← Security
Around two-factor authentication and access management the acronyms pile up: TOTP, RADIUS, LDAP, PKI, HSM. Below is what they mean and where they end up in an ordinary business environment, so you know what a supplier is talking about.
Authentication
- 2FA and MFA
- Two-factor authentication is exactly one extra factor beside the password; MFA is the broader term for multiple factors. In practice people use them interchangeably.
- TOTP
- The technique behind the six-digit code in an authenticator app. Based on time and a shared secret, so it works without a network connection.
- Hardware token
- A physical key that confirms the sign-in. The only method genuinely resistant to phishing.
- Service account
- An account with no person behind it, used by systems and integrations. It gets keys or certificates rather than an app.
Access and keys
- Active Directory
- The user administration of a Windows environment: who exists, and what they may reach.
- LDAP
- The protocol other systems use to consult that user administration.
- RADIUS
- The protocol network equipment and VPNs use to have a sign-in checked. It is why the same second factor works for VPN, RDP and your web applications.
- PKI
- The whole of certificates and their issuance, allowing systems to trust each other. Watching expiry dates is the work that remains.
- HSM
- A device that stores and uses keys without revealing them. For heavier requirements; often disproportionate for an average smaller organisation.
The acronyms are the easy part. What rollouts founder on are the exceptions: the colleague without a company phone, the external party, and the account with no person behind it.
More on this →