Lire en françaisA reference guide to key cybersecurity concepts, protocols, and technologies related to password management, privileged access, and the security posture of businesses.
Access security
Access security refers to the full set of technical and organisational measures that protect access to the resources of an information system. This includes strong authentication, role-based access control (RBAC), the principle of least privilege, session recording, and privileged access management (PAM). Effective access security protects against unauthorised access, account compromise, and lateral movement within the network.
AES-256
AES-256 (Advanced Encryption Standard, 256-bit) is a symmetric encryption algorithm used worldwide to protect classified and sensitive data. It is considered unbreakable with current computing technology. AES-256 is the encryption standard used by governments, financial institutions, and security-conscious organisations to encrypt data at rest and in transit. Heimlane Vault uses AES-256-CBC with HMAC-SHA256 to encrypt all vault contents client-side before they ever reach the server.
Argon2id
Argon2id is a modern key derivation function (KDF) designed to resist brute-force attacks by requiring significant memory and processing time. It won the Password Hashing Competition in 2015 and is recommended by OWASP for password hashing. Unlike older algorithms such as PBKDF2, Argon2id is resistant to GPU-based and ASIC-based attacks due to its memory-hard design. Heimlane Vault supports Argon2id as its recommended KDF for deriving master keys from user passwords.
Audit trail
An audit trail is the chronological record of who did what, when, and from where, kept in a form that can be produced as evidence. In privileged access it consists of structured events (authentication, session opened, target reached, credential used, file transferred, session closed) rather than video, which makes it searchable, exportable to a SIEM, and usable for compliance reporting. Its value depends on integrity: logs must be written somewhere the person being logged cannot alter them, and retained long enough to cover the detection delay of a real incident, which is measured in months. Session recording shows what happened on screen; the audit trail is what you query.
Bastion
A bastion (also called bastion host or jump server) is a hardened entry point that acts as a single, controlled gateway for administrators and third-party providers to access an organisation’s servers and applications. All privileged connections pass through the bastion, which authenticates users, enforces access policies, records sessions, and provides a complete audit trail. In France, “bastion” is widely used as a synonym for PAM (Privileged Access Management) solutions. Heimlane Realm functions as a bastion, providing browser-based access to RDP, SSH, and VNC targets with full session recording and credential injection. Read more: what a bastion host is, what it is used for, and how to deploy one.
Breach monitoring
Breach monitoring checks whether an email address, a domain, or a password appears in known data breaches and credential dumps circulating publicly or on criminal marketplaces. It works by comparing your identifiers against aggregated breach corpora such as Have I Been Pwned, normally using k-anonymity so the service never learns the full password being checked. A hit does not mean your vault has been compromised; it means a credential you use somewhere is public and must be changed. Heimlane Vault includes manual breach checks on the free plan and automatic, bulk checks on paid plans, so exposed credentials surface before someone gets round to using them.
Break-glass account
A break-glass account, also called an emergency administrative account, is a highly privileged account held in reserve for the day the normal access paths fail: the identity provider is down, MFA is unavailable, or the PAM solution itself is unreachable. It exists precisely because centralising access creates a single point of failure. Good practice is to keep very few of them, seal the credentials offline or in a separate vault, forbid routine use, alert on any authentication, and document a procedure for using them and rotating them afterwards. A break-glass procedure that has never been rehearsed is not a procedure.
CLOUD Act
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) is a United States federal law allowing US authorities to compel US-based service providers to hand over data under their control, regardless of the country in which it is stored. A US company’s European data centre is therefore not out of reach, and neither is the European subsidiary of a US parent. This is the legal foundation of most digital sovereignty concerns in Europe, and the reason “hosted in the EU” is not a sufficient answer on its own: what matters is who controls the operator, and whether the data is encrypted such that the operator is unable to produce plaintext at all.
Credential injection
Credential injection is the process of automatically inserting stored credentials (username, password) into a login session without revealing them to the user. The user connects to a target system through a PAM solution, and the solution retrieves the credentials from the password vault and injects them transparently. This eliminates shared passwords, prevents credential theft via keyloggers, and creates a full audit trail of who accessed what, when, and with which account. Heimlane Realm retrieves credentials from Vault and injects them into RDP, SSH, VNC, and web sessions.
Credential stuffing
Credential stuffing is the automated replay of username and password pairs stolen from one service against many others, betting on password reuse. It is not guessing: the credentials are already valid somewhere, which is why a success rate of a fraction of a percent is enough to be profitable at scale, and why the traffic is hard to distinguish from ordinary failed logins. The countermeasures are a unique password for every service, which in practice means a password manager, combined with MFA and breach monitoring so that a leaked credential is changed before anyone tries it elsewhere.
CSPN
CSPN (Certification de Sécurité de Premier Niveau) is a French security certification issued by ANSSI. It validates that a product meets a defined set of security requirements, verified by an accredited evaluation laboratory. CSPN is lighter and faster to obtain than a Common Criteria (CC) certification, and is widely recognised in French public procurement and regulated sectors.
Cyber insurance
Cyber insurance is an insurance contract that covers the financial losses and liabilities arising from a cybersecurity incident (ransomware, data theft, business interruption). Insurers increasingly require verifiable security controls to be in place, such as privileged access management, session recording, strong authentication, and password policies, before granting coverage or reducing premiums.
Cyber Resilience Act (CRA)
The Cyber Resilience Act is an EU regulation, in force since December 2024, that sets cybersecurity requirements for products with digital elements placed on the European market: hardware, software, and their remote data processing solutions. It requires secure-by-default configuration, vulnerability handling with coordinated disclosure, and security updates throughout a defined support period, evidenced by CE marking. Its main obligations apply from December 2027, with vulnerability and incident reporting duties from September 2026. Where NIS2 governs how organisations must operate, the CRA governs what vendors are allowed to sell.
Digital sovereignty
Digital sovereignty refers to the ability of an organisation or nation to control its own digital infrastructure, data, and technology choices without dependence on foreign providers or jurisdictions. In cybersecurity, digital sovereignty means hosting data within the EU, using solutions developed in Europe, and ensuring that no foreign government can compel access to customer data through extraterritorial laws such as the US CLOUD Act.
DORA
DORA (Digital Operational Resilience Act) is an EU regulation applicable since 17 January 2025 that harmonises operational resilience requirements across the financial sector: banks, insurers, investment firms, payment institutions, crypto-asset service providers, and their critical ICT suppliers. It covers ICT risk management, incident reporting, resilience testing, and third-party risk in particular: financial entities must maintain a register of their ICT providers and impose contractual security requirements on them. Its access control expectations overlap heavily with NIS2 and with what privileged access management already provides: strong authentication, least privilege, and auditable records of administrative activity.
Emergency access (digital legacy)
Emergency access lets a user designate a trusted contact who can request access to their vault in the event of death, incapacity, or loss of credentials. The request opens a waiting period during which the owner can refuse it; if the delay expires without refusal, access is granted. Done properly the mechanism is cryptographic rather than administrative: the vault key is wrapped in advance for the trusted contact’s key, so the provider is still unable to open the vault itself and zero knowledge is preserved. This answers the hardest question in zero-knowledge design, which is what happens when the only person who can decrypt the data is no longer there. Heimlane Vault provides emergency access through a designated trusted contact and a waiting period.
End-to-end encryption
End-to-end encryption (E2EE) means that data is encrypted on the sender’s device and can only be decrypted on the recipient’s device. No intermediary, including the service provider, can access the plaintext content. This is the foundation of zero-knowledge architectures where the provider never has access to customer data, even if their servers are compromised.
FIDO2 / WebAuthn
FIDO2 is an open authentication standard from the FIDO Alliance, and WebAuthn is the browser API that implements it. Instead of a shared secret, the authenticator (a hardware key such as a YubiKey, or a platform authenticator such as Windows Hello or Touch ID) holds a private key and signs a challenge sent by the site. The signature is bound to the site’s origin, so a lookalike domain obtains nothing reusable. That is what makes FIDO2 phishing-resistant by construction, unlike TOTP or SMS codes, which a user can be talked into relaying to an attacker in real time. Heimlane Vault supports FIDO2 / WebAuthn hardware security keys as a second factor on paid plans.
Four-eyes principle
The four-eyes principle requires two people for a sensitive action: one performs it, another approves it. Applied to privileged access, it means a session on a critical system cannot begin until a second authorised person validates the request, and in stronger variants a supervisor watches the session live and can terminate it. It is the standard control wherever a single administrator would otherwise hold unchecked power over production systems or financial data, which is why it appears in banking and industrial regulation. It is also known as dual control or dual authorisation.
GDPR
The General Data Protection Regulation (GDPR) is the European Union regulation governing the collection, processing, and storage of personal data. It requires organisations to implement appropriate technical and organisational measures to protect personal data, including encryption, access controls, and the ability to demonstrate compliance. GDPR applies to any organisation processing data of EU residents, regardless of where the organisation is based.
HSM
An HSM (hardware security module) is a tamper-resistant device that generates and stores cryptographic keys and performs operations with them without the key ever leaving the hardware in usable form. Applications ask the HSM to sign or decrypt rather than borrowing the key themselves. HSMs are certified against standards such as FIPS 140-3 and Common Criteria, and are mandatory in payment processing, certificate authorities, and qualified electronic signature. Cloud providers offer them as a managed service, usually as an HSM-backed key management service. They protect the keys that protect everything else, which is why they sit at the root of most serious key hierarchies.
Identity provider (IdP)
An identity provider is the system that authenticates users and asserts their identity to applications, which trust it rather than holding passwords of their own. Microsoft Entra ID, Okta, Google Workspace, and Keycloak are common examples. Applications integrate through SAML 2.0 or OpenID Connect, and the same integration usually carries group membership, which then drives authorisation. Centralising authentication is what makes SSO, a consistent MFA policy, and immediate offboarding possible; it also concentrates risk, since an attacker who controls the identity provider controls everything downstream. That is why the administrative accounts of the identity provider itself are the first thing a privileged access programme should cover.
ISO 27001
ISO/IEC 27001 is the international standard for information security management systems (ISMS). Rather than prescribing a fixed list of controls, it requires an organisation to identify its risks, select proportionate controls from Annex A, and demonstrate that the whole system is measured and improved over time. Certification is granted by an accredited body following an audit, and lasts three years with annual surveillance audits. It is the certification most frequently demanded in enterprise procurement and supplier questionnaires. Several Annex A controls, notably privileged access rights, secret authentication information, and logging and monitoring, map directly onto what a password vault and a PAM solution provide.
Just-in-time access (JIT)
Just-in-time access grants a privilege only when it is needed, for as long as it is needed, and removes it automatically afterwards, in place of accounts that hold administrative rights permanently. A request is made and approved, or granted automatically under policy, the entitlement is created, the work is done, and the entitlement expires. The point is to shrink the window during which a compromised account is worth anything: standing privilege is what an attacker inherits, and administrative rights sit unused the overwhelming majority of the time. It is the principle of least privilege applied to time as well as to scope.
KDF (key derivation function)
A key derivation function turns a human password into a cryptographic key of fixed length. Because passwords are short and guessable, a KDF is deliberately slow and resource-hungry: it applies a large number of iterations, and in modern designs a substantial memory requirement, so that every guess costs an attacker real time and real hardware. This is what stands between a stolen encrypted vault and its contents. Argon2id and PBKDF2 are the two KDFs commonly used for password vaults, with scrypt and bcrypt also found in the wild. Choosing a KDF also means choosing its parameters: iteration count, memory cost, and parallelism. Heimlane Vault derives the master key on the client side using Argon2id (recommended) or PBKDF2.
Lateral movement
Lateral movement is what an attacker does after the initial compromise: pivoting from the first machine or account towards more valuable ones until they reach domain administrator, the hypervisor, or the backups. The techniques rely on what is already lying around, such as reused local administrator passwords, cached credentials, over-privileged service accounts, and unrestricted network paths between workstations and servers. Most of the damage in a ransomware incident is done during this phase rather than at the point of entry. Least privilege, unique credentials on every machine, network segmentation, and routing all administrative access through a bastion are what break the chain.
Least privilege
The principle of least privilege dictates that users, accounts, and processes should only have the minimum permissions necessary to perform their tasks. Applying least privilege reduces the attack surface by limiting what a compromised account can access. In the context of PAM, least privilege means granting administrators access only to the specific servers and applications they need, for the time they need it, with no standing permissions.
Master password
The master password is the single password that unlocks a password vault. In a zero-knowledge design it never leaves the user’s device: it is passed to a key derivation function locally, producing the key that encrypts and decrypts vault contents, and the provider only ever stores ciphertext. The consequence is absolute, and it is the point: nobody, including the vendor, can reset the master password or recover the vault without it. That is why it should be a long, unique passphrase, never reused elsewhere, protected by a second factor, and backed by an emergency access arrangement rather than by a copy left in a browser.
MFA / 2FA
Multi-factor authentication (MFA) and two-factor authentication (2FA) require users to prove their identity using two or more independent factors: something they know (password), something they have (phone, security key), or something they are (biometrics). MFA significantly reduces the risk of account compromise from stolen credentials. OWASP and ANSSI both recommend MFA for any privileged or sensitive access.
MFA fatigue
MFA fatigue, also called push bombing, is an attack in which an adversary who already holds a valid password triggers authentication prompts over and over until the legitimate user approves one out of irritation, confusion, or because it is three in the morning. It defeats simple push-approval MFA precisely because approving requires nothing more than a tap. The mitigations are number matching, which forces the user to read a code from the screen they are actually signing into, rate limiting on prompts, and better still authenticators that are phishing-resistant by construction, such as FIDO2 hardware keys.
MSP / MSSP
A Managed Service Provider (MSP) is a company that remotely manages a customer’s IT infrastructure, typically including servers, networks, endpoints, and security. A Managed Security Service Provider (MSSP) specialises in security operations. MSPs and MSSPs need tools that are multi-tenant by design, allowing them to manage multiple customers from a single platform while maintaining strict data isolation between tenants.
National cybersecurity agencies
National cybersecurity agencies are government bodies that publish security standards, issue advisories, certify products, and coordinate incident response at country or regional level. Their guidance shapes procurement requirements, regulatory frameworks, and the baseline expectations for what “good security” looks like in their jurisdiction. Major agencies you will encounter in the field:
- ACN (Agenzia per la Cybersicurezza Nazionale, Italy) is Italy’s national cybersecurity authority, established in 2021. It coordinates incident response through CSIRT Italia and maintains the Perimetro di Sicurezza Nazionale Cibernetica framework for critical national infrastructure.
- ACSC (Australian Cyber Security Centre, Australia) publishes the Essential Eight, one of the few government frameworks that explicitly ranks security controls by priority and maturity level. Widely cited internationally as a starting point for hardening.
- ANSSI (Agence Nationale de la Sécurité des Systèmes d’Information, France) is France’s national cybersecurity agency. It publishes the Référentiel Général de Sécurité and the CSPN and SecNumCloud certification schemes, and is the essential reference for French public sector procurement and for companies subject to French and European regulation.
- BSI (Bundesamt für Sicherheit in der Informationstechnik, Germany) issues the IT-Grundschutz framework and certifies products under the German national scheme.
- CCN-CERT (Centro Criptológico Nacional, Spain) is Spain’s national cryptologic centre. It publishes the ENS (Esquema Nacional de Seguridad), the mandatory security framework for the Spanish public sector.
- CISA (Cybersecurity and Infrastructure Security Agency, United States) is the US federal operational lead for cyber defence and critical infrastructure protection. Its Known Exploited Vulnerabilities (KEV) catalog is an authoritative reference.
- ENISA (European Union Agency for Cybersecurity) is the EU-wide body that supports member states on policy, capacity building, and the implementation of directives such as NIS2.
- NCSC (National Cyber Security Centre, United Kingdom) is the UK’s authority on cyber threats and best practice. Its Cyber Essentials scheme is a widely adopted baseline certification.
- NIST (National Institute of Standards and Technology, United States) publishes the SP 800-series and the NIST Cybersecurity Framework (CSF), the most globally referenced security standards in the industry.
These agencies often align on core principles (least privilege, defence in depth, audit trails, MFA), so following any one of them tends to satisfy most of the others. Heimlane’s product design references guidance from multiple agencies rather than a single jurisdiction.
NIS2
NIS2 (Network and Information Security Directive 2) is the European Union directive that expands cybersecurity obligations to a broader range of organisations, including mid-sized businesses in essential and important sectors. NIS2 requires measures such as access control, incident reporting, risk management, supply chain security, and accountability at management level. Article 21 specifically addresses access control and privileged access management as required security measures.
PAM
PAM (Privileged Access Management) is the discipline of controlling, monitoring, and auditing access to critical systems by users with elevated permissions (administrators, third-party providers, service accounts). A PAM solution typically includes a bastion or gateway, a password vault, session recording, access policies, and credential injection. PAM addresses the risk that privileged accounts, if compromised, give attackers direct access to an organisation’s most sensitive systems.
Passkey
A passkey is a FIDO2 credential that replaces the password outright rather than adding a second factor to it. The private key lives in the device’s secure hardware or in a synchronised keychain, and the user releases it with a biometric or a device PIN, so signing in involves no shared secret to steal, phish, or reuse. Passkeys are phishing-resistant by construction, because the credential is bound to the site’s origin and the browser refuses to use it anywhere else. Adoption remains uneven: passkeys are excellent where they exist, but most business software still expects a password, so vaults and passkeys will coexist for years rather than one replacing the other.
Password rotation
Password rotation is the practice of changing credentials on a schedule or after a triggering event: an administrator leaving, a provider’s contract ending, a suspected compromise. Blanket periodic rotation of user passwords has fallen out of favour, and both NIST and ANSSI now advise against forcing it without cause, because it pushes people towards predictable variations of the same password. Privileged and shared accounts are a different matter: those credentials are known to several people, rarely tied to one individual, and rotating them after use or on departure is the only reliable way to revoke access. Credential injection makes this practical, since users never see the password and are not inconvenienced when it changes.
Password spraying
Password spraying tries a small number of very common passwords against a large number of accounts, rather than many passwords against a single account. Because each account only sees one or two failed attempts, lockout thresholds are never reached and the attempts blend into background noise. It is a standard opening move against exposed authentication endpoints: RDP gateways, VPN portals, webmail, and directory services. Detecting it requires correlation across accounts rather than per-account counters, and the structural fix is MFA combined with rejecting weak and already-breached passwords at the moment they are chosen.
Password vault
A password vault is an encrypted digital safe that stores passwords, credentials, notes, payment cards, and other sensitive data. A business password vault adds features such as team sharing, access controls, shared vaults, and audit trails. Unlike consumer-grade solutions, a business vault integrates with privileged access management tools to enable credential injection into remote sessions without exposing passwords to users.
PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) is a key derivation function that applies a pseudorandom function (typically HMAC-SHA256) to a password along with a salt, repeated over many iterations, to produce a derived key. The high iteration count (600,000 is the current OWASP recommendation) makes brute-force attacks computationally expensive. PBKDF2 is widely supported across all platforms and remains the default KDF for Bitwarden-compatible clients.
Phishing / adversary-in-the-middle
Phishing is the use of a convincing message and a fake page to obtain credentials from a user. Adversary-in-the-middle (AiTM) is its modern form: instead of harvesting a password for later use, the fake page relays the session to the real service in real time, forwards the MFA challenge to the victim, and captures the resulting session cookie. The account is then accessible without the password and without the second factor. TOTP codes and push notifications do not survive this attack; origin-bound credentials such as FIDO2 and passkeys do, because the browser refuses to sign for a domain that is not the genuine one. A password manager helps as well, since it will not autofill on a domain that does not match.
PKI
PKI (public key infrastructure) is the set of certificate authorities, registration processes, revocation mechanisms, and policies that bind a public key to an identity. It underpins TLS certificates for websites, client certificates for machine and user authentication, code signing, S/MIME email, and SSH certificate authorities. The hard part is not the cryptography but the lifecycle: issuing certificates to the right parties, renewing them before they expire, and revoking them promptly when a key is compromised or a person leaves. Expired certificates remain one of the most reliable causes of self-inflicted outages.
Privileged accounts
Privileged accounts are the accounts with elevated rights on an information system: system administrators, database administrators, service accounts, root accounts. These accounts are prime targets for attackers, because compromising one gives direct access to an organisation’s most sensitive resources. Privileged access management (PAM) aims to control, monitor, and audit the use of these accounts in order to reduce the attack surface.
Ransomware
Ransomware is malware that encrypts an organisation’s data and demands payment for the decryption key, nowadays almost always combined with prior exfiltration so the attacker can extort a second time by threatening publication. Modern incidents are hands-on-keyboard operations rather than a virus spreading on its own: an operator obtains access, often through a stolen credential or an exposed RDP service, escalates privileges, moves laterally, destroys the backups, and only then detonates the payload. This is why credential hygiene, privileged access control, and offline backups determine the outcome far more than the detection that happens at the end of the chain.
RBAC
Role-Based Access Control (RBAC) is an access control method where permissions are assigned to roles rather than to individual users. Users are then assigned to roles based on their job function. RBAC simplifies access management, reduces administrative overhead, and makes it easier to enforce least privilege across an organisation. When an employee changes role, their access changes with their role assignment rather than requiring individual permission updates.
RDP / SSH / VNC
These are the three protocols used for remote administration. RDP (Remote Desktop Protocol, Microsoft) provides graphical access to a Windows desktop or server. SSH (Secure Shell) provides an encrypted command-line session on Linux, Unix, and network equipment, and also carries file transfers and tunnels. VNC (Virtual Network Computing) shares a graphical desktop across platforms and is common on Linux workstations, hypervisors, and appliances. All three are prime targets: exposing RDP or SSH directly to the internet attracts brute-force attempts within hours, which is why they belong behind a bastion that authenticates the user, injects the credentials, and records the session. Heimlane Realm proxies all three in the browser over HTML5, with no client software and no VPN.
Recovery codes
Recovery codes are single-use codes issued when two-factor authentication is enabled, to be used if the second factor is lost: a stolen phone, a wiped authenticator app, a misplaced hardware key. Each code works once. They should be printed or stored somewhere separate from the device and from the vault they protect, since keeping them inside the account they unlock defeats their purpose. Recovery codes are a backup for the second factor only: they do not recover a master password and cannot decrypt a zero-knowledge vault. Heimlane Vault displays a set of recovery codes once, when you enable 2FA.
RSA-2048
RSA-2048 is an asymmetric encryption algorithm that uses a pair of keys (public and private) to encrypt and decrypt data. The 2048-bit key length is considered secure for current use and is recommended by NIST and ANSSI. In password management, RSA is typically used for sharing encrypted data between users: a sender encrypts with the recipient’s public key, and only the recipient’s private key can decrypt it. Heimlane Vault uses RSA-2048 for zero-knowledge team sharing within organisations.
SCIM
SCIM (System for Cross-domain Identity Management) is the standard REST protocol for provisioning user accounts between systems. Where SSO answers the question “may this person sign in”, SCIM answers “does this person have an account at all”: the identity provider pushes account creations, attribute updates, group changes, and above all deactivations to each connected application. Without it, offboarding depends on somebody remembering every tool a departing employee had access to. It is a routine expectation in enterprise procurement and a genuine security control, since dormant accounts belonging to former staff are a recurring root cause in breach reports.
SecNumCloud
SecNumCloud is the qualification issued by ANSSI for cloud service providers. It goes beyond technical controls: it imposes requirements on the legal structure of the provider, which must be immune to non-European extraterritorial law such as the CLOUD Act, and on the location of data, of administration, and of support. It is the reference for French public sector cloud procurement under the “cloud de confiance” doctrine, and increasingly for operators of vital importance and regulated sectors. The qualification is demanding and held by a small number of providers, which is what makes it a meaningful differentiator rather than a checkbox.
Service accounts
A service account is a non-human identity used by an application, a script, a scheduled task, or a piece of infrastructure to authenticate to another system. Service accounts typically outnumber human accounts several times over, hold broad permissions, and carry passwords that were set at deployment and never changed, often because nobody is certain what would break. They are rarely covered by joiner-mover-leaver processes and almost never protected by MFA, which makes them a preferred route for lateral movement. Bringing them into a vault, giving each one a distinct identity, restricting what it may do, and rotating its secret is usually the highest-value privileged access project an organisation can start with.
Session isolation
Session isolation means the administrator’s workstation never talks directly to the target system: the connection is established by an intermediate component, and only pixels and keystrokes travel to the user. A compromised laptop therefore cannot reach the server’s network, malware cannot follow the tunnel, and the credential is never present on the endpoint. Isolation also gives the control point somewhere to enforce clipboard and file transfer rules, and to record the session. A browser-based bastion isolates by construction, since the client is a web page rather than a network path. Heimlane Realm renders RDP, SSH, and VNC sessions in the browser over HTML5, so no direct route from workstation to target is needed.
Session recording
Session recording is the capture and storage of everything that happens during a privileged access session (RDP, SSH, VNC, or web). Recordings may include video of the screen, keystroke logs, command histories, and metadata such as timestamps and user identity. Session recordings provide an auditable trail for compliance, forensic investigation, and real-time monitoring of administrative actions. Heimlane Realm records all privileged sessions with OCR-based event detection for searchable audit trails.
Shadow IT
Shadow IT is any software, service, or device used for work without the knowledge or approval of the IT function: a personal file-sharing account, a departmental SaaS subscription paid by card, an AI assistant handed company data. It grows because the sanctioned tools are slower or missing, not out of malice. The security consequence is that credentials and data end up in systems nobody monitors, that offboarding cannot revoke, and that no incident response plan covers. Providing tools that are genuinely easier than the shadow alternative, and a vault where credentials remain visible to the organisation, addresses more of it than a ban ever will.
SIEM
A SIEM (security information and event management) system collects logs from across an information system, normalises them, correlates events between sources, and raises alerts on patterns that no single source would reveal on its own. It is the tool a security team lives in, and usually the system of record for log retention and incident investigation. Feeding privileged access events into it, meaning who opened which session, on which target, and with which account, is what makes administrative activity visible alongside everything else, typically through syslog, an API, or a CEF-formatted export. Splunk, Elastic, Microsoft Sentinel, and Wazuh are common examples.
SOC 2
SOC 2 is a US audit framework defined by the AICPA that reports on a service organisation’s controls against five trust services criteria: security, availability, processing integrity, confidentiality, and privacy. A Type I report assesses the design of controls at a point in time; a Type II report tests their operating effectiveness over a period, usually six to twelve months, and is the one buyers actually want to see. Unlike ISO 27001 it produces an auditor’s report rather than a certification, and it is the customary requirement in North American procurement where European buyers ask for ISO 27001.
SSO
Single Sign-On (SSO) allows users to authenticate once and gain access to multiple applications without re-entering credentials. SSO improves user experience and reduces password fatigue, but it also concentrates risk: if the SSO provider is compromised, all connected applications are exposed. SSO is typically implemented using protocols such as SAML 2.0 or OpenID Connect.
Supply chain attack
A supply chain attack compromises an organisation through one of its suppliers rather than head-on: a software vendor whose update mechanism is subverted, an open source dependency taken over, or, most commonly for ordinary businesses, a service provider whose remote access to its customers is abused. That third variant is why third-party access deserves the same controls as employee access: named accounts rather than a shared one, access restricted to the systems concerned and to the intervention window, credentials the provider never actually holds, and a recording of what was done. Heimlane Realm was designed with vendor and third-party access in mind.
TLS 1.3
TLS 1.3 (Transport Layer Security, version 1.3) is the most recent version of the protocol that secures communications over the internet. Compared to TLS 1.2, it removes obsolete cipher suites, reduces the handshake to one round trip (improving performance), and mandates Perfect Forward Secrecy (PFS), which means that even if a server’s private key is compromised in the future, past sessions cannot be decrypted.
TOTP
TOTP (Time-based One-Time Password, defined in RFC 6238) is the standard behind the rotating six-digit codes shown by authenticator apps. The service and the app share a secret seed once, usually by scanning a QR code, then each side independently derives the same code from that seed and the current time, normally in 30-second windows. Nothing is sent between them afterwards, so TOTP works offline and does not depend on SMS, which is vulnerable to SIM swapping. TOTP stops attacks based on stolen or reused passwords, but not real-time phishing: a code typed into a fake login page can be replayed by an attacker within its validity window, which is why FIDO2 / WebAuthn hardware keys remain the stronger option for the most sensitive accounts. Heimlane Vault has a built-in authenticator that stores the TOTP seed on the login item and generates the code when you need it, and our free Google Authenticator export decoder lets you move existing seeds out of Google Authenticator into the vault or any other tool.
Zero knowledge
Zero-knowledge architecture means that the service provider has zero ability to access, read, or recover customer data. All encryption and decryption happens on the user’s device (client-side), and the provider only stores encrypted ciphertext. Even if the provider’s servers are breached, the attacker obtains only encrypted data that cannot be decrypted without the user’s master password. The provider cannot reset passwords or recover vaults because they never possess the decryption keys.
Zero trust
Zero trust is a security model based on the principle “never trust, always verify.” Instead of assuming that users or devices inside the network perimeter are trusted, zero trust requires continuous verification of identity, device health, and context for every access request. Zero trust architectures typically combine strong authentication, micro-segmentation, least privilege access, and continuous monitoring. ZTNA (Zero Trust Network Access) implements this model for remote access to applications and resources.
ZTNA
ZTNA (Zero Trust Network Access) replaces traditional VPNs by providing application-level access based on identity and context rather than network-level access. Unlike a VPN, which gives broad access to an entire network, ZTNA grants access only to specific applications the user is authorised to use. ZTNA provides the connectivity layer, while PAM provides the governance layer: who accessed what, when, with which credentials, and what they did during the session.