Deck Two Flashcards
(36 cards)
The interconnection of electronic devices embedded in everyday or specialized objects, enabling them to sense, collect, process, and transmit data. IoT devices include wearable fitness trackers, “smart” appliances, home automation devices, wireless health devices, and cars—among many others.
Internet of Things (IoT)
A system or software that monitors and analyzes network or system events for the purpose of finding and providing real-time or near real-time warning of attempts to access system resources in an unauthorized manner. In addition, intrusion prevention systems can also attempt to stop the activity, ideally before it reaches its targets.
Intrusion Detection System/Intrusion Prevention System
A computer program that is covertly placed onto a computer or electronic device with the intent to compromise the confidentiality, integrity, or availability of data, applications, or operating systems. Common types of malware include viruses, worms, malicious mobile code, Trojan horses, rootkits, spyware, and some forms of adware.
Malware
Authentication using two or more different factors to provide increased security during log-ins. Factors may include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).
Multi-factor Authentication/Two-Factor Authentication/Dual Factor Authentication
An information system implemented with a collection of interconnected components such as computers, routers, hubs, cabling, and telecommunications controllers.
Network
Splitting a network into sub-networks, for example, by creating separate areas on the network which are protected by firewalls configured to reject unnecessary traffic. Network segmentation minimizes the harm of malware and other threats by isolating it to a limited part of the network.
Network Segmentation
A widely used, risk-based approach to managing cybersecurity composed of three parts: the Framework Core, the Framework Profile, and the Framework Implementation Tiers. The Cybersecurity Framework includes references to standards, guidelines, and best practices. The Framework is voluntary for private sector use; federal agencies must use this risk management approach.9
NIST Cybersecurity Framework
The software “master control application” that runs a computer or electronic device.
Operating System
The software “master control application” that runs a computer or electronic device.
Operating System
A secret sequence of words or other text used to authenticate a person’s or system’s identity. A passphrase is similar to a password but is generally longer for added security.
Passphrase
A secret string of characters (letters, numbers, and other symbols) used to authenticate an identity, to verify access authorization or to derive cryptographic keys.
Passwords
A “repair job” for a piece of programming, also known as a “fix.” When a software developer or distributor learns of a security weakness, a patch is the usual immediate solution that is provided to users and can sometimes be downloaded from the software maker’s web site.
Patch
Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using the same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.
Penetration Testing
Information which can be used to distinguish or trace the identity of an individual (e.g., name, social security number, biometric records, etc.) alone, or when combined with other personal or identifying information which is linkable to a specific individual (e.g., date and place of birth, mother’s maiden name, etc.).
Personally Identifiable Information (PII)
A technique for attempting to acquire sensitive data, such as bank account numbers, or access to a larger computerized system through a fraudulent solicitation in email or on a web site. The perpetrator typically masquerades as a legitimate business or reputable person.
Phishing
Physical measures, policies, and procedures to protect an entity’s electronic information systems and related buildings and equipment from natural/environmental hazards and unauthorized intrusion.
Physical Security/Safeguards
Digital privacy is more than the security of personal information. It also covers the processing of information about individuals for a business’ operational purposes throughout the information lifecycle (from collection through disposal) and addressing risks that this processing could create for these individuals. These problems could range from embarrassment, discrimination, or loss of autonomy to more tangible harms such as identity theft or physical harm.
Privacy
A type of malware that attempts to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid.10
Ransomware
Access to an organization’s information system by a user (or a process acting on behalf of a user) communicating through an external network (e.g., the Internet).
Remote Access
The extent to which an entity is threatened by a potential circumstance or event. Risk typically is a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Information system-related security risks arise from the loss of confidentiality, integrity, or availability of information or information systems. These risks reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.
Risk
The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation. Risk management includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.
Risk Management
Router
A device that allows communication between different networks. Routers determine the best path for forwarding data to its destination.
Forms of electronic communications, including websites and applications, that enable users to create and share content or to participate in social networking.
Social Media
Electronic junk mail or the abuse of electronic messaging systems to indiscriminately send unsolicited bulk messages.
Spam
