Glossary for Identity Management, Data Security, Data Privacy & GDPR-compliance

An adequacy decision confirms that a third country has a level of data protection comparable to that of the EU.

Infringement of applicable data protection rules and regulations does not only result in liability to any person having suffered damages but may also cause the imposition of penalties and administrative fees by the supervisory authorities.

Advanced Encryption Standard (AES256) is a way of encrypting data so that unauthorized people cannot read it. For all data, which needs to be persistently stored, and which needs to be readable by us, we use this industry standard of “symmetric-key encryption”.

Engity stores passwords (and other secrets) using this award-winning hashing algorithm, which is currently one of the securest known algorithms for that purpose. Hereby, Argon2 is an improved password hashing function that offers a degree of “memory hardness” and password protection by using one-way encryption. It is suitable for applications with credential storage, key derivation, or any other purpose where password hashing is needed. Argon2 uses the XTEA encryption algorithm and 256-bit key to produce a 32-byte hash.

Two different keys are used for encryption and decryption.

Authentication is used to verify identities and plays an important role in data protection.

Engity's open-source SSH server alternative.

An attempt to gain unauthorized access to a system – or data – by simply trying out all possible combinations of access credentials.

Data protection regulations must be seamlessly integrated into business processes.

Checking who is making entries into internet forms with the help of Captchas.

The Cookie Consent informs users of a website or service about how cookies are used on the site and asks for informed consent.

Using stolen login data to access accounts on other services.

Cybersecurity is the protection of computers, servers and other online systems against targeted attacks.

Dark patterns are user interface (UI) practices that nudge users to do what's best for the provider, not necessarily the user themselves.

An Data Processing Agreement defines the rights and obligations between the processor and controller.

Data Protection is the idea of preventing the misuse of personal data.

Compliance with data protection regulations in a company can be checked by an external authority by means of a data protection audit.

A Data Protection Officer (DPO) advises companies or organizations on data protection topics.

A Data Transfer is a transfer of personal data from one person or organization to another.

Digital Services Act, to complete the digital single market.

The Elliptic Curve Digital Signature is an industry standard for e.g. signing tokens.

A mechanism to align differences in EU-US data protection standards that allows data transfers to the US.

The highest court in the EU, the European Court of Justice (ECJ), is also responsible for interpreting the GDPR - which has repeatedly led to spectacular decisions.

The European Data Protection Supervisor (EDPS) is the highest supervisory authority for Data Protection within the EU and is responsible for citizens' data protection rights.

The GDPR applies directly in every EU member state and aims to protect the fundamental rights and freedoms of natural persons.

Hooks as an interface for integrating external program code.

In Identity and Access Management (IAM), an identity is a representation of a user with certain access right to resources.

With an identity and access management system, users can be administrated and their access controlled.

An Identity Provider (IdP) provides authentication and authorization services for users.

In case of a data protection breach, the data controller can be held liable.

The server location often determines which laws are applicable to data processing - but it is not the only criterion.

A lock-out function is a security mechanism in IAM or access management that denies access to a system or user account after a certain number of failed login attempts.

Keeping pace with IT technology and saving costs and resources with managed services.

Multi-factor authentication (MFA) combines various factors when verifying the identity of a user asking for access to a system or resource.

A password that can only be used once is called a one-time password.

Software where the source code is available in a free, open and understandable form is referred to as open source.

OpenID Connect as a secure system for verifying the identity of an end user.

Secure authentication using asymmetric cryptography and the challenge-response method.

A passphrase is a sequence of words strung together used as a password while being easy to remember.

A password is a key in the form of "something the user knows" that gives access to digital accounts, devices, or information.

By using a password generator, strong passwords can be created.

A password manager is a tool that securely stores and manages a user’s login credentials.

A password reset is the process of replacing a forgotten or compromised password with a new one.

The attempt to gain unauthorized access to user accounts by trying a few commonly used passwords against many usernames or email addresses.

A password strength checker is a tool that accesses the strength of a password – as the name suggests.

The Privacy Shield is a legal framework addressing transfers of personal data between the EU and the US.

Safe Harbor was an inadequate tool for transferring personal data from the EU to the US.

The term scalability means the ability to adapt an IT installation or system.

Schrems I and II are two judgements by the European Court of Justice (ECJ) that invalidated the transfer tools Safe Harbor and Privacy Shield.

A server is usually a computer on the Internet that provides data so that other devices can access this data.

Single sign-on (or "SSO" in short) is a centralized authentication method that lets users access multiple applications or systems using a single set of login credentials.

SSH as a network protocol enables remote access via an encrypted connection.

Standard Contractual Clauses (SCCs) are a contractual tool enabling data transfers between the EU and third countries.

The same key is used for both encryption and decryption.

TOMs are technical and organizational measures to protect personal data and make data processing compliant to the GDPR.

A Transfer Impact Assessment (TIA) is a risk assessment regarding data transfers to third countries, in particular when SCC are being used as a transfer tool.

TLS is an Internet security protocol and the successor to SSL.

The US Cloud Act is a law that gives American intelligence and law enforcement authorities wide-ranging access to personal data, including data of European citizens.