ITPROTV Security Glossary Flashcards
(367 cards)
1
Q
6to4
A
Transition mechanism for migrating from IPv4 to IPv6 . It allows systems to use IPv6 to communicate if their traffic has to transverse an IPv4 network .
2
Q
Absolute addresses
A
Hardware addresses used by the CPU .
3
Q
Abstraction
A
The capability to suppress unnecessary details so the important, inherent properties can be examined and reviewed .
4
Q
Accepted ways for handling risk
A
Avoid, accept, transfer (share), mitigate, recast .
5
Q
Access
A
The flow of information between a subject and an object .
6
Q
Access control
A
security features that control how users and systems communicate and interact with other systems and resources .
7
Q
Access control list (ACL)
A
Mechanism implementing discretionary and/or mandatory access control between subjects and objects .
8
Q
Access Control Matrix
A
A table of subjects and objects indicating what actions individual subjects can take upon individual objects .
9
Q
Access control mechanism
A
Security safeguard designed to detect and deny unauthorized access and permit authorized access in an information system.
10
Q
Access Control Model
A
A framework that dictates how subjects access objects .
11
Q
Access level
A
Hierarchical portion of the security level used to identify the sensitivity of information system data and the clearance or authorization of users . Access level, in conjunction with the nonhierarchical categories, forms the sensitivity label of an object .
12
Q
Access list
A
(IS) Compilation of users, programs, or processes and the access levels and types to which each is authorized . (COMSEC) Roster of individuals authorized admittance to a controlled area .
13
Q
Access profile
A
Associates each user with a list of protected objects the user may access .
14
Q
Access type
A
– Privilege to perform action on an object . Read, write, execute, append, modify, delete, and create are examples of access types .
15
Q
Accountability
A
(IS) Process of tracing information system activities to a responsible source . (COMSEC) Principle that an individual is entrusted to safeguard and control equipment, keying material, and information and is answerable to proper authority for the loss or misuse of that equipment or information .
16
Q
Accreditation
A
Formal acceptance of the adequacy of a system’s overall security by management .
17
Q
Accrediting authority
A
Synonymous with Designated Accrediting Authority (DAA) .
18
Q
ActiveX
A
– A Microsoft technology composed of a set of OOP technologies and tools based on COM and DCOM . It is a framework for defining reusable software components in a programming language-independent manner
19
Q
Address bus
A
Physical connections between processing components and memory segments used to communicate the physical memory addresses being used during processing procedures .
20
Q
Address Resolution Protocol (ARP) –
A
A networking protocol used for resolution of network layer IP addresses into link layer MAC addresses .
21
Q
Address space layout randomization (ASLR)
A
Memory protection mechanism used by some operating systems . The addresses used by components of a process are randomized so that it is harder for an attacker to exploit specific memory vulnerabilities .
22
Q
Adequate security
A
Security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information . This includes assuring that information systems operate effectively and provide appropriate confidentiality, integrity, and availability, through the use of cost-effective management, personnel, operational, and technical controls . (OMB Circular A-130)
23
Q
Advanced Encryption Standard (AES)
A
FIPS approved cryptographic algorithm that is a symmetric block cipher using cryptographic key sizes of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits
24
Q
Advisory
A
– Notification of significant new trends or developments regarding the threat to the information system of an organization . This notification may include analytical insights into trends, intentions, technologies, or tactics of an adversary targeting information systems .
25
Alert
Notification that a specific attack has been directed at the information system of an organization .
26
Algebraic attack –
Cryptanalysis attack that exploits vulnerabilities within the intrinsic algebraic structure of mathematical functions .
27
Algorithm
Set of mathematical and logic rules used in cryptographic functions .
28
Analog signals
Continuously varying electromagnetic wave that represents and transmits data .
29
Analytic attack
Cryptanalysis attack that exploits vulnerabilities within the algorithm structure .
30
Annualized loss expectancy (ALE) –
Annual expected loss if a specific vulnerability is exploited and how it affects a single asset . SLE x ARO = ALE .
31
Application
Software program that performs a specific function directly for a user and can be executed without access to system control, monitoring, or administrative privileges .
32
Application programming interface (API)
Software interface that enables process-to-process interaction . Common way to provide access to standard routines to a set of software programs .
33
Arithmetic logic unit (ALU) –
Component of the CPU that carries out logic and mathematical functions as they are laid out in the programming code being processed by the CPU .
34
Assemblers
Tools that convert assembly code into the necessary machine-compatible binary language for processing activities to take place .
35
Assembly language
A low-level programming language that is the mnemonic representation of machine-level instructions .
36
Assurance
Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy .
37
Assurance evaluation criteria
Check-list and process of examining the security-relevant parts of a system (TCB, reference monitor, security kernel) and assigning the system an assurance rating .
38
Asymmetric algorithm
– Encryption method that uses two different key types, public and private . Also called public key cryptography
39
Asymmetric mode multiprocessing
When a computer has two or more CPUs and one CPU is dedicated to a specific program while the other CPUs carry out general processing procedures .
40
Asynchronous communication
Transmission sequencing technology that uses start and stop bits or similar encoding mechanism . Used in environments that transmit a variable amount of data in a periodic fashion .
41
Asynchronous token-generating method
Employs a challenge/response scheme to authenticate the user .
42
Attack
Attempt to gain unauthorized access to an information system’s services, resources, or information, or the attempt to compromise an information system’s integrity, availability, or confidentiality .
43
Attack surface
Components available to be used by an attacker against the product itself .
44
Attenuation
Gradual loss in intensity of any kind of flux through a medium . As an electrical signal travels down a cable, the signal can degrade and distort or corrupt the data it is carrying .
45
Attribute
A column in a two-dimensional database .
46
Audit
Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures, and to recommend necessary changes in controls, policies, or procedures .
47
Audit trail
Chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event .
48
Authenticate –
To verify the identity of a user, user device, or other entity, or the integrity of data stored, transmitted, or otherwise exposed to unauthorized modification in an information system, or to establish the validity of a transmission .
49
Authentication
Security measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual’s authorization to receive specific categories of information .
50
Authentication header (AH) protocol
– Protocol within the IPSec suite used for integrity and authentication .
51
Authentication system
Cryptosystem or process used for authentication .
52
Authenticator
Means used to confirm the identity of a station, originator, or individual .
53
Authenticode
A type of code signing, which is the process of digitally signing software components and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was digitally signed . Authenticode is Microsoft’s implementation of code signing .
54
Authorization
Access privileges granted to a user, program, or process .
55
Availability
– Reliable and timely access to data and resources is provided to authorized individuals .
56
Avalanche effect –
Algorithm design requirement so that slight changes to the input result in drastic changes to the output .
57
Back door
Hidden software or hardware mechanism used to circumvent security controls . Synonymous with trap door .
58
Backup
Copy of files and programs made to facilitate recovery, if necessary .
59
Banner
Display on an information system that sets parameters for system or data use .
60
Base registers
Beginning of address space assigned to a process . Used to ensure a process does not make a request outside its assigned memory boundaries
61
Baseband transmission –
– Uses the full bandwidth for only one communication channel and has a low data transfer rate compared to broadband .
62
Bastion host
A highly exposed device that will most likely be targeted for attacks, and thus should be properly locked down .
63
Behavior blocking
Allowing the suspicious code to execute within the operating system and watches its interactions with the operating system, looking for suspicious activities .
64
Bell-LaPadula
A formal state transition model of computer security policy that describes a set of access control rules that uses security labels on objects and clearances for subjects . It was developed by David E . Bell and Leonard J . LaPadula . Bell-LaPadula security model is for meeting the confidentiality security objective only .
65
Biba
A formal state transition access control security model that focuses on data integrity in an information system . In general, Biba integrity model has three goals – Prevent data modification by unauthorized subject, prevent unauthorized data modification by authorized subject, and maintain internal and external consistency . It is defined by Kenneth J . Biba .
66
Binding
Process of associating a specific communications terminal with a specific cryptographic key or associating two related elements of information
67
Biometrics
Automated methods of authenticating or verifying an individual based upon a physical or behavioral characteristic .
68
Birthday attack –
A type of cryptographic attack that exploits the mathematics behind the birthday problem in probability theory . This attack can be used to abuse communication between two or more parties . The attack depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations) .
69
Bit error rate
Ratio between the number of bits incorrectly received and the total number of bits transmitted in a telecommunications system .
70
Block cipher
Symmetric algorithm type that encrypts chunks (blocks) of data at a time .
71
Blowfish –
– Block symmetric cipher that uses 64-bit block sizes and variable-length keys .
72
Border Gateway Protocol (BGP)
The protocol that carries out core routing decisions on the
Internet . It maintains a table of IP networks, or “prefixes,” which designate network reachability among autonomous systems .
73
Bots
– Software applications that run automated tasks over the Internet, which perform tasks that are both simple and structurally repetitive . Malicious use of bots is the coordination and operation of an automated attack by a botnet (centrally controlled collection of bots) .
74
Boundary
Software, hardware, or physical barrier that limits access to a system or part of a system .
75
Broadband transmission
Divides the bandwidth of a communication channel into many channels, enabling different types of data to be transmitted at one time .
76
Browsing
– Act of searching through information system storage to locate or acquire information, without necessarily knowing the existence or format of information being sought .
77
Buffer overflow
– Too much data is put into the buffers that make up a stack . Common attack vector used by hackers to run malicious code on a target system .
78
Bulk encryption
Simultaneous encryption of all channels of a multichannel telecommunications link .
79
Bus topology
Systems are connected to a single transmission channel (i .e ., network cable), forming a linear construct .
80
Business continuity management (BCM)
the overarching approach to managing all aspects of BCP and DRP .
81
Business Continuity Plan (BCP)
Contains strategy documents that provide detailed procedures that ensure critical business functions are maintained and that help minimize losses of life, operations, and systems . A BCP provides procedures for emergency responses, extended backup operations, and post-disaster recovery .
82
Business Impact Analysis (BIA)
A systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency .
83
Cable modem
A device that provides bidirectional data communication via radio frequency channels on cable TV infrastructures . Cable modems are primarily used to deliver broadband Internet access to homes .
84
Cache memory
Fast memory type that is used by a CPU to increase read and write operations .
85
Caesar Cipher
Simple substitution algorithm created by Julius Caesar that shifts alphabetic values three positions during its encryption and decryption processes
86
Call back –
Procedure for identifying and authenticating a remote information system terminal, whereby the host system disconnects the terminal and reestablishes contact . Synonymous with dial back .
87
Capability Maturity Model Integration (CMMI) model
A process improvement approach that provides organizations with the essential elements of effective processes, which will improve their performance .
88
Capability Table
A capability table specifies the access rights a certain subject possesses pertaining to specific objects . A capability table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL .
89
Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)
Used with Wireless Networks . Carrier sense (CS): The initial idea is that participants may only send data over the network if the transmission medium is free . The carrier status detection checks the channel any time, and data is not sent until it’s available .
Multiple access (MA): Several stations share a transmission medium . It is crucial for functioning communication that all of them adhere to a binding protocol .
Collision avoidance (CA): A complex schedule tries to ensure that two or more participants do not start a transmission at the same time to avoid collisions . If overlapping does occur, this will be detected and the transmission will be tried again .
90
Carrier Sense Multiple Access with Collision Setection (CSMA/CD)
Used in Wired Ethernet networks .
Carrier sense (CS): The carrier state detection makes sure that all network participants check whether the medium is currently free – only then does the protocol initiate data transmission Multiple access (MA): Several participants (computers connected to the network) share a transmission medium
Collision detection (CD): The collision detection is an extension of the original protocol and regulates how to proceed in case data packets happen to collide .
91
CBC-MAC
Cipher block chaining message authentication code uses encryption for data integrity and data origin authentication .
92
Cell
An intersection of a row and a column .
93
Cell suppression
A technique used to hide specific cells that contain sensitive information .
94
Central office
The physical building used to house inside plant equipment including telephone switches, which make telephone calls “work” in the sense of making connections and relaying the speech information .
95
Central processing unit (CPU)
A silicon component made up of integrated chips with millions of transistors that carry out the execution of instructions within a computer .
96
Certificate
Digital identity used within a PKI . Generated and maintained by a certificate authority and used for authentication .
97
Certificate management
– Process whereby certificates are generated, stored, protected, transferred, loaded, used, and destroyed .
98
Certificate Revocation List (CRL) –
List that is maintained by the certificate authority of a PKI that contains information on all of the digital certificates that have been revoked .
99
Certification
Technical evaluation of the security components and their compliance to a predefined security policy for the purpose of accreditation .
100
Certification authority (CA) –
– (C&A) Official responsible for performing the comprehensive evaluation of the security features of an information system and determining the degree to which it meets its security requirements . (PKI) Trusted entity authorized to create, sign, and issue public key certificates . By digitally signing each certificate issued, the user’s identity is certified, and the association of the certified identity with a public key is validated .
101
Certification package
– Product of the certification effort documenting the detailed results of the certification activities .
102
Certifier
Individual responsible for making a technical judgment of the system’s compliance with stated requirements, identifying and assessing the risks associated with operating the system, coordinating the certification activities, and consolidating the final certification and accreditation packages .
103
Challenge and reply authentication
Prearranged procedure in which a subject requests authentication of another and the latter establishes validity with a correct reply .
104
Change control
– The process of controlling the changes that take place during the life cycle of a system and documenting the necessary change control activities .
105
Channel Service Unit (CSU)
A line bridging device for use with T-carriers, and that is required by PSTN providers at digital interfaces that terminate in a Data Service Unit (DSU) on the customer side . The DSU is a piece of telecommunications circuit terminating equipment that transforms digital data between telephone company lines and local equipment .
106
Check word
Cipher text generated by cryptographic logic to detect failures in cryptography .
107
Checklist test
Determines if sufficient supplies are stored at the backup site, telephone number listings are current, quantities of forms are adequate, and a copy of the recovery plan and necessary operational manuals are available . Under this testing technique, the recovery team reviews the plan and identifies key components that should be current and available . The checklist test ensures that the organization complies with the requirements of the disaster recovery plan .
108
Checksum
Value computed on data to detect error or manipulation during transmission .
109
Chosen-ciphertext attack
– Cryptanalysis attack where the attacker chooses a ciphertext and obtains its decryption under an unknown key .
110
Chosen-plaintext attack
Cryptanalysis attack where the attacker can choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts .
111
Cipher
Another name for algorithm .
112
Cipher text
Enciphered information .
113
Ciphertext-only attack
Cryptanalysis attack where the attacker is assumed to have access only to a set of ciphertexts .
114
Clark-Wilson –
A formal security model to preserve information integrity in an information system . The model focuses on “well-formed” transaction using a set of enforcement and certification rules . It is developed by David D . Clark and David R . Wilson .
115
Classless Interdomain Routing (CIDR)
Variable-length subnet masking, which allows a network to be divided into different-sized subnets . The goal is to increase the efficiency of the use of IP addresses since classful addressing schemes commonly end up in unused addresses .
116
Clearance
Formal security determination by an authorized adjudicative office that an individual is authorized access, on a need to know basis, to a specific level of collateral classified information (TOP SECRET, SECRET, CONFIDENTIAL) .
117
Client-side validation
Input validation is done at the client before it is even sent back to the server to process .
118
Clipping Level
A threshold .
119
Closed security environment
– Environment providing sufficient assurance that applications and equipment are protected against the introduction of malicious logic during an information system life cycle . Closed security is based upon a system’s developers, operators, and maintenance personnel having sufficient clearances, authorization, and configuration control
120
Closed system
– Designs are built upon proprietary procedures, which inhibit interoperability capabilities .
121
Cloud computing
The delivery of computer processing capabilities as a service rather than as a product, whereby shared resources, software, and information are provided to end users as a utility . Offerings are usually bundled as an infrastructure, platform, or software .
122
CMAC
Cipher message authentication code that is based upon and provides more security compared to CBC-MAC .
123
CobiT
Set of control objectives used as a framework for IT governance developed by Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI) .
124
Cognitive passwords
Fact or opinion based information used to verify an individual’s identity .
125
Cold site
Is just a building with power, raised floors, and utilities . No devices are available . This is the cheapest of the three options, but can take weeks to get up and operational .
126
Cold start
– Procedure for initially keying crypto-equipment .
127
Collaborative computing
Applications and technology (e .g . , whiteboarding, group conferencing) that allow two or more individuals to share information real time in an inter- or intra-enterprise environment .
128
Collision
When two different messages are computed by the same hashing algorithm and the same message digest value results .
129
Collusion –
Two or more people working together to carry out fraudulent activities .
130
Common Criteria
– Common Criteria (ISO 15408) - International standard used to assess the effectiveness of the security controls built into a system from functional and assurance perspectives .
131
Communications security (COMSEC) –
Measures and controls taken to deny unauthorized individuals information derived from telecommunications and to ensure the authenticity of such telecommunications . Communications security includes cryptosecurity, transmission security, emission security, and physical security of COMSEC material .
132
Community risk
– Probability that a particular vulnerability will be exploited within an interacting population and adversely impact some members of that population .
133
Compartmentalization –
A nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone .
134
Compartmented mode –
Mode of operation wherein each user with direct or indirect access to a system, its peripherals, remote terminals, or remote hosts has all of the following – (a) valid security clearance for the most restricted information processed in the system; (b) formal access approval and signed nondisclosure agreements for that information which a user is to have access; and (c) valid need-to-know for information which a user is to have access .
135
Compilers
Tools that convert high-level language statements into the necessary machine-level format ( .exe, .dll, etc .) for specific processors to understand .
136
Compression viruses
– Another type of virus that appends itself to executables on the system and compresses them by using the user’s permissions .
137
Compromise
Type of incident where information is disclosed to unauthorized individuals or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred .
138
Computer abuse
– Intentional or reckless misuse, alteration, disruption, or destruction of information processing resources .
139
Computer cryptography
Use of a crypto-algorithm program by a computer to authenticate or encrypt/decrypt information .
140
Computer security
Measures and controls that ensure confidentiality, integrity, and availability of information system assets including hardware, software, firmware, and information being processed, stored, and communicated .
141
Computer security incident
See incident .
142
Computer security subsystem
Hardware/software designed to provide computer security features in a larger system environment . Computing environment Workstation or server (host) and its operating system, peripherals, and applications .
143
Concealment Cipher
– Encryption method that hides a secret message within an open message .
144
Concept of operations (CONOP)
– Document detailing the method, act, process, or effect of using an information system
145
Confidentiality
– Necessary level of secrecy is enforced and unauthorized disclosure is prevented .
146
Configuration control
Process of controlling modifications to hardware, firmware, software, and documentation to ensure the information system is protected against improper modifications prior to, during, and after system implementation .
147
Configuration management
– Management of security features and assurances through control of changes made to hardware, software, firmware, documentation, test, test fixtures, and test documentation throughout the life cycle of an information system
148
Confusion
Substitution processes used in encryption functions to increase randomness .
149
Contamination
Type of incident involving the introduction of data of one security classification or security category into data of a lower security classification or different security category .
150
Content-based access
Bases access decisions on the sensitivity of the data, not solely on subject identity .
151
Context-based access
Bases access decisions on the state of the situation, not solely on identity or content sensitivity .
152
Contingency key
Key held for use under specific operational conditions or in support of specific contingency plans . (See reserve keying material .)
153
Continuity of operations plan
Plan for continuing an organization’s (usually a (COOP) headquarters element) essential functions at an alternate site and performing those functions for the duration of an event with little or no loss of continuity before returning to normal operations .
154
Control
Safeguard that is put in place to reduce a risk, also called a countermeasure .
155
Control Categories
Administrative, technical (logical), and physical
156
Control unit
Part of the CPU that oversees the collection of instructions and data from memory and how they are passed to the processing components of the CPU .
157
Controlled access area –
Physical area (e .g ., building, room, etc .) to which only authorized personnel are granted unrestricted access . All other personnel are either escorted by authorized personnel or are under continuous surveillance .
158
Controlled access protection
– Minimum set of security functionality that enforces access control on individual users and makes them accountable for their actions through login procedures, auditing of security-relevant events, and resource isolation .
159
Controlled cryptographic item (CCI)
Secure telecommunications or information handling equipment, or associated cryptographic component, that is unclassified but governed by a special set of control requirements . Such items are marked “CONTROLLED CRYPTOGRAPHIC ITEM” or, where space is limited, “CCI .”
160
Controlled interface
Mechanism that facilitates the adjudication of different interconnected system security policies (e .g ., controlling the flow of information into or out of an interconnected system) .
161
Controlled space
– Three-dimensional space surrounding information system equipment, within which unauthorized individuals are denied unrestricted access and are either escorted by authorized individuals or are under continuous physical or electronic surveillance .
162
Controlling authority
– Official responsible for directing the operation of a cryptonet and for managing the operational use and control of keying material assigned to the cryptonet . Cookies – Data files used by web browsers and servers to keep browser state information and browsing preferences .
163
Cooperative multitasking
Multitasking scheduling scheme used by older operating systems to allow for computer resource time slicing .
164
Copyright
– Protects the expression of ideas rather than the ideas themselves .
165
COSO –
– Internal control model used for corporate governance to help prevent fraud developed by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission .
166
Cost/benefit analysis
Calculating the value of a control . (ALE before implementing a control) - (ALE after implementing a control) - (annual cost of control) = value of control .
167
Countermeasure
Action, device, procedure, technique, or other measure that reduces the vulnerability of an information system .
168
Covert channel
Unintended and/or unauthorized communications path that can be used to transfer information in a manner that violates an information system security policy .
169
Covert channel analysis
Determination of the extent to which the security policy model and subsequent lower-level program descriptions may allow unauthorized access to information .
170
Covert storage channel
– Covert channel involving the direct or indirect writing to a storage location by one process and the direct or indirect reading of the storage location by another process . Covert storage channels typically involve a finite resource (e .g ., sectors on a disk) that is shared by two subjects at different security levels .
171
Covert timing channel
– Covert channel in which one process signals information to another process by modulating its own use of system resources (e .g ., central processing unit time) in such a way that this manipulation affects the real response time observed by the second process . CRAMM – Central Computing and Telecommunications Agency Risk Analysis and Management Method .
172
Credentials
Information, passed from one entity to another, used to establish the sending entity’s access rights .
173
Cross domain solution
Information assurance solution that provides the ability to access or transfer information between two or more security domains .
174
Cross-site scripting (XSS) attack
An attack where a vulnerability is found on a web site that allows an attacker to inject malicious code into a web application .
175
Crosstalk –
A signal on one channel of a transmission creates an undesired effect in another channel by interacting with it . The signal from one cable “spills over” into another cable .
176
Cryptographic hash function
A special class of hash function that has certain properties which make it suitable for use in cryptography . It is a mathematical algorithm that maps data of arbitrary size to a bit string of a fixed size (a hash) and is designed to be a one-way function, that is, a function which is infeasible to invert . The input data is often called the message, and the output (the hash value or hash) is often called the message digest or simply the digest .
177
Cryptanalysis
Practice of uncovering flaws within cryptosystems .
178
Cryptography –
Science of secret writing that enables an entity to store and transmit data in a form that is available only to the intended individuals .
179
Cryptology –
The study of both cryptography and cryptanalysis .
180
Cryptosystem
– Hardware or software implementation of cryptography that contains all the necessary software, protocols, algorithms, and keys .
181
Cyclic redundancy check
Error checking mechanism that checks data integrity by computing a polynomial algorithm based checksum .
182
Data aggregation
Compilation of unclassified individual data systems and data elements that could result in the totality of the information being classified or of beneficial use to an adversary .
183
Data bus
Physical connections between processing components and memory segments used to transmit data being used during processing procedures .
184
Data custodian
– Individual responsible for implementing and maintaining security controls to meet security requirements outlined by data owner .
185
Data dictionary
Central repository of data elements and their relationships .
186
Data diddling
The act of willfully modifying information, programs, or documentation in an effort to commit fraud or disrupt production .
187
Data Encryption Standard (DES)
– A symmetric-key algorithm for the encryption of data . DES is the archetypal block cipher—an algorithm that takes a fixed-length string of plaintext bits and transforms it through a series of complicated operations into another ciphertext bitstring of the same length . In the case of DES, the block size is 64 bits . DES also uses a key to customize the transformation, so that decryption can supposedly only be performed by those who know the particular key used to encrypt . The key ostensibly consists of 64 bits; however, only 56 of these are actually used by the algorithm . Eight bits are used solely for checking parity, and are thereafter discarded . Hence the effective key length is 56 bits .
188
Data execution prevention (DEP)
Memory protection mechanism used by some operating systems . Memory segments may be marked as non-executable so that they cannot be misused by malicious software .
189
Data flow control
Synonymous with information flow control .
190
Data hiding
Use of segregation in design decisions to protect software components from negatively interacting with each other . Commonly enforced through strict interfaces .
191
Data integrity
Condition existing when data is unchanged from its source and has not been accidentally or maliciously modified, altered, or destroyed .
192
Data mining
– Otherwise known as knowledge discovery in database (KDD), which is the process of massaging the data held in the data warehouse into more useful information .
193
Data modeling –
Considers data independently of the way the data are processed and of the components that process the data . A process used to define and analyze data requirements needed to support the business processes .
194
Data origin authentication
Corroborating the source of data is as claimed .
195
Data owner
Individual responsible for the protection and classification of a specific data set .
196
Data security
– Protection of data from unauthorized (accidental or intentional) modification, destruction, or disclosure .
197
Data structure
A representation of the logical relationship between elements of data .
198
Data warehousing
Combines data from multiple databases or data sources into a large database for the purpose of providing more extensive information retrieval and data analysis .
199
Database
A cross-referenced collection of data .
200
Database Management System (DBMS)
Manages and controls the database .
201
Decertification –
Revocation of the certification of an information system item or equipment for cause .
202
Decipher
Act of transforming data into a readable format .
203
Decode
Convert encoded text to plain text by means of a code .
204
Decrypt –
Generic term encompassing decode and decipher .
205
Dedicated mode
information system security mode of operation wherein each user, with direct or indirect access to the system, its peripherals, remote terminals, or remote hosts, has all of the following – a . valid security clearance for all information within the system; b . formal access approval and signed nondisclosure agreements for all the information stored and/or processed (including all compartments, sub-compartments, and/or special access programs); and c . valid need-to-know for all information contained within the information system . When in the dedicated security mode, a system is specifically and exclusively dedicated to and controlled for the processing of one particular type or classification of information, either for full-time operation or for a specified period of time .
206
Defense-in-depth
– Implementation of multiple controls so that successful penetration and compromise is more difficult to attain .
207
Degaussing
Procedure that reduces the magnetic flux to virtual zero by applying a reverse magnetizing field . Also called demagnetizing .
208
Delphi method –
Data collection method that happens in an anonymous fashion .
209
Denial of service
Any action or series of actions that prevents any part of an information system from functioning .
210
Designated approval authority (DAA)
Official with the authority to formally assume responsibility for operating a system at an acceptable level of risk . This term is synonymous with authorizing official, designated accrediting authority, and delegated accrediting authority .
211
Dial back –
Synonymous with call back .
212
Differential cryptanalysis –
Cryptanalysis method that uses the study of how differences in an input can affect the resultant difference at the output .
213
Diffie-Hellman algorithm
First asymmetric algorithm created and is used to exchange symmetric key values . Based upon logarithms in finite fields .
214
Diffusion
– Transposition processes used in encryption functions to increase randomness .
215
Digital Rights Management (DRM)
Access control technologies commonly used to protect copyright material .
216
Digital signals
Binary digits are represented and transmitted as discrete electrical pulses .
217
Digital signature –
Ensuring the authenticity and integrity of a message through the use of hashing algorithms and asymmetric algorithms . The message digest is encrypted with the sender’s private key .
218
Digital signature algorithm
Procedure that appends data to, or performs a cryptographic transformation of, a data unit . The appended data or cryptographic transformation allows reception of the data unit and protects against forgery, e .g ., by the recipient .
219
Digital Subscriber Line (DSL)
A set of technologies that provide Internet access by transmitting digital data over the wires of a local telephone network . DSL is used to digitize the “last mile” and provide fast Internet connectivity .
220
Disaster recovery plan –
Provides for the continuity of system operations after a disaster .
221
Discretionary access control (DAC)
Means of restricting access to objects based on the (DAC) identity and need-to-know of users and/or groups to which the object belongs . Controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (directly or indirectly) to any other subject (unless restrained by mandatory access control) .
222
Distance-vector routing protocol
A routing protocol that calculates paths based on the distance (or number of hops) and a vector (a direction) .
223
Distinguished name
Globally unique identifier representing an individual’s identity .
224
DMZ (Demilitarized Zone)
Perimeter network segment that is logically between internal and external networks . Its purpose is to enforce the internal network’s IA policy for external information exchange and to provide external, un-trusted sources with restricted access to releasable information while shielding the internal networks from outside attacks . A DMZ is also called a
“screened subnet .”
225
DNS zone transfer
The process of replicating the databases containing the DNS data across a set of DNS servers .
226
DNSSEC
A set of extensions to DNS that provide to DNS clients (resolvers) origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attack types .
227
DoDAF
– U .S . Department of Defense architecture framework that ensures interoperability of systems to meet military mission goals .
228
Domain
– System or group of systems operating under a common security policy .
229
Domain Name System (DNS)
A hierarchical distributed naming system for computers, services, or any resource connected to an IP based network . It associates various pieces of information with domain names assigned to each of the participating entities .
230
Dual-homed firewall
This device has two interfaces and sits between an untrusted network and trusted network to provide secure access .
231
Dumpster diving
Refers to going through someone’s trash to find confidential or useful information .
It is legal, unless it involves trespassing, but in all cases it is considered unethical .
232
Dynamic Host Configuration Protocol (DHCP)
A network configuration service for hosts on IP networks . It provides IP addressing, DNS server, subnet mask, and other important network configuration data to each host through automation .
233
Dynamic link libraries (DLLs)
A set of subroutines that are shared by different applications and operating system processes .
234
E-mail spoofing
Activity in which the sender address and other arts of the e-mail header are altered to appear as though the e-mail originated from a different source . Since SMTP does not provide any authentication, it is easy to impersonate and forge e-mails .
235
El Gamal algorithm –
– Asymmetric algorithm based upon the Diffie-Hellman algorithm used for digital signatures, encryption, and key exchange .
236
Electronically generated key
– Key generated in a COMSEC device by introducing (either mechanically or electronically) a seed key into the device and then using the seed, together with a software algorithm stored in the device, to produce the desired key .
237
Elliptic curve cryptosystem algorithm
Asymmetric algorithm based upon the algebraic structure of elliptic curves over finite fields . Used for digital signatures, encryption, and key exchange .
238
Embedded computer
Computer system that is an integral part of a larger system .
239
Embedded cryptographic system –
– Cryptosystem performing or controlling a function as an integral element of a larger system or subsystem .
240
Embedded cryptography
– Cryptography engineered into an equipment or system whose basic function is not cryptographic .
241
Emissions security (EMSEC) –
Protection resulting from measures taken to deny unauthorized individuals information derived from intercept and analysis of compromising emanations from crypto- equipment or an information system . (See TEMPEST .)
242
Encapsulating Security Payload Protocol (ESP)
Protocol within the IPSec suite used for integrity, authentication, and encryption .
243
Encipher
Act of transforming data into an unreadable format .
244
Enclave
Collection of computing environments connected by one or more internal networks under the control of a single authority and security policy, including personnel and physical security .
245
Enclave boundary –
Point at which an enclave’s internal network service layer connects to an external network’s service layer, i .e ., to another enclave or to a Wide Area Network (WAN) .
246
Encode
Convert plain text to cipher text by means of a code .
247
Encrypt
Generic term encompassing encipher and encode .
248
Encryption algorithm
Set of mathematically expressed rules for rendering data unintelligible by executing a series of conversions controlled by a key .
249
End-to-end encryption
Encryption method used by the sender of data that encrypts individual messages and not full packets .
250
End-to-end security
Safeguarding information in an information system from point of origin to point of destination .
251
Entrapment
– Deliberate planting of apparent flaws in an information system for the purpose of detecting attempted penetrations .
252
Erasure
Process intended to render magnetically stored information irretrievable by normal means .
253
Ethernet –
Common LAN media access technology standardized by IEEE 802 .3 .
254
Evaluation Assurance Level (EAL)
– Set of assurance requirements that represent a point on the Common Criteria predefined assurance scale .
255
Event –
Occurrence, not yet assessed, that may affect the performance of an information system
256
Exploitable channel –
Channel that allows the violation of the security policy governing an information system and is usable or detectable by subjects external to the trusted computing base .
(See covert channel .)
257
Exposure –
Presence of a vulnerability, which exposes the organization to a threat .
258
Extraction resistance
Capability of crypto-equipment or secure telecommunications equipment to resist efforts to extract key .
259
Extranet
Extension to the intranet allowing selected outside users access to portions of an organization’s intranet .
260
Facilitated Risk Analysis Process (FRAP)
A focused, qualitative approach that carries out prescreening to save time and money .
261
Fail safe
– Automatic protection of programs and/or processing systems when hardware or software failure is detected .
262
Fail soft –
Selective termination of affected nonessential processing when hardware or software failure is determined to be imminent .
263
Failure Modes and Effect Analysis (FMEA)
– Approach that dissects a component into its basic functions to identify flaws and those flaw’s effects .
264
Fault tree analysis
Approach to map specific flaws to root causes in complex systems .
265
Federated identity
– A portable identity, and its associated entitlements, that can be used across business boundaries .
266
Fiber Distributed Data Interface (FDDI)
Ring-based token network protocol that was derived from the IEEE 802 .4 token bus timed token protocol . It can work in LAN or MAN environments and provides fault tolerance through dual-ring architecture .
267
File –
A collection of records of the same type .
268
Firewall –
– System designed to defend against unauthorized access to or from a private network .
269
Firmware –
– Program recorded in permanent or semi-permanent computer memory .
270
Flaw –
Error of commission, omission, or oversight in an information system that may allow protection mechanisms to be bypassed .
271
Flooding
– Type of incident involving insertion of a large volume of data resulting in denial of service .
272
Foreign key
An attribute of one table that is related to the primary key of another table
273
Fraggle attack
A DDoS attack type on a computer that floods the target system with a large amount of UDP echo traffic to IP broadcast addresses .
274
Frequency analysis
Cryptanalysis process used to identify weaknesses within cryptosystems by locating patterns in resulting ciphertext .
275
Frequency hopping
– Repeated switching of frequencies during radio transmission according to a specified algorithm, to minimize unauthorized interception or jamming of telecommunications .
276
Frequency-division multiplexing (FDM)
Dividing available bandwidth into a series of nonoverlapping frequency sub-bands that are then assigned to each communicating source and user pair . FDM is inherently an analog technology .
277
–Full-interruption test
One in which regular operations are stopped and processing is moved to the alternate site .
278
Functional testing
– Segment of security testing in which advertised security mechanisms of an information system are tested under operational conditions .
279
Fuzzing
A technique used to discover flaws and vulnerabilities in software .
280
Garbage collector
Identifies blocks of memory that were once allocated but are no longer in use and deallocates the blocks and marks them as free .
281
Gateway
– Interface providing a compatibility between networks by converting transmission speeds, protocols, codes, or security measures .
282
General registers –
Temporary memory location the CPU uses during its processes of executing instructions . The ALU’s ”scratch pad” it uses while carrying out logic and math functions .
283
Guard
– Mechanism limiting the exchange of information between systems
284
H.323
A standard that addresses call signaling and control, multimedia transport and control, and bandwidth control for point-to-point and multipoint conferences .
285
Hacker
Unauthorized user who attempts to or gains access to an information system .
286
Handshaking procedures –
Dialogue between two information system’s for synchronizing, identifying, and authenticating themselves to one another .
287
Hardware segmentation
Physically mapping software to individual memory segments .
288
Hardwired key
Permanently installed key .
289
Hashed message authentication code (HMAC)
Cryptographic hash function that uses a symmetric key value and is used for data integrity and data origin authentication .
290
Hierarchical data model
Combines records and fields that are related in a logical tree structure .
291
High availability
Refers to a system, component, or environment that is continuously operational .
292
High-level languages –
Otherwise known as third-generation programming languages, due to their refined programming structures, using abstract statements .
293
Honeypots
Systems that entice with the goal of protecting critical production systems . If two or more honeypots are used together, this is considered a honeynet .
294
Hot site
Fully configured with hardware, software, and environmental needs . It can usually be up and running in a matter of hours . It is the most expensive option, but some companies cannot be out of business longer than a day without very detrimental results .
295
HTTPS
A combination of HTTP and SSL\TLS that is commonly used for secure Internet connections and e-commerce transactions .
296
Hybrid cryptography
Combined use of symmetric and asymmetric algorithms where the symmetric key encrypts data and an asymmetric key encrypts the symmetric key .
297
Hypervisor
– A hypervisor or virtual machine monitor (VMM) is a piece of computer software, firmware or hardware that creates and runs virtual machines . A computer on which a hypervisor is running one or more virtual machines is defined as a host machine . Each virtual machine is called a guest machine .
298
Identification –
Process an information system uses to recognize an entity .
299
Identity token
Smart card, metal key, or other physical object used to authenticate identity .
300
Identity validation
Tests enabling an information system to authenticate users or resources .
301
IEEE 802.1AE (MACSec)
– Standard that specifies a set of protocols to meet the security requirements for protecting data traversing Ethernet LANs .
302
IEEE 802.1AR
Standard that specifies unique per-device identifiers (DevID) and the management and cryptographic binding of a device (router, switch, access point) to its identifiers .
303
Immunizer
Attaches code to the file or application, which would fool a virus into “thinking” it was already infected .
304
Impersonating
Form of spoofing .
305
Inadvertent disclosure
Type of incident involving accidental exposure of information to an individual not authorized access .
306
Incident
IS) Assessed occurrence having actual or potentially adverse effects on an information system . (COMSEC) Occurrence that potentially jeopardizes the security of COMSEC material or the secure electrical transmission of national security information .
307
Indicator
Recognized action, specific, generalized, or theoretical, that an adversary might be expected to take in preparation for an attack .
308
Information assurance (IA)
Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation . These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities .
309
Information environment
Aggregate of individuals, organizations, or systems that collect, process, or disseminate information, also included is the information itself .
310
Information flow control –
Procedure to ensure that information transfers within an information system are not made from a higher security level object to an object of a lower security level .
311
Information gathering
– Usually the first step in an attacker’s methodology, in which the information gathered may allow an attacker to infer additional information that can be used to compromise systems .
312
Information owner
Official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal .
313
Information security policy
Aggregate of directives, regulations, rules, and practices that prescribe how an organization manages, protects, and distributes information .
314
Information system (IS)
Set of information resources organized for the collection, storage, processing, maintenance, use, sharing, dissemination, disposition, display, or transmission of information .
315
Information systems security (INFOSEC)
Protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users, including those measures necessary to detect, document, and counter such threats .
316
Information Technology Security Evaluation Criteria (ITSEC)
– European standard used to assess the effectiveness of the security controls built into a system .
317
Initialization vectors (IVs)
Values that are used with algorithms to increase randomness for cryptographic functions .
318
Initialize –
Setting the state of a cryptographic logic prior to key generation, encryption, or other operating mode .
319
Inspectable space
Three dimensional space surrounding equipment that process classified and/or sensitive information within which TEMPEST exploitation is not considered practical or where legal authority to identify and remove a potential TEMPEST exploitation exists . Synonymous with zone of control .
320
Instruction set
Set of operations and commands that can be implemented by a particular processor (CPU) .
321
Integrated Services Digital Network (ISDN)
A circuit-switched telephone network system technology designed to allow digital transmission of voice and data over ordinary telephone copper wires .
Integrity – Accuracy and reliability of the information and systems are provided and any unauthorized modification is prevented .
322
Integrity check value
Checksum capable of detecting modification of an information system .
323
Interconnection security agreement
Written management authorization to interconnect information systems based upon acceptance of risk and implementation of established controls .
324
Interface –
Common boundary between independent systems or modules where interactions take place .
325
Internal security controls –
Hardware, firmware, or software features within an information system that restrict access to resources only to authorized subjects .
326
International Data Encryption Algorithm (IDEA) –
– Block symmetric cipher that uses a 128-bit key and 64-bit block size .
327
Internet Control Message Protocol (ICMP) –
– A core protocol of the IP suite used to send status and error messages .
328
Internet Group Management Protocol (IGMP) –
Used by systems and adjacent routers on IP networks to establish and maintain multicast group memberships .
329
Internet Message Access Protocol (IMAP)
– An Internet standard protocol used by e-mail clients to retrieve e-mail from a remote server . E-mail clients using IMAP generally leave messages on the server until the user explicitly deletes them .
330
Internet Protocol (IP) –
Core protocol of the TCP/IP suite . Provides packet construction, addressing, and routing functionality .
331
Internet Security Association and Key Management Protocol (ISAKMP) –
Used to establish security associates and an authentication framework in Internet connections . Commonly used by IKE for key exchange .
332
Interpreters –
Tools that convert code written in interpreted languages to the machine-level format for processing .
333
Interrupt –
– Software or hardware signal that indicates that system resources (i .e .,CPU) are needed for instruction processing .
334
Intra-Site Automatic Tunnel Addressing Protocol (ISATAP
An IPv6 transition mechanism meant to transmit IPv6 packets between dual-stack nodes on top of an IPv4 network .
335
Intrusion –
– Unauthorized act of bypassing the security mechanisms of a system .
336
IP broadcast methods –
– There are three methods - Unicast – Packet is sent from a single source to a single destination . Broadcast – Source packet is copied and sent to all the nodes on a network .
Multicast – Source packet is copied and then sent to multiple destinations on a network .
337
IPSec –
– Protocol suite used to protect IP traffic through encryption and authentication . De facto standard VPN protocol .
338
IPv6 –
IP version 6 is the successor to IP version 4 and provides 128-bit addressing, integrated IPSec security protocol, simplified header formats, and some automated configuration .
339
ISO/IEC 27000 series –
International standard for the implementation of a risk management program that integrates into an information security management system (ISMS) .
340
ITIL –
– Best practices for information technology services management processes developed by the United Kingdom’s Office of Government Commerce .
341
Java applets
Small components (applets) that provide various functionalities and are delivered to users in the form of Java bytecode . Java applets can run in a web browser using a Java Virtual Machine (JVM) . Java is platform independent; thus, Java applets can be executed by browsers for many platforms .
342
Kerckhoffs’ Principle
Concept that an algorithm should be known and only the keys should be kept secret .
343
Kernel mode (supervisory state, privilege mode) –
– Mode that a CPU works within when carrying out more trusted process instructions . The process has access to more computer resources when working in kernel versus user mode .
344
Key –
– Sequence of bits that are used as instructions that govern the acts of cryptographic functions within an algorithm .
345
Key clustering –
Instance when two different keys generate the same ciphertext from the same plaintext .
346
Key Derivation Functions (KDFs) –
– Generation of secret keys (subkeys) from an initial value (master key) .
347
Key distribution center (KDC) –
COMSEC facility generating and distributing key in electrical form .
348
Key exchange –
Process of exchanging public keys (and other information) in order to establish secure communications .
349
Key pair –
Public key and its corresponding private key as used in public key cryptography .
350
Key recovery –
Mechanisms and processes that allow authorized parties to retrieve the cryptographic key used for data confidentiality .
351
Key stream
– Sequence of symbols (or their electrical or mechanical equivalents) produced in a machine or auto-manual cryptosystem to combine with plain text to produce cipher text, control transmission security processes, or produce key .
352
Key-encryption-key (KEK) –
– Key that encrypts or decrypts other key for transmission or storage .
353
Keying material –
Key, code, or authentication information in physical or magnetic form .
354
Keyspace –
A range of possible values used to construct keys .
355
Keystream generator –
Component of a stream algorithm that creates random values for encryption purposes
356
Known-plaintext attack –
Cryptanalysis attack where the attacker is assumed to have access to sets of corresponding plaintext and ciphertext .
357
Label
See security label .
358
Labeled security protections
– Elementary-level mandatory access control protection features and intermediate-level discretionary access control features in a TCB that uses sensitivity labels to make access control decisions .
359
Layered operating system architecture
Architecture that separates system functionality into hierarchical layers .
360
Least privilege
Principle requiring that each subject be granted the most restrictive set of privileges needed for the performance of authorized tasks . Application of this principle limits the damage that can result from accident, error, or unauthorized use of an information system .
361
Limit registers
Ending of address space assigned to a process . Used to ensure a process does not make a request outside its assigned memory boundaries .
362
Linear cryptanalysis
Cryptanalysis method that uses the study of affine transformation approximation in encryption processes .
363
Link encryption
Technology that encrypts full packets (all headers and data payload) and is carried out without the sender’s interaction .
364
Link-state routing protocol
A routing protocol used in packet-switching networks where each router constructs a map of the connectivity within the network and calculates the best logical paths, which form its routing table .
365
Logic bomb
Executes a program, or string of code, when a certain event happens or a date and time arrives .
366
Logical addresses
– Indirect addressing used by processes within an operating system . The memory manager carries out logical-to-absolute address mapping .
367
Machine language
Means of restricting access to objects based on the sensitivity of the information contained in the objects and the formal authorization (i .e ., clearance, formal access approvals, and need-to-know) of subjects to access information of such sensitivity .
