Identity-Security
Business Email Compromise (BEC) Financial Verification Playbook — Enterprise Prevention Framework
An enterprise-grade prevention playbook for Business Email Compromise (BEC) and invoice payment redirection fraud. This SECMONS guide outlines structured verification controls, identity protections, and financial workflow safeguards.
Credential Dumping — Post-Exploitation Identity Compromise Technique
Credential dumping is a post-exploitation technique used to extract authentication material from compromised systems. This SECMONS record explains how credential dumping works, its role in enterprise intrusions, and defensive detection strategies.
Access Control — Enforcing Who Can Access What in a System
Access Control is the security discipline that defines and enforces who can access systems, data, and resources. This SECMONS glossary entry explains access control models, common failures, and how broken enforcement leads to major security incidents.
Authentication vs Authorization — Verifying Identity vs Granting Access
Authentication and Authorization are distinct security concepts: authentication verifies identity, while authorization determines access rights. This SECMONS glossary entry explains the difference, common implementation flaws, and how misconfigurations lead to security incidents.
Brute Force & Password Spraying — Systematic Credential Guessing Attacks
Brute Force and Password Spraying are credential-based attack techniques that attempt to gain unauthorized access by systematically guessing passwords. This SECMONS glossary entry explains how these attacks differ, how they are detected, and how organizations mitigate identity abuse.
Credential Stuffing — Automated Account Takeover Using Reused Passwords
Credential stuffing is an automated attack technique where attackers use previously leaked username and password combinations to attempt login across multiple services. This SECMONS glossary entry explains how credential stuffing works, why password reuse fuels it, and how defenders can detect and mitigate it.
Multi-Factor Authentication (MFA) — Adding Layers to Account Security
Multi-Factor Authentication (MFA) is a security control that requires users to provide two or more verification factors to gain access to an account or system. This SECMONS glossary entry explains how MFA works, its role in preventing credential-based attacks, and common bypass techniques attackers attempt.
Session Hijacking — Taking Over Authenticated User Sessions
Session Hijacking is an attack technique where an attacker takes control of a valid user session by stealing or predicting session identifiers. This SECMONS glossary entry explains how session hijacking works, common attack methods, real-world impact, and defensive mitigation strategies.
Zero Trust — Security Model Based on Continuous Verification and Least Privilege
Zero Trust is a security model that assumes no user, device, or system is inherently trusted, even inside the network perimeter. This SECMONS glossary entry explains Zero Trust principles, architectural components, and how it reduces attack surface and lateral movement risk.