactive and workload access.

Secure design principle · Intermediate

Complete Mediation

Complete mediation requires every security-relevant access request to be checked against current authorization rules rather than relying indefinitely on an earlier decision.

Adaptive access control · Advanced

Conditional Access for Hybrid Networks

Conditional access for hybrid networks combines identity, device, location, risk, application, and session context to make dynamic access decisions across cloud and on-premises resources.

Adversary behavior · Intermediate

Credential Access

Credential access includes techniques used to obtain passwords, hashes, tokens, keys, tickets, cookies, or other material that can authenticate an identity.

Engineering capability · Advanced

Cryptographic Agility

Cryptographic agility is the ability to inventory, evaluate, replace, and validate cryptographic mechanisms without emergency redesign of every dependent system.

Architecture practice · Advanced

Cryptographic Architecture

Cryptographic architecture defines where and why cryptography is used, how keys and trust anchors are managed, and how algorithms and implementations change over time.

Cryptographic control practice · Advanced

Cryptographic Key Management

Cryptographic key management governs key generation, registration, distribution, storage, use, rotation, backup, recovery, revocation, archival, and destruction.

Data protection · Intermediate

Data Masking and Tokenization

Data masking and tokenization replace or transform sensitive values so systems and users can work with lower-exposure representations.

Nonhuman identity security · Intermediate

Database Credential and Service-Account Security

Database credential and service-account security limits how nonhuman identities are created, stored, rotated, monitored, and granted database privileges.

Database protection · Advanced

Database Encryption and Key Management

Database encryption and key management protect database files, backups, fields, and network connections while governing the keys that enable access.

Cryptography and trust concept · Intermediate

Diffie-Hellman Key Exchange

Diffie-Hellman Key Exchange is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Digital Signatures

Digital Signatures is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptographic control · Intermediate

Digital Signatures and Non-Repudiation

Digital signatures use asymmetric cryptography to support message integrity, signer authentication, and evidence that an action came from a particular key holder.

Identity and access concept · Intermediate

Discretionary Access Control

Discretionary Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Technology overview · Beginner

Encryption, Hashing, and Digital Certificates

Encryption protects confidentiality, hashing produces fixed-length representations for integrity and comparison, and certificates bind public keys to identities or services.

Troubleshooting practice · Advanced

Enterprise IAM Troubleshooting

Enterprise IAM troubleshooting isolates failures across identity proofing, directory data, federation, tokens, conditional access, authorization, MFA, session, and application integration layers.

Risk terminology · Foundational

Exposure

Exposure is the condition of being reachable, visible, accessible, or otherwise subject to loss or attack because assets, identities, data, or services are presented to a threat.

Authentication standard · Intermediate

FIDO2 and WebAuthn

FIDO2 combines public-key authentication protocols with WebAuthn so users can sign in using phishing-resistant credentials bound to legitimate services.

Identity architecture · Intermediate

Federation and Single Sign-On

Federation allows one trusted identity system to assert information to another service, while single sign-on reduces repeated authentication across connected applications.

Identity and access concept · Intermediate

Federation and Trust Relationships

Federation and Trust Relationships is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Software authenticity control · Advanced

Firmware Signing

Firmware signing uses protected private keys and verified metadata to let a bootloader, device, installer, or update service determine that firmware was authorized by the product owner and has not been modified since signing.

Architecture practice · Advanced

Identity Architecture

Identity architecture defines how people, workloads, devices, services, and organizations are identified, authenticated, authorized, governed, and audited.

Identity practice · Beginner

Identity Lifecycle Management

Identity lifecycle management governs how accounts and access are requested, created, changed, reviewed, suspended, and removed.

Identity assurance practice · Intermediate

Identity Proofing

Identity proofing establishes evidence that an applicant is the person or entity they claim to be before an identity is enrolled or credentials are issued.

Access architecture practice · Intermediate

Integrated Physical and Logical Access Control

Integrated physical and logical access control coordinates identity, credentials, badges, devices, locations, systems, authorization, logging, and revocation without creating hidden trust escalation.

Connected-device identity concept · Advanced

IoT Device Identity

IoT device identity is the set of cryptographic and lifecycle mechanisms used to distinguish one physical or logical device from another, authenticate it to services and peers, and bind actions and data to an accountable device record.

Identity and access concept · Intermediate

Just-in-Time Access

Just-in-Time Access is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Authentication protocol · Intermediate

Kerberos

Kerberos is a ticket-based network authentication protocol that lets users and services prove identity without repeatedly sending passwords across the network.

Cryptography and trust concept · Intermediate

Key Derivation Functions

Key Derivation Functions is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Access-control principle · Beginner

Least Privilege

Least privilege reduces avoidable exposure by limiting users, services, applications, and devices to the permissions they actually require.

Identity lifecycle · Intermediate

Linux Account Lifecycle

Linux account lifecycle management governs creation, modification, suspension, deletion, home directories, shells, group membership, service identities, and residual access from onboarding through deprovisioning.

Privilege management · Intermediate

Linux Capabilities and Privilege Delegation

Linux capabilities and controlled privilege delegation split broad superuser power into narrower rights so services and administrators receive only the authority required for a task.

Secure automation · Advanced

Machine Identity Governance for Automation

Machine identity governance manages service accounts, workload identities, certificates, tokens, and keys used by automation as governed identities with owners and life cycles.

Access control model · Intermediate

Mandatory Access Control

Mandatory access control enforces centrally defined rules using security labels, classifications, and clearances that ordinary users cannot alter.

Mobile platform-security concept · Foundational

Mobile App Permissions

Mobile app permissions authorize access to protected device capabilities and data such as location, camera, microphone, contacts, files, sensors, notifications, nearby devices, and background activity.

Mobile identity-security concept · Advanced

Mobile Authentication and Authorization

Mobile authentication and authorization combine user, device, application, and backend trust decisions so a mobile client can establish an identity while servers enforce what that identity may do with each resource and transaction.

Mobile transport-security concept · Advanced

Mobile Certificate Validation and Pinning

Mobile certificate validation verifies that a server certificate chains to a trusted authority, matches the intended service, is valid for the current time and policy, and has not been revoked or otherwise rejected; pinning adds a narrower application trust decision for selected keys or certificates.

Security control · Beginner

Multifactor Authentication

Multifactor authentication strengthens sign-in by requiring independent evidence from different factor categories rather than relying on one credential alone.

Authorization framework · Intermediate

OAuth 2.0

OAuth 2.0 is an authorization framework that lets a client obtain limited access to a resource on behalf of a user or itself without receiving the user's password.

Identity and access concept · Intermediate

OAuth 2.0 Authorization

OAuth 2.0 Authorization is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Operational technology architecture · Advanced

OPC UA Trust Management

OPC UA trust management governs application identities, certificates, trust lists, security policies, endpoint configuration, and lifecycle actions for industrial data exchange.

Operational technology architecture · Advanced

OT Remote Access Governance

OT remote access governance limits who can connect, from what managed path, for what approved purpose, to which assets, for how long, and under what monitoring and response controls.

Federated identity protocol · Intermediate

OpenID Connect

OpenID Connect adds an identity layer to OAuth 2.0 so a relying application can authenticate a user and receive standardized identity claims.

Authentication architecture · Intermediate

PAM Authentication Policy

Pluggable Authentication Modules centralize Linux authentication decisions through ordered policy stacks that can combine passwords, lockouts, multifactor methods, directories, and session controls.

Service management · Intermediate

PCI Cryptographic Key Control Evidence

PCI cryptographic key control evidence demonstrates that key generation, distribution, storage, access, rotation, replacement, revocation, destruction, and split knowledge or dual control operate as designed.

Service management · Intermediate

PCI PIN Security

PCI PIN security protects personal identification numbers and cryptographic keys used in payment transactions through controlled devices, encryption, key management, processing, and operational procedures.

Service management · Intermediate

PCI Tokenization and Scope Reduction

PCI tokenization replaces account data with substitute values while preserving tightly controlled tokenization, detokenization, key, vault, and administrative components that remain security-critical.

Cryptographic architecture · Advanced

PKI Architecture

PKI architecture defines certificate authorities, registration, trust anchors, certificate profiles, validation, revocation, key protection, issuance workflows, and relying-party behavior.

Authentication technology · Foundational

Passkeys

Passkeys are FIDO credentials that use public-key cryptography to provide passwordless, phishing-resistant sign-in through a device or credential provider.

Authentication policy · Intermediate

Password Aging and Lockout Policy

Password aging and lockout policy coordinates credential lifetime, failed-attempt controls, recovery, service-account handling, and monitoring without creating predictable resets or denial-of-service risk.

Authentication practice · Beginner

Password Security

Password security combines user-friendly length, protection against reuse and compromise, secure storage, rate limiting, recovery controls, and stronger authentication where needed.

Authentication strategy · Foundational

Passwordless Authentication

Passwordless authentication verifies identity without requiring the user to enter a memorized password, using methods such as public-key credentials, device-bound keys, or one-time links.

Privacy rights operations · Intermediate

Privacy Rights Request Verification

Privacy rights request verification confirms that a requester is entitled to act without collecting excessive new data or exposing another person’s information.

Identity security program · Intermediate

Privileged Access Management

Privileged access management protects accounts, roles, credentials, and workflows that can make high-impact changes or bypass ordinary controls.

Identity and access concept · Intermediate

Privileged Access Workflows

Privileged Access Workflows is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Cloud automation security · Advanced

Provider SDK Credential Security

Provider SDK credential security controls how command-line tools and software development kits discover, store, select, refresh, and use cloud or service credentials.

Cryptography and trust concept · Intermediate

Public Key Infrastructure Operations

Public Key Infrastructure Operations is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Federated identity protocol · Intermediate

SAML

Security Assertion Markup Language is an XML-based standard used to exchange authentication and authorization assertions between an identity provider and a service provider.

Identity and access concept · Intermediate

SAML Authentication

SAML Authentication is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Identity and access concept · Intermediate

SCIM Provisioning

SCIM Provisioning is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

Mobile data-protection concept · Intermediate

Secure Mobile Data Storage

Secure mobile data storage keeps secrets and sensitive information out of inappropriate files, caches, backups, logs, screenshots, clipboards, notifications, and shared locations while using platform protection suited to the data and threat model.

Identity control · Intermediate

Temporary Cloud Credentials

Temporary cloud credentials provide time-limited access tokens or keys instead of persistent secrets.