Identity and Access Terms
Many small business break-ins start with a login: a reused password, a code read out to a fake help desk, or a mailbox with no second factor. These terms cover how accounts are protected and how they get taken over, from multi-factor authentication to account takeover. Each one is explained in plain English with the NIST, CISA, and FBI guidance behind it.
Start here
- Multi-factor authentication (MFA): A login that requires two or more different kinds of proof, such as a password plus a phone app or security key, so a stolen password alone is not enough.
- Least privilege: The principle that every user, device, application, and service account gets only the minimum access needed to do its job.
- Single sign-on (SSO): An authentication process that lets one account and its authenticators unlock many applications, usually through a federation protocol.
- Password spraying: A brute force attack that tries a few common passwords against many accounts, staying under lockout limits to avoid detection.
- Password manager: An application that creates, stores, and fills unique passwords from an encrypted vault unlocked by one master password.
- Account takeover: When a criminal gains control of a legitimate account, such as email, banking, payroll, or a cloud app, and uses it as the owner to steal money or data.
- Session hijacking: Taking over a signed-in user session, usually by stealing its session cookie or token, so the attacker can act as the user without a password or MFA.
Last updated October 14, 2026.