CISM (Certified Information Security manager) – Vocabulary – Flashcards

Unlock all answers in this set

Unlock answers
question
Acceptable interruption window
answer
Max time a system can be unavailable before compromising business objectives.
question
Acceptable use policy
answer
Policy agreement between users and the organization. Defines approved range of use for access to a network or the Internet
question
Access controls
answer
The processes, rules and deployment mechanisms that control access to information systems, resources and physical access to premises
question
Access path
answer
Logical route an end user takes to access computerized information. Typically includes a route through the OS, telecommunications software, applications, and access controls.
question
Access rights
answer
Permission or privileges granted to users, programs or workstations to create, change, delete or view data and files within a system, as defined by rules established by data owners and the information security policy
question
Accountability
answer
The ability to map a given activity or event back to the responsible party
question
Action plan
answer
A plan of the steps necessary to achieve objectives
question
Ad hoc
answer
Arbitrary approach, no formal plan or process
question
Administrative controls
answer
Rules, procedures and practices that deal with operational effectiveness, efficiency and adherence to regulations and management policies.
question
Adware
answer
Any software package that automatically plays, displays or downloads advertising material to a computer after the software is installed on it or while the application is being used. In most cases, this is done without any notification to the user or without the user's consent. This software may or maynot contain spyware.
question
Advance Encryption Standard (AES)
answer
The international encryption standard that replaced 3DES.
question
Algorithm
answer
A finite set of step-by-step instructions for a problem-solving or computation procedure, especially one that can be implemented by a computer.
question
Anomaly-Based Detection
answer
The process of comparing definitions of what activity is considered normal against observed events to identify significant deviations. This approach is used on some intrusion detection systems.
question
Annual Loss Expectation (ALE)
answer
The total expected loss divided by the number of years in the forecast period yielding the average annual loss
question
Alert situation
answer
The point in an emergency procedure when the elapsed time passes a threshold and the interruption is not resolved. The organization entering into an alert situation initiates a series of escalation steps.
question
Alternate facilities
answer
Locations and infrastructures from which emergency or backup processes are executed, when the main premises are unavailable or destroyed. This includes other buildings, offices or data processing centers.
question
Alternate process
answer
Automatic or manual processes designed and established to continue critical business processes from point-of-failure to return-to-normal
question
Anonymous File Transfer Protocol (AFTP)*
answer
A method of downloading public files using the File Transfer Protocol (FTP). AFTP does not require users to identify themselves before accessing files from a particular server. In general, users enter the word "anonymous" when the host prompts for a username. Anything can be entered for the password, such as the user's e-mail address or simply the word "guest."
question
Antivirus software
answer
An application software deployed at multiple points in an IT architecture. It is designed to detect and potentially eliminate virus code before damage is done, and repair or quarantine files that have already been infected
question
Application Programming Interface (API)
answer
An application programming interface (API) is a source code-based specification intended to be used as an interface by software components to communicate with each other.
question
Application controls
answer
The policies, procedures and activities designed to provide reasonable assurance that objectives relevant to a given automated solution (application) are achieved
question
Application layers
answer
In the Open Systems Interconnection (OSI) communications model, the application layer provides services for an application program to ensure that effective communication with another application program in a network is possible. The application layer is not the application that is doing the communication; it is a service layer that provides these services.
question
Application service provider (ASP)
answer
Also known as managed service provider (MSP), it deploys, hosts and manages access to a packaged application to multiple parties from a centrally managed facility. The applications are delivered over networks on a subscription basis.
question
Architecture
answer
Description of the fundamental underlying design of the components of the business system, or of one element of the business system (e.g., technology), the relationships among them, and the manner in which they support the organization's objectives
question
Address Resolution Protocol (ARP)
answer
ARP defines the exchanges between network interfaces connected to an Ethernet media segment in order to map an IP address to a link layer address on demand.
question
Assurance
answer
The grounds for confidence that the set of intended security controls in an information system are effective in their application.
question
Assurance Process Integration
answer
Integration of organizational assurance processes to achieve greater efficiencies and counter typical silo effects.
question
Assymetric encryption
answer
A cryptographic key that may be widely published and is used to enable the operation of an asymmetric cryptography scheme. This key is mathematically linked with a corresponding private key. Typically, a public key can be used to encrypt, but not decrypt, or to validate a signature, but not to sign.
question
Attack Signature
answer
A specific sequence of events indicative of an unauthorized access attempt. Typically a characteristic byte pattern used in malicious code or an indicator, or set of indicators that allows the identification of malicious network activities.
question
Attributes
answer
The fundamental characteristics of something
question
Audit
answer
Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures, and to recommend necessary changes in controls, policies, or procedures
question
Audit Review
answer
The assessment of an information system to evaluate the adequacy of implemented security controls, assure that they are functioning properly, identify vulnerabilities, and assist in implementation of new security controls where required. This assessment is conducted annually or whenever significant change has occurred and may lead to recertification of the information system.
question
Audit trail
answer
A series of records either in hard copy or in electronic format that provide a chronological record of user activity and other events that show the details of user and system activity. Audit trails can be used to document when users log in, how long they are engaged in various activities, what they were doing, and whether any actual or attempted security violations occurred.
question
Authentication
answer
The act of verifying the identity of an entity (e.g., a user, a system, a network node)
question
Authorization
answer
Access privileges granted to a user, program, or process or the act of granting those privileges
question
Automated Clearing House (ACH)
answer
ACH is an electronic network for financial transactions in the United States. ACH processes large volumes of credit and debit transactions in batches. Credit transfers include direct deposit payroll and vendor payments and ACH direct debit transfers include consumer payments on insurance premiums, mortgage loans, and other kinds of bills
question
Availability
answer
Information that is accessible when required by the business process now and in the future
question
Awareness (Information Security)
answer
Activities which seek to focus an individual's attention on an (information security) issue or set of issues.
question
Backup center
answer
An alternate facility to continue IT/IS operations when the primary DP center is unavailable
question
Biometrics
answer
To recognize the identity, or verify the claimed identity, of an applicant. Facial images, fingerprints, and iris scan samples are all examples of biometrics.
question
Business intelligence (BI)*
answer
Refers to computer-based techniques used in identifying, extracting, and analyzing business data, such as sales revenue by products and/or departments, or by associated costs and incomes. BI technologies provide historical, current and predictive views of business operations. Common functions of business intelligence technologies are reporting, online analytical processing, analytics, data mining, process mining, complex event processing, business performance management, benchmarking, text mining and predictive analytics.
question
Business impact assessment (BIA)
answer
An analysis of an information system's requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption.
question
Baseline Security
answer
The minimum security controls required for safeguarding an IT system based on its identified needs for confidentiality, integrity, and/or availability protection.
question
Bastion Host
answer
A special-purpose computer on a network specifically designed and configured to withstand attacks.
question
Business continuity management (BCM)
answer
Planning focused on assuring continuous business processes and is a major factor in an organization's survival during and after a disruption. This is a key component of Comprehensive Emergency Management.
question
Business continuity planning (BCP)
answer
The documentation of a predetermined set of instructions or procedures that describe how an organization's mission/business functions will be sustained during and after a significant disruption.
question
Benchmarking
answer
A systematic approach to comparing an organization's performance against peers and competitors in an effort to learn the best ways of conducting business. Examples include benchmarking of quality, logistical efficiency and various other metrics.
question
Business Impact Assessment (BIA)
answer
An analysis of an information system's requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption.
question
Biometric
answer
A measurable physical characteristic or personal behavioral trait used to recognize the identity, or verify the claimed identity, of an applicant. Facial images, fingerprints, and iris scan samples are all examples.
question
Bit-stream image
answer
Also referred to as mirror image backups, involve the backup of all areas of a computer hard disk drive or other type of storage media. Such backups exactly replicate all sectors on a given storage device including all files and ambient data storage areas.
question
Bit copy
answer
Provides an exact image of the original and is a requirement for legally justifiable forensics
question
Bit
answer
The smallest unit of information storage; a contraction of the term "binary digit;" one of two symbols "0" (zero) and "1" (one) - that are used to represent binary numbers.
question
Blacklisting
answer
The process of the system invalidating a user ID based on the user's inappropriate actions. A user ID on this list cannot be used to log on to the system, even with the correct credentials. This is a positive security-relevant event. Also applies to blocks placed against IP addresses to prevent inappropriate or unauthorized use of Internet resources.
question
Botnet
answer
A large number of compromised computers that are used to create and send spam or viruses or flood a network with messages as a denial of service attack.
question
Boundary
answer
Physical or logical perimeter of a system
question
Brute force attack
answer
Repeatedly trying all possible combinations of passwords or encryption keys until the correct one is found
question
Business case
answer
Documentation of the rationale for making a business investment, used both to support a business decision on whether to proceed with the investment and as an operational tool to support management of the investment through its full economic life cycle
question
Business dependency assessment
answer
A process of identifying resources critical to the operation of a business process
question
Business impact analysis/assessment (BIA)
answer
Evaluating the criticality and sensitivity of information assets. An exercise that determines the impact of losing the support of any resource to an organization, establishes the escalation of that loss over time, identifies the minimum resources needed to recover, and prioritizes the recovery of processes and supporting system. This process also includes addressing: income loss, unexpected expense, legal issues (regulatory compliance or contractual), interdependent processes, and loss of public reputation or public confidence.
question
Business Model for Information Security (BMIS)
answer
A business-oriented model for managing information security utilizing systems thinking to clarify complex relationships within an enterprise. The four elements and six dynamic interconnections form the basis of a three dimensional model that establish the boundaries of an information security program and models how the program functions and reacts to internal and external change. It also provides the context for frameworks such as COBIT.
question
Byte
answer
A fundamental unit of computer storage; the smallest addressable unit in a computer's architecture. Usually holds one character of information and usually means eight bits.
question
Capability Maturity Model (CMM)
answer
A qualitative approach typically using a 0 to 5 scale with each value assigned a set of attributes or characteristics to determine a relative level of competency and proficiency.
question
Certificate
answer
A digitally signed representation of information that 1) identifies the authority issuing it, 2) identifies the subscriber, 3) identifies its valid operational period (date issued / expiration date). In the information assurance (IA) community, certificate usually implies public key certificate and can have the following types: Cross certificate, Encryption certificate and Key management.
question
Cross certificate
answer
A certificate issued from a CA that signs the public key of another CA not within its trust hierarchy that establishes a trust relationship between the two CAs.
question
Encryption certificate
answer
A certificate containing a public key that can encrypt or decrypt electronic messages, files, documents, or data transmissions, or establish or exchange a session key for these same purposes.
question
Identity certificate
answer
A certificate that provides authentication of the identity claimed. Within the National Security Systems (NSS) PKI, identity certificates may be used only for authentication or may be used for both authentication and digital signatures.
question
Key management
answer
Refers to the process of storing, protecting, and escrowing the private component of the key pair associated with the encryption certificate.
question
Certificate (Certification) Authority (CA)
answer
In cryptography, a CA is a trusted third party that issues digital certificates. A CA attests, as the trusted provider of the public/private key pairs, to the authenticity of the owner (entity or individual) to whom a public/private key pair has been given. The process involves a CA who makes a decision to issue a certificate based on evidence or knowledge obtained in verifying the identity of the recipient. Upon verifying the identity of the recipient, the CA signs the certificate with its private key for distribution to the user, where, upon receipt, the user will decrypt the certificate with the CA's public key (e.g., commercial CAs, such as VeriSign, provide public keys on web browsers). The ideal CA is authoritative (someone the user trusts) for the name or key space it represents. CAs are characteristic of many public key infrastructure (PKI) schemes. Many commercial CAs charge for their services. Institutions and governments may have their own CAs, and there are free CAs.
question
Certificate policy (CP)
answer
A specialized form of administrative policy tuned to electronic transactions performed during certificate management. A Certificate Policy addresses all aspects associated with the generation, production, distribution, accounting, compromise recovery, and administration of digital certificates. Indirectly, a certificate policy can also govern the transactions conducted using a communications system protected by a certificate-based security system. By controlling critical certificate extensions, such policies and associated enforcement technology can support provision of the security services required by particular applications.
question
Certification Practice Statement
answer
A statement of the practices that a Certification Authority employs in issuing, suspending, revoking, and renewing certificates and providing access to them, in accordance with specific requirements (i.e., requirements specified in this Certificate Policy, or requirements specified in a contract for services).
question
Certificate revocation list (CRL)
answer
A list of revoked public key certificates created and digitally signed by a Certification Authority.
question
Chain of custody
answer
The chain of custody is a legal principle regarding the validity and integrity of evidence. It requires accountability for anything that will be used as evidence in a legal proceeding, to ensure that it can be accounted for from the time it was collected until the time it is presented in a court of law. This includes documentation as to who had access to the evidence and when, as well as the ability to identify evidence as being the exact item that was recovered or tested. Lack of control over evidence can lead to it being discredited. Chain of custody depends on the ability to verify that evidence could not have been tampered with. This is accomplished by sealing off the evidence, so it cannot be changed, and providing a documentary record of custody to prove that the evidence was, at all times, under strict control and not subject to tampering.
question
Chain of Evidence
answer
A process and record that shows who obtained the evidence; where and when the evidence was obtained; who secured the evidence; and who had control or possession of the evidence. The "sequencing" of the chain of evidence follows this order: collection and identification; analysis; storage; preservation; presentation in court; return to owner.
question
Challenge and Reply Authentication
answer
Prearranged procedure in which a subject requests authentication of another and the latter establishes validity with a correct reply.
question
Challenge-Response Protocol
answer
An authentication protocol where the verifier sends the claimant a challenge (usually a random value or a nonce) that the claimant combines with a shared secret (often by hashing the challenge and secret together) to generate a response that is sent to the verifier. The verifier knows the shared secret and can independently compute the response and compare it with the response generated by the claimant. If the two are the same, the claimant is considered to have successfully authenticated himself. When the shared secret is a cryptographic key, such protocols are generally secure against eavesdroppers. When the shared secret is a password, an eavesdropper does not directly intercept the password itself, but the eavesdropper may be able to find the password with an off-line password guessing attack.
question
Change management
answer
A controlled approach to managing the transition from a current to a desired organizational state while ensuring that critical success factors and potential risks are determined and addressed.
question
Checksum
answer
A value that is computed by a function that is dependent on the contents of a data object and is stored or transmitted together with the object, for the purpose of detecting changes in the data.
question
Cipher
answer
A cryptographic algorithm for encryption and decryption.
question
Cipher-text
answer
Cipher-text is the encrypted form of the message being sent.
question
Chief executive officer (CEO)
answer
The highest ranking individual in an organization
question
Chief financial officer (CFO)
answer
The CFO is a fiduciary responsible for an organizations finance and accounting as well as compliance with various financial regulatory requirements.
question
Chief information officer (CIO)
answer
The most senior official of the enterprise who is accountable for IT advocacy, aligning IT and business strategies, and planning, resourcing and managing the delivery of IT services, information and the deployment of associated human resources. In some cases, the CIO role has been expanded to become the chief knowledge officer (CKO) who deals in knowledge, not just information. Also see chief technology officer.
question
Chief information security officer (CISO)
answer
The CISO is responsible for managing information risk, the information security program, and ensuring appropriate confidentiality, integrity and availability of information assets.
question
Chief Operating Officer (COO)
answer
The COO is typically responsible for oversight and management of operations at the direction of the Chief Executive.
question
Chief security officer (CSO)
answer
The CSO is typically responsible for physical security in the organization although increasingly the CISO and CSO roles are merged.
question
Chief technology officer (CTO)
answer
The individual (typically a corporate officer) who focuses on technology issues in an organization.
question
Classification
answer
The system or process that segregates information resources according to their sensitivity and criticality.
question
Chief Risk Office (CRO)
answer
The individual, usually a corporate officer, charged with identifying and managing organizational risk.
question
Cipher
answer
Series of transformations that converts plaintext to ciphertext using the Cipher Key
question
Clear Text
answer
Information that is not encrypted
question
Client-Client server
answer
Individual or process acting on behalf of an individual who makes requests of a dedicated server. The client's requests to the dedicated server can involve data transfer to, from, or through dedicated server.
question
Cloud computing
answer
An approach using external services for convenient on-demand IT operations using a shared pool of configurable computing capability. Typical capabilities include infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS). (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
question
Cloud model
answer
The cloud model is composed of five essential characteristics (on-demand selfservice, ubiquitous network access, location independent resource pooling, rapid elasticity, and measured service). It allows users to access technology-based services from the network cloud without knowledge of, expertise with, or control over the technology infrastructure that supports them and provides and four models for enterprise access (Private cloud, Community cloud, Public cloud, and Hybrid cloud)
question
COBIT
answer
The international IT management framework and set of IT control objectives published by ISACA, 2007, 2005, 2000, 1998, 1996
question
Cold Site
answer
Backup site that can be up and operational in a relatively short time span, such as a day or two. Provision of services, such as telephone lines and power, is taken care of, and the basic office furniture might be in place, but there is unlikely to be any computer equipment, even though the building might well have a network infrastructure and a room ready to act as a server room. In most cases, cold sites provide the physical location and basic services.
question
Common Carrier
answer
In a telecommunications context, a telecommunications company that holds itself out to the public for hire to provide communications transmission services. Note: In the United States, such companies are usually subject to regulation by federal and state regulatory commissions.
question
Community of Interest (COI)
answer
A collaborative group of users who exchange information in pursuit of their shared goals, interests, missions, or business processes, and who therefore must have a shared vocabulary for the information they exchange. The group exchanges information within and between systems to include security domains.
question
Compartmentalization
answer
A nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone.
question
Compensating Security Control
answer
A management, operational, and/or technical control (i.e., safeguard or countermeasure) employed by an organization in lieu of a recommended security control in the low, moderate, or high baselines that provides equivalent or comparable protection for an information system.
question
Competitive Intelligence
answer
Competitive Intelligence is espionage using legal, or at least not obviously illegal, means.
question
Compromise
answer
Disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred.
question
Computer emergency response team (CERT)
answer
A group of people integrated at the organization with clear lines of reporting and responsibilities for standby support in case of an information systems emergency. This group will act as an efficient corrective control, and should also act as a single point of contact for all incidents and issues related to information systems.
question
Computer Incident Response Team (CIRT)
answer
Group of individuals usually consisting of Security Analysts organized to develop, recommend, and coordinate immediate mitigation actions for containment, eradication, and recovery resulting from computer security incidents. Also called a Computer Security Incident Response Team (CSIRT) or a CIRC (Computer Incident Response Center, Computer Incident Response Capability, or Cyber Incident Response Team)
question
Confidentiality
answer
The protection of sensitive or private information from unauthorized disclosure
question
Control center
answer
Hosts the recovery meetings where disaster recovery operations are managed
question
Controls
answer
Any regulatory document, process, structure or technology
question
Configuration Management
answer
Process of controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modification prior to, during, and after system implementation
question
Controls policy
answer
A policy defining control operational and failure modes e.g. fail secure, fail open, allowed unless specifically denied, denied unless specifically permitted.
question
Content Filtering
answer
The process of monitoring communications such as email and Web pages, analyzing them for suspicious content, and preventing the delivery of suspicious content to users.
question
Contingency Plan
answer
Management policy and procedures used to guide an enterprise response to a perceived loss of mission capability. The Contingency Plan is the first plan used by the enterprise risk managers to determine what happened, why, and what to do. It may point to the Continuity of Operations Plan (COOP) or Disaster Recovery Plan for major disruptions
question
Convergence
answer
The trend of combining physical and information security under one manager to increase efficiency and effectiveness
question
Continuity of operations plan (COOP)
answer
A predetermined set of instructions or procedures that describe how an organization's mission-essential functions will be sustained within 12 hours and for up to 30 days as a result of a disaster event before returning to normal operations.
question
Continuous Monitoring
answer
The process implemented to maintain a current security status for one or more information systems or for the entire suite of information systems on which the operational mission of the enterprise depends. The process includes the development of a strategy to regularly evaluate selected IA controls/metrics, Recording and evaluating IA relevant events and the effectiveness of the enterprise in dealing with those events, Recording changes to IA controls, or changes that affect IA risks, and Publishing the current security status to enable information-sharing decisions involving the enterprise.
question
Corporate governance
answer
The system by which organizations are directed and controlled. Boards of directors are responsible for the governance of their organizations.
question
COSO
answer
Refers to the report "Internal Control—An Integrated Framework," sponsored by the Committee of Sponsoring Organizations of the Treadway Commission in 1992. It provides guidance and a comprehensive framework of internal control for all organizations.
question
Countermeasures
answer
Any process that directly reduces a threat or vulnerability
question
Credential
answer
An object that authoritatively binds an identity (and optionally, additional attributes) to a token possessed and controlled by a person.
question
Critical Infrastructure
answer
System and assets, whether physical or virtual, so vital to a country that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.
question
Critical success factor(s) (CSF)
answer
The issues that must be resolved or the specific steps that must be completed that are essential to the achievement of an objective
question
Criticality
answer
A measure of the impact that the failure of a system to function as required will have on the organization.
question
Criticality analysis
answer
An analysis to evaluate resources or business functions to identify their importance to the organization, and the impact if a function cannot be completed or a resource is not available
question
Common vulnerabilities and exposures (CVE)
answer
The Common Vulnerabilities and Exposures or CVE system provides a reference-method for publicly known information-securityvulnerabilities and exposures. MITRE Corporation maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland Security.
question
Cost Benefit Analysis
answer
Cost-benefit analysis (CBA), sometimes called benefit-cost analysis (BCA), is a systematic process for calculating and comparing benefits and costs of a project, decision
question
Cross-Certificate
answer
A certificate used to establish a trust relationship between two Certification Authorities.
question
Critical path
answer
Critical Path Analysis (CPA) or the Critical Path Method (CPM) defines all essential tasks that must be completed in sequence as part of a project in the least possible time.
question
Culture
answer
The set of shared attitudes, values, goals, and practices that characterizes an institution or organization
question
Cryptographic Algorithm
answer
A well-defined computational procedure that takes variable inputs, including a cryptographic key, and produces an output
question
Cryptographic Strength
answer
A measure of the expected number of operations required to defeat a cryptographic mechanism.
question
Cryptography
answer
The discipline that embodies the principles, means, and methods for the transformation of data in order to hide their semantic content, prevent their unauthorized use, or prevent their undetected modification.
question
Cybercops
answer
An investigator of computer-crime-related activities
question
Cyclical Redundancy Check (CRC)
answer
A method to ensure data has not been altered after being sent through a communication channel
question
Discretionary Access Control (DAC)
answer
In computer security, discretionary access control (DAC) is a type of access control defined by the Trusted Computer System Evaluation Criteria[1] "as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls arediscretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject
question
Damage evaluation
answer
The determination of the extent of damage that is necessary to provide for an estimation of the recovery time frame and the potential loss to the organization
question
Data classification
answer
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification. Levels of sensitivity of data are assigned according to predefined categories as data are created, amended, enhanced, stored or transmitted. The classification level is an indication of the value or importance of the data to the organization.
question
Data Custodian
answer
A Data Custodian is the entity currently using or manipulating the data, and therefore, temporarily taking responsibility for the data.
question
Data Integrity
answer
The property that data has not been altered in an unauthorized manner. Data integrity covers data in storage, during processing, and while in transit.
question
Data Mining
answer
Data Mining is a technique used to analyze existing information, usually with the intention of pursuing new avenues to pursue business.
question
Data Owner
answer
A Data Owner is the entity having responsibility and authority for the data.
question
Data Warehousing
answer
Data Warehousing is the consolidation of several previously independent databases into one location.
question
Data Encryption Standard (DES)
answer
An algorithm for encoding binary data. It is a secret key cryptosystem published by the National Bureau of Standards (NBS), the predecessor of the US National Institute of Standards and Technology (NIST). DES and its variants has been replaced by the Advanced Encryption Standard (AES)
question
Decrypt
answer
Generic term encompassing decode and decipher
question
Data leakage
answer
Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes
question
Data leak protection (DLP)
answer
A suite of technologies and associated processes that locate, monitor and protect sensitive information from unauthorized disclosure
question
Data normalization
answer
A structured process for organizing data into tables in a common form in such a way that it preserves the relationships among the data
question
Data warehouse
answer
A generic term for a system that stores, retrieves and manages large volumes of data. Data warehouse software often includes sophisticated comparison and hashing techniques for fast searches, as well as advanced filtering.
question
Decentralization
answer
The process of distributing computer processing to different locations within an organization
question
Decryption
answer
Decryption is the process of transforming an encrypted message into its original plaintext.
question
Decryption key
answer
A digital piece of information used to recover plaintext from the corresponding ciphertext by decryption
question
Defense in depth
answer
The practice of layering defenses to provide added protection. Defense in depth increases security by raising the effort needed in an attack. This strategy places multiple barriers between an attacker and an organization's computing and information resources.
question
Degauss
answer
The application of variable levels of alternating current for the purpose of demagnetizing magnetic recording media. The process involves increasing the alternating current field gradually from zero to some maximum value and back to zero, leaving a very low residue of magnetic induction on the media. Degauss loosely means: to erase.
question
Demilitarized zone (DMZ)
answer
A screened (firewalled) network segment that acts as a buffer zone between a trusted and untrusted network. A DMZ is typically used to house systems such as web servers that must be accessible from both internal networks and the Internet.
question
Denial of service (DOS)
answer
A denial-of-service attack (DoS attack) is an attempt to make a computer or network resource unavailable to its intended users by overloading the system with requests causing it to fail.
question
Disruption
answer
An unplanned event that causes the general system or major application to be inoperable for an unacceptable length of time (e.g., minor or extended power outage, extended unavailable network, or equipment or facility damage or destruction).
question
Digital certificate
answer
An electronic credential issued by a certificate authority (CA). A digital certificate binds a user's identity to a public key. It contains a user identifier, a unique serial number, valid to-from dates, usage information, a copy of the certificate holder's public key, and a thumbprint (hash) to verify integrity. The certificate is signed by the digital signature of the certificate-issuing authority so that a recipient can verify the validity of the certificate.
question
Digital code signing
answer
The process of digitally signing computer code to ensure its integrity
question
Disaster declaration
answer
The communication to appropriate internal and external parties that the disaster recovery plan is being put into operation
question
Disaster notification fee
answer
The fee the recovery site vendor charges when the customer notifies them that a disaster has occurred and the recovery site is required. The fee is implemented to discourage false disaster notifications.
question
Disaster recovery plan (DRP)
answer
A set of human, physical, technical and procedural resources to recover, within a defined time and cost, an activity interrupted by an emergency or disaster
question
Disaster recovery plan desk checking
answer
Typically a read-through of a disaster recovery plan without any real actions taking place. It generally involves a reading of the plan, discussion of the action items and definition of any gaps that might be identified.
question
Disaster recovery plan walk-through
answer
Generally a robust test of the recovery plan requiring that some recovery activities take place and are tested. A disaster scenario is often given and the recovery teams talk through the steps they would need to take to recover. As many aspects of the plan should be tested as possible.
question
Discretionary access control (DAC)
answer
A means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject.
question
Disk mirroring
answer
The practice of duplicating data in separate volumes on two hard disks to make storage more fault tolerant. Mirroring provides data protection in the case of disk failure because data are constantly updated to both disks.
question
Disk Imaging
answer
Generating a bit-for-bit copy of the original media, including free space and slack space.
question
Distributed denial of service (DDOS)
answer
A denial-of-service attack (DoS attack) is an attempt to make a computer or network resource unavailable to its intended users by overloading the system with requests from multiple sources (such as a botnet) causing it to fail.
question
Domain
answer
A sphere of knowledge, or a collection of facts about some program entities or a number of network points or addresses, identified by a name. On the Internet, a domain consists of a set of network addresses. In the Internet's domain name system, a domain is a name with which name server records are associated that describe sub-domains or host. In Windows NT and Windows 2000, a domain is a set of network resources (applications, printers, and so forth) for a group of users. The user need only to log in to the domain to gain access to the resources, which may be located on a number of different servers in the network.
question
Domain name system (DNS)
answer
A hierarchical database that is distributed across the Internet that allows names to be resolved into IP addresses (and vice versa) to locate services such as web and e-mail servers
question
Dual control
answer
A procedure that uses two or more entities (usually persons) operating in concert to protect a system resource such that no single entity acting alone can access that resource
question
Due care
answer
The level of care expected from a reasonable person of similar competency under similar conditions
question
Due diligence
answer
The performance of those actions that are generally regarded as prudent, responsible and necessary to conduct a thorough and objective investigation, review and/or analysis
question
Dynamic host configuration protocol (DHCP)
answer
Dynamic Host Configuration Protocol is a protocol for assigning dynamic IP addresses to devices on a network. With dynamic addressing, a device can have a different IP address every time it connects to the network. In some systems, the device's IP address can even change while it is still connected. DHCP also supports a mix of static and dynamic IP addresses.
question
Electronic data exchange (EDI)
answer
Electronic data interchange (EDI) is the structured transmission of data between organizations by electronic means. It is used to transfer electronic documents or business data from one computer system to another computer system, i.e. from one trading partner to another trading partner without human intervention.
question
Electronic funds transfer (EFT)
answer
Electronic funds transfer (EFT) is the electronic exchange or transfer of money from one account to another, either within a single financial institution or across multiple institutions, through computer-based systems
question
Encryption
answer
Cryptographic transformation of data (called "plaintext") into a form (called "cipher text") that conceals the data's original meaning to prevent it from being known or used.
question
Encipher
answer
Convert plain text to cipher text by means of a cryptographic system
question
End-to-End Encryption
answer
Communications encryption in which data is encrypted when being passed through a network, but routing information remains visible.
question
End-to-End Security
answer
Safeguarding information in an information system from point of origin to point of destination.
question
Enterprise governance
answer
A set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise's resources are used responsibly.
question
Enterprise Architecture (EA)
answer
The description of an enterprise's entire set of information systems: how they are configured, how they are integrated, how they interface to the external environment at the enterprise's boundary, how they are operated to support the enterprise mission, and how they contribute to the enterprise's overall security posture.
question
Enterprise Risk Management
answer
The methods and processes used by an enterprise to manage risks to its mission and to establish the trust necessary for the enterprise to support shared missions. It involves the identification of mission dependencies on enterprise capabilities, the identification and prioritization of risks due to defined threats, the implementation of countermeasures to provide both a static risk posture and an effective dynamic response to active threats; and it assesses enterprise performance against threats and adjusts countermeasures as necessary.
question
Entitlements
answer
Entitlements is the process business users manage the data that controls how policies are evaluated at runtime. They can add and delete users for applications and put those users into groups or assign them to roles. They manage sets of actions (permissions) that can be logically grouped for a particular business function. They assign those sets of actions to users or to roles defined for the application.
question
Ethernet
answer
The most widely-installed LAN technology. Specified in a standard, IEEE 802.3, an Ethernet LAN typically uses coaxial cable or special grades of twisted pair wires. Devices are connected to the cable and compete for access.
question
Event
answer
An event is an observable occurrence in a system or network.
question
Exposure
answer
The extent of the area exposed to a viable threat creating a risk. i.e Both a viable threat and a susceptible vulnerability may exist but the risk is a function of the degree of exposure.
question
External storage
answer
The location that contains the backup copies to be used in case recovery or restoration is required in the event of a disaster
question
Extranet
answer
A private network that uses Web technology, permitting the sharing of portions of an enterprise's information or operations with suppliers, vendors, partners, customers, or other enterprises.
question
Fail Safe
answer
Automatic protection of programs and/or processing systems when hardware or software failure is detected.
question
Failover
answer
The capability to switch over automatically (typically without human intervention or warning) to a redundant or standby information system upon the failure or abnormal termination of the previously active system.
question
Fall-through logic
answer
An optimized code based on a branch prediction that predicts which way a program will branch when an application is presented
question
False Positive
answer
An alert that incorrectly indicates that malicious activity is occurring
question
False Negative
answer
A lack of or incorrect alert indicating that no malicious activity is occurring
question
Federal energy regulatory commission (FERC) USA
answer
The Federal Energy Regulatory Commission (FERC) is the United States federal agency with jurisdiction over interstate electricity sales, wholesale electric rates, hydroelectric licensing,natural gas pricing, and oil pipeline rates. FERC also reviews and authorizes liquefied natural gas (LNG) terminals, interstate natural gas pipelines and non-federal hydropower projects
question
Federal financial institutions examination council (FFIEC) USA
answer
The Federal Financial Institutions Examination Council, or FFIEC, is a formal interagency body of the United States government empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions by the Board of Governors of the Federal Reserve System (FRB), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), MAIC Mergers & Acquisitions International Clearing and the Consumer Financial Protection Bureau(CFPB) and to make recommendations to promote uniformity in the supervision of financial institutions.
question
File Encryption
answer
The process of encrypting individual files on a storage medium and permitting access to the encrypted data only after proper authentication is provided.
question
File Transfer Protocol (FTP)
answer
A TCP/IP protocol specifying the transfer of text or binary files across the network.
question
Financial security authority (FSA) UK
answer
The Financial Services Authority is the regulator of the financial services industry in the UK.
question
Firewall
answer
A system or combination of systems that enforces a boundary between two or more networks typically forming a barrier between a secure and an open environment such as the Internet
question
Firmware
answer
Computer programs and data stored in hardware - typically in read-only memory (ROM) or programmable read-only memory (PROM) - such that the programs and data cannot be dynamically written or modified during execution of the programs.
question
Flooding
answer
An attack that attempts to cause a failure in a system by providing more input than the system can process properly.
question
Foreign corrupt practices act (FPCA)
answer
In 1998 the United States Congress and 33 other countries acted against the bribery of foreign officials, essentially government officials in an attempt to reduce corruption and money laundering through the global financial system.
question
Forensic Copy
answer
An accurate bit-for-bit reproduction of the information contained on an electronic device or associated media, whose validity and integrity has been verified using an accepted algorithm.
question
Forensic examination
answer
The process of collecting, assessing, classifying and documenting digital evidence to assist in the identification of an offender and the method of compromise
question
Forensic Specialist
answer
A professional who locates, identifies, collects, analyzes, and examines data while preserving the integrity and maintaining a strict chain of custody of information discovered.
question
Forensics
answer
The practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.
question
Full Disk Encryption (FDE)
answer
The process of encrypting all the data on the hard disk drive used to boot a computer, including the computer's operating system, and permitting access to the data only after successful authentication with the full disk encryption product
question
Generally accepted information security principles (GAISP)
answer
GAISP describes eight pervasive principles and fourteen practices for information security. Each of the principles applies to each of the practices.
question
Gap analysis
answer
A process used to determine the difference between and what is required to move from an existing state and the desired state.
question
Guideline
answer
A description of a particular way of accomplishing something that is less prescriptive than a procedure
question
Hardening
answer
Configuring a host's operating systems and applications to reduce the host's security weaknesses.
question
Hash Function
answer
An algorithm that computes a value based on a data object thereby mapping the data object to a smaller data object.
question
Help desk
answer
A service offered via telephone/Internet by an organization to its clients or employees, which provides information, assistance and troubleshooting advice regarding software, hardware or networks. A help desk is staffed by people that can either resolve the problem on their own or escalate the problem to specialized personnel. A help desk is often equipped with dedicated customer relationship management (CRM) software that logs the problems and tracks them until they are solved.
question
High Availability
answer
A failover feature to ensure availability during device or component interruptions.
question
Host based Intrusion Detection System (HIDS)
answer
A host-based IDS monitors all or parts of the dynamic behavior and the state of a computer system.
question
Honeypot
answer
A specially configured server, also known as a decoy server, designed to attract and monitor intruders in a manner such that their actions do not affect production systems
question
Hot site
answer
A fully operational offsite data processing facility equipped with hardware and system software to be used in the event of a disaster
question
Hypertext Markup Language (HTML)
answer
The set of markup symbols or codes inserted in a file intended for display on a World Wide Web browser page.
question
Hypertext Transfer Protocol (HTTP)
answer
A communication protocol used to connect to servers on the World Wide Web. Its primary function is to establish a connection with a web server and transmit HTML, XML or other pages to the client browsers.
question
HTTPS
answer
A secure form of HTTP using encryption
question
Heating, ventilation and air conditioning (HVAC)
answer
The main purposes of a Heating, Ventilation, and Air-Conditioning (HVAC) system are to help maintain good indoor air quality through adequate ventilation with filtration and provide thermal protection for IT equipment
question
IA Architecture
answer
A description of the structure and behavior for an enterprise's security processes, information security systems, personnel and organizational sub-units, showing their alignment with the enterprise's mission and strategic plans.
question
IA Infrastructure
answer
The underlying security framework that lies beyond an enterprise's defined boundary, but supports its IA and IA-enabled products, its security posture and its risk management plan.
question
ICT
answer
ICT is an acronym that stands for Information Communications Technology and is largely synonymous with IT
question
Identification
answer
The process of verifying the identity of a user, process, or device, usually as a prerequisite for granting access to resources in an IT system
question
Identity
answer
A unique name of an individual person or device. Since the legal names of persons are not necessarily unique, the identity of a person must include sufficient additional information to make the complete name unique
question
Impact
answer
The magnitude of harm that can be expected to result from the consequences of unauthorized disclosure of information, unauthorized modification of information, unauthorized destruction of information, or loss of information or information system availability.
question
Impact analysis
answer
An impact analysis is a study to prioritize the criticality of information resources for the organization based on costs (or consequences) of adverse events. In an impact analysis, threats to assets are identified and potential business losses determined for different time periods. This assessment is used to justify the extent of safeguards that are required and recovery time frames. This analysis is the basis for establishing the recovery strategy.
question
Incident
answer
An adverse event in an information system or network or the threat of the occurrence of such an event
question
Incident Handling
answer
An action plan for dealing with intrusions, cyber-theft, denial of service, fire, floods, and other security-related events. It is comprised of a six step process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned
question
Incident Management Team - IMT
answer
A team of highly trained, experienced, and credentialed people that can come together and remedy unanticipated disruptive security events
question
Incident Response Team -IRT
answer
The first responders to unanticipated disruptive events with the objective of containing damage, restoring services and investigating causes.
question
Incident Response Plan - IRP
answer
A part of business continuity planning that addresses the nature, scope, constituency and charter of the IMT and IRT as well as notification and escalation procedures. It also defines severity and declaration criteria, triage procedures, training and deployment requirements and other significant aspects of incident response.
question
Incremental Backups
answer
The backup of files that have been modified since the last backup. If dump levels are used, these backup's only backup files changed since last backup of a lower dump level.
question
Information Assurance - IA
answer
Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. Synonymous with information security
question
Information Security Governance
answer
The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise's resources are used responsibly
question
Information Security Program
answer
The overall combination of technical, operational and procedural measures, and management structures implemented to provide for the confidentiality, integrity and availability of information based on business requirements and risk analysis
question
Information Security
answer
The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. Synonymous with Information Assurance - IA
question
Information Security Architect
answer
Individual, group, or organization responsible for ensuring that the information security requirements necessary to protect the organization's core missions and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting information systems supporting those missions and business processes.
question
Integrity
answer
The accuracy, completeness and validity of information
question
Intellectual Property
answer
Useful artistic, technical, and/or industrial information, knowledge or ideas that convey ownership and control of tangible or virtual usage and/or representation. Also known as the intangible property of value.
question
Internal controls
answer
The policies, procedures, practices and organizational structures designed to provide reasonable assurance that business objectives will be achieved and undesired events will be prevented or detected and corrected
question
Internal Rate of Return (IRR)
answer
The return on an investment or project is the "annualized effective compounded return rate" or "rate of return" that makes the net present value of all cash flows (both positive and negative) from a particular investment equal to zero. Commonly used to evaluate the desirability of investments or projects.
question
Internet
answer
A term to describe connecting multiple separate networks together.
question
Internet Control Message Protocol - ICMP
answer
An Internet Standard protocol that is used to report error conditions during IP datagram processing and to exchange other information concerning the state of the IP network.
question
Internet Message Access Protocol (IMAP)
answer
A protocol that defines how a client should fetch mail from and return mail to a mail server. IMAP is intended as a replacement for or extension to the Post Office Protocol (POP). It is defined in RFC 1203 (v3) and RFC 2060 (v4).
question
Internet service provider (ISP)
answer
A third party that provides individuals and organizations access to the Internet and a variety of other Internet-related services
question
Interruption window
answer
The time the company can wait from the point of failure to the restoration of the minimum and critical services or applications. After this time, the progressive losses caused by the interruption are excessive for the organization.
question
Intranet
answer
A computer network, especially one based on Internet technology that an organization uses for its own internal, and usually private, purposes and that is closed to outsiders.
question
Intrusion detection
answer
The process of monitoring the events occurring in a computer system or network to detect signs of unauthorized access or attack
question
Intrusion detection system (IDS)
answer
An IDS inspects network and host security activity to identify suspicious patterns that may indicate a network or system attack
question
Intrusion prevention system (IPS)
answer
An IPS inspects network and host security activity to identify suspicious patterns that may indicate a network or system attack and then blocks it at the firewall to prevent damage to information resources.
question
IP Security (IPSec)
answer
A set of protocols developed by the Internet Engineering Task Force (IETF) to support the secure exchange of packets
question
ISO/IEC 17799
answer
Originally released as part of the British Standard for Information Security in 1999 and then as the Code of Practice for Information Security Management in October 2000, it was elevated by the International Organization for Standardization (ISO) to an international code of practice for information security management. This standard defines information's confidentiality, integrity and availability controls in a comprehensive information security management system. The latest version is ISO/IEC 17799:2005.
question
ISO/IEC 2700
answer
An international standard, released in 2005 and revised in 2006, that defines a set of requirements for an information security management system. Prior its adoption by the ISO, this standard was known as BS 17799 Part 2, which was originally published in 1999.
question
ISO/IEC 27002
answer
A code of practice that contains a structured list of suggested information security controls for organizations implementing an information security management system. Prior to its adoption by ISO/IEC, this standard existed as BS 77799.
question
ISO/IEC 31000
answer
The purpose of ISO 31000:2009 is to provide principles and generic guidelines on risk management. ISO 31000 seeks to provide a universally recognized paradigm for practitioners and companies employing risk management processes to replace the myriad of existing standards, methodologies and paradigms that differed between industries, subject matters and regions
question
ISO/IEC 15504
answer
ISO/IEC 15504 Information technology — Process assessment, also known as SPICE (Software Process Improvement and Capability Determination), is a set of technical standards documents for the computer software development process and related business management functions
question
IT governance
answer
The responsibility of executives and the board of directors. Consists of the leadership, organizational structures and processes that ensure that the enterprise's IT sustains and extends the organization's strategies and objectives.
question
IT steering committee
answer
An executive management-level committee that assists the executive in the delivery of the IT strategy, oversees day?to?day management of IT service delivery and IT projects and focuses on implementation aspects
question
IT strategic plan
answer
A long?term plan, i.e., three? to five?year horizon, in which business and IT management cooperatively describe how IT resources will contribute to the enterprise's strategic objectives (goals)
question
IT strategy committee
answer
A committee at the level of the board of directors to ensure that the board is involved in major IT matters and decisions. The committee is primarily accountable for managing the portfolios of IT?enabled investments, IT services and other IT resources. The committee is the owner of the portfolio.
question
Kerberos
answer
A widely used authentication protocol developed at the Massachusetts Institute of Technology (MIT). In "classic" Kerberos, users share a secret password with a Key Distribution Center (KDC). The user, Alice, who wishes to communicate with another user, Bob, authenticates to the KDC and is furnished a "ticket" by the KDC to use to authenticate with Bob. When Kerberos authentication is based on passwords, the protocol is known to be vulnerable to off-line dictionary attacks by eavesdroppers who capture the initial user-toKDC exchange.
question
Key goal indicator (KGI)
answer
A measure that tells management, after the fact, whether an IT process has achieved its business requirements; usually expressed in terms of information criteria
question
Key Logger
answer
A program designed to record which keys are pressed on a computer keyboard used to obtain passwords or encryption keys and thus bypass other security measures.
question
Key performance indicator (KPI)
answer
A measure that determines how well the process is performing in enabling the goal to be reached. A KPI is a lead indicator of whether a goal will likely be reached, and a good indicator of capability, practices and skills. It measures an activity goal, which is an action that the process owner must take to achieve effective process performance.
question
Key risk indicator (KRI)
answer
A subset of risk indicators that are highly relevant and possess a high probability of predicting or indicating important risk
question
Keystroke Monitoring
answer
The process used to view or record both the keystrokes entered by a computer user and the computer's response during an interactive session. Keystroke monitoring is usually considered a special case of audit trails.
question
Least Privilege
answer
Least Privilege is the principle of allowing users or applications the least amount of permissions necessary to perform their intended function.
question
Likelihood of Occurrence
answer
In Information Assurance risk analysis, a weighted factor based on a subjective analysis of the probability that a given threat is capable of exploiting a given vulnerability.
question
Lightweight Directory Access Protocol (LDAP)
answer
A software protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices in a network, whether on the public Internet or on a corporate Intranet.
question
Link Encryption
answer
Link encryption encrypts all of the data along a communications path (e.g., a satellite link, telephone circuit, or T1 line). Since link encryption also encrypts routing data, communications nodes need to decrypt the data to continue routing.
question
Local area network
answer
A local area network (LAN) is a computer network that interconnects computers in a limited area such as a home, school, computer laboratory, or office building using network media.[1] The defining characteristics of LANs, in contrast to wide area networks (WANs), include their usually higher data-transfer rates, smaller geographic area, and lack of a need for leased telecommunication lines
question
Local Registration Authority (LRA)
answer
A Registration Authority with responsibility for a local community in a PKI-enabled environment.
question
Logic Bomb
answer
A piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met.
question
Media Access Control (MAC) Address
answer
A physical address; a numeric value that uniquely identifies that network device from every other device on the planet.
question
Mail relay server
answer
An e-mail server that relays messages so that neither the sender nor the recipient is a local user
question
Malicious Code
answer
Software (e.g., Trojan horse) that appears to perform a useful or desirable function, but actually gains unauthorized access to system resources or tricks a user into executing other malicious logic.
question
Malware
answer
A generic term for a number of different types of malicious code.
question
Mandatory access control (MAC)
answer
A means of restricting access to data based on varying degrees of security requirements for information contained in the objects and the corresponding security clearance of users or programs acting on their behalf.
question
Man-in-the-middle Attack (MitM)
answer
An attack on the authentication protocol run in which the attacker positions himself in between the claimant and verifier so that he can intercept and alter data traveling between them.
question
Masqueraders
answer
Attackers that penetrate systems by using the identity of legitimate users and their login credentials
question
Maximum tolerable outages (MTO)
answer
Maximum time the organization can support processing in alternate mode
question
Message Authentication Code
answer
An ANSI standard checksum that is computed using the Data Encryption Standard (DES)
question
Message Digest
answer
A cryptographic checksum, typically generated for a file that can be used to detect changes to the file; Secure Hash Algorithm-1 (SHA-1) is an example of a message digest algorithm.
question
Metric
answer
A measure from one or more points of reference
question
Maximum tolerable outage (MTO)
answer
The maximum time that the organization can support processing in the alternate mode
question
Mirrored site
answer
An alternate site that contains the same information as the original. Mirror sites are set up for backup and disaster recovery as well as to balance the traffic load for numerous download requests. Such download mirrors are often placed in different locations throughout the Internet.
question
Mobile site
answer
The use of a mobile/temporary facility to serve as a business resumption location. They can usually be delivered to any site and can house information technology and staff.
question
Monitoring policy
answer
Rules outlining or delineating the way in which information about the use of computers, networks, applications and information is captured and interpreted.
question
Multipurpose internet mail extension (MIME)
answer
A specification for formatting non-ASCII messages so that they can be sent over the Internet. Many e-mail clients now support MIME, which enables them to send and receive graphics, audio, and video files via the Internet mail system. In addition, MIME supports messages in character sets other than ASCII.
question
Naming Authority
answer
An organizational entity responsible for assigning distinguished names (DNs) and for assuring that each DN is meaningful and unique within its domain.
question
Need-To-Know
answer
A method of isolating information resources based on a user's need to have access to that resource in order to perform their job but no more. The terms 'need-to know" and "least privilege" express the same idea. Need-to-know is generally applied to people, while least privilege is generally applied to processes.
question
Net present value (NPV)
answer
The discounted value of an investment's cash inflows minus the discounted value of its cash outflows. To be adequately profitable, an investment should have a net present value greater than zero
question
Network address translation (NAT)
answer
Basic NATs are used when there is a requirement to interconnect two IP networks with incompatible addressing. However it is common to hide an entire IP address space, usually consisting of private IP addresses, behind a single IP address (or in some cases a small group of IP addresses) in another (usually public) address space. To avoid ambiguity in the handling of returned packets, a one-to-many NAT must alter higher level information such as TCP/UDP ports in outgoing communications and must maintain a translation table so that return packets can be correctly translated back
question
Network based intrusion detection (NIDs)
answer
Network based intrusion detection provides broader coverage than host based approaches but functions in the same manner detecting attacks using either an anomaly based or signature based approach or both.
question
Nonce
answer
A value used in security protocols that is never repeated with the same key. For example, challenges used in challenge-response authentication protocols generally must not be repeated until authentication keys are changed, or there is a possibility of a replay attack. Using a nonce as a challenge is a different requirement than a random challenge, because a nonce is not necessarily unpredictable.
question
Nonintrusive monitoring
answer
The use of transported probes or traces to assemble information, track traffic and identify vulnerabilities
question
Nonrepudiation
answer
The assurance that a party cannot later deny originating data; that is, it is the provision of proof of the integrity and origin of the data and can be verified by a third party. A digital signature can provide nonrepudiation.
question
Organization for Economic Cooperation and Development (OECD)
answer
The Organization for Economic Co-operation and Development (OECD, French:Organisation de coopération et de développement économiques, OCDE) is an international economic organisation of 34 countries founded in 1961 to stimulate economic progress and world trade. It is a forum of countries committed to democracy and the market economy, providing a platform to compare policy experiences, seek answers to common problems, identify good practices, and co-ordinate domestic and international policies of its members
question
Offline files
answer
Computer file storage media not physically connected to the computer; typically tapes or tape cartridges used for backup purposes
question
Open Shortest Path First (OSPF)
answer
A routing protocol developed for IP networks. It is based on the shortest path first or link state algorithm.
question
Open Source Security Testing Methodology
answer
An open and freely available methodology and manual for security testing
question
Open systems interconnection* (OSI)
answer
The main idea of the OSI model is that the process of communication between two end points in a telecommunication network can be divided into layers, with each layer adding its own set of special, related functions. OSI divides telecommunication into seven layers. The layers are in two groups. The upper four layers are used whenever a message passes from or to a user. The lower three layers (up to the network layer) are used when any message passes through the host computer or router. Each communicating user or program is at a computer equipped with these seven layers of function. The actual programming and hardware that furnishes these seven layers of function is usually a combination of the computer operating system, applications (such as your Web browser), TCP/IP or alternative transport and network protocols, and the software and hardware that enable you to put a signal on one of the lines attached to your computer.
question
OSI Layer 1
answer
The physical layer...This layer conveys the bit stream through the network at the electrical and mechanical level. It provides the hardware means of sending and receiving data on a carrier.
question
OSI Layer 2
answer
The data-link layer...This layer provides synchronization for the physical level and does bit-stuffing for strings of 1's in excess of 5. It furnishes transmission protocol knowledge and management.
question
OSI Layer 3
answer
The network layer...This layer handles the routing of the data (sending it in the right direction to the right destination on outgoing transmissions and receiving incoming transmissions at the packet level). The network layer does routing and forwarding.
question
OSI Layer 4
answer
The transport layer...This layer manages the end-to-end control (for example, determining whether all packets have arrived) and error-checking. It ensures complete data transfer.
question
OSI Layer 5
answer
The session layer...This layer sets up, coordinates, and terminates conversations, exchanges, and dialogs between the applications at each end. It deals with session and connection coordination.
question
OSI Layer 6
answer
The presentation layer...This is a layer, usually part of an operating system, that converts incoming and outgoing data from one presentation format to another (for example, from a text stream into a popup window with the newly arrived text). Sometimes called the syntax layer.
question
OSI Layer 7
answer
The application layer...This is the layer at which communication partners are identified, quality of service is identified, user authentication and privacy are considered, and any constraints on data syntax are identified. (This layer is not the application itself, although some applications may perform application layer functions.)
question
Operations Security (OPSEC)
answer
Systematic and proven process by which potential adversaries can be denied information about capabilities and intentions by identifying, controlling, and protecting generally unclassified evidence of the planning and execution of sensitive activities. The process involves five steps: identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risk, remediation.
question
Outcome measure
answer
Represents the consequences of actions previously taken and is often referred to as a lag indicator. An outcome measure frequently focuses on results at the end of a time period and characterizes historical performance. Also referred to as a key goal indicator (KGI) and used to indicate whether goals have been met. Can be measured only after the fact and, therefore, is called a lag indicator.
question
Packet
answer
A piece of a message transmitted over a packet-switching network. One of the key features of a packet is that it contains the destination address in addition to the data. In IP networks, packets are often called datagrams.
question
Packet filtering
answer
Controlling access to a network by analyzing the attributes of the incoming and outgoing packets, and either letting them pass or denying them based on a list of rules
question
Packet Sniffer
answer
Software that observes and records network traffic.
question
Packet Switched Network
answer
A packet switched network is where individual packets each follow their own paths through the network from one endpoint to another.
question
Partitions
answer
Major divisions of the total physical hard disk space.
question
Password Authentication Protocol (PAP)
answer
Password Authentication Protocol is a simple, weak authentication mechanism where a user enters the password and it is then sent across the network, usually in the clear.
question
Password Cracking
answer
Password cracking is the process of attempting to guess passwords, given the password file information.
question
Password Sniffing
answer
Passive wiretapping, usually on a local area network, to gain knowledge of passwords.
question
Patch
answer
A patch is a small update released by a software manufacturer to fix bugs in existing programs.
question
Patching
answer
Patching is the process of updating software to a different version.
question
Patch Management
answer
The systematic notification, identification, deployment, installation, and verification of operating system and application software code revisions. These revisions are known as patches, hot fixes, and service packs.
question
Passive response
answer
A response option in intrusion detection in which the system simply reports and records the problem detected, relying on the user to take subsequent action
question
Password cracker
answer
A tool that tests the strength of user passwords searching for passwords that are easy to guess by repeatedly trying words from specially crafted dictionaries and often also by generating thousands (and, in some cases, even millions) of permutations of characters, numbers and symbols
question
Payment card industry (PCI)
answer
The term is specifically used to refer to the Payment Card Industry Security Standards Council, a council originally formed by American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International on Sept. 7, 2006, with the goal of managing the ongoing evolution of the Payment Card Industry Data Security Standard. The council itself claims to be independent of the various card vendors that make up the council.
question
Payment card industry data security standard (PCI-DSS)
answer
The PCI Council formed a body of security standards known as the PCI Data Security Standards, (PCI DSS), and these standards consist of 12 significant requirements including multiple sub-requirements which contain numerous directives against which businesses may measure their own payment card security policies, procedures and guidelines
question
Penetration testing
answer
A live test of the effectiveness of security defenses through mimicking the actions of real-life attackers
question
Personally Identifiable Information (PII)
answer
Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc., alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother's maiden name, etc.
question
Pharming
answer
This is a more sophisticated form of MITM attack. A user's session is redirected to a masquerading website. This can be achieved by corrupting a DNS server on the Internet and pointing a URL to the masquerading website's IP. Almost all users use a URL like www.worldbank.com instead of the real IP (192.86.99.140) of the website. Changing the pointers on a DNS server, the URL can be redirected to send traffic to the IP of the pseudo website. At the pseudo website, transactions can be mimicked and information like login credentials can be gathered. With this the attacker can access the real www.worldbank.com site and conduct transactions using the credentials of a valid user on that website.
question
Phishing
answer
The use of e-mails that appear to originate from a trusted source to trick a user into entering valid credentials at a fake website. Typically the e-mail and the web site looks like they are part of a bank the user is doing business with.
question
Port Scanning
answer
Using a program to remotely determine which ports on a system are open (e.g., whether systems allow connections through those ports).
question
Plan-do-check-act (PDCA)
answer
PDCA (plan-do-check-act or plan-do-check-adjust) is an iterative four-step management method used in business for the control and continuous improvement of processes and products. It is also known as the Deming circle/cycle/wheel, Shewhart cycle, control circle/cycle, or plan-do-study-act (PDSA).
question
Policies
answer
High-level statements of management intent and direction
question
Port
answer
A hardware interface between a CPU and a peripheral device. Can also refer to a software (virtual) convention that allows remote services to connect to a host operating system in a structured manner
question
Port Scan
answer
A port scan is a series of messages sent by someone attempting to break into a computer to learn which computer network services, each associated with a "well-known" port number, the computer provides. Port scanning, a favorite approach of computer cracker, gives the assailant an idea where to probe for weaknesses. Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed for weakness.
question
Post Office Protocol, Version 3 (POP3)
answer
An Internet Standard protocol by which a client workstation can dynamically access a mailbox on a server host to retrieve mail messages that the server has received and is holding for the client
question
Protocol
answer
A formal specification for communicating; an IP address the special set of rules that end points in a telecommunication connection use when they communicate. Protocols exist at several levels in a telecommunication connection.
question
Privacy
answer
Freedom from unauthorized intrusion or disclosure of information about individuals
question
Private Key
answer
The secret part of an asymmetric key pair that is typically used to digitally sign or decrypt data in a PKI.
question
Privileged Accounts
answer
Individuals who have access to set "access rights" for users on a given system. Sometimes referred to as system or network administrative accounts.
question
Procedures
answer
A detailed description of the steps necessary to perform specific operations in conformance with applicable standards
question
Proxy
answer
A proxy is an application that "breaks" the connection between client and server. The proxy accepts certain types of traffic entering or leaving a network and processes it and forwards it. This effectively closes the straight path between the internal and external networks making it more difficult for an attacker to obtain internal addresses and other details of the organization's internal network. Proxy servers are available for common Internet services; for example, a Hyper Text Transfer Protocol (HTTP) proxy used for Web access, and a Simple Mail Transfer Protocol (SMTP) proxy used for email.
question
Proxy server
answer
A server that acts on behalf of a user. Typically proxies accept a connection from a user, make a decision as to whether or not the user or client IP address is permitted to use the proxy, perhaps perform additional authentication, and then complete a connection to a remote destination on behalf of the user.
question
Proximity factors
answer
The distance from potential hazards, which can include flooding risk from nearby waterways, hazardous material manufacturing or storage, or other situations that may pose a risk to the operation of a recovery
question
Public Key
answer
The public part of an asymmetric key pair that is typically used to verify signatures or encrypt data in a PKI
question
Public key infrastructure (PKI)
answer
The framework and services that provide for the generation, production, distribution, control, accounting, and destruction of public key certificates. Components include the personnel, policies, processes, server platforms, software, and workstations used for the purpose of administering certificates and public-private key pairs, including the ability to issue, maintain, recover, and revoke public key certificates.
question
Quality assurance (QA)
answer
A process for testing to ensure specifications are met
question
Red Team
answer
A group of people authorized and organized to emulate a potential adversary's attack or exploitation capabilities against an enterprise's security posture. The Red Team's objective is to improve enterprise Information Assurance by demonstrating the impacts of successful attacks and by demonstrating what works for the defenders (i.e., the Blue Team) in an operational environment.
question
Relying Party
answer
An entity that relies upon the subscriber's credentials, typically to process a transaction or grant access to information or a system typically in a PKI.
question
Remediation
answer
The act of correcting a vulnerability or eliminating a threat. Three possible types of remediation are installing a patch, adjusting configuration settings, or uninstalling a software application.
question
Reciprocal agreement
answer
Emergency processing agreements among two or more organizations with similar equipment or applications. Typically, participants promise to provide processing time to each other when an emergency arises.
question
Recovery action
answer
Execution of a response or task according to a written procedure
question
Recovery point objective (RPO)
answer
Determined based on the acceptable data loss in case of a disruption of operations. Indicates the earliest point in time to which it is acceptable to recover data. Effectively quantifies the permissible amount of data loss in case of interruption i.e. the last point of known good data
question
Recovery time objective (RTO)
answer
The amount of time allowed for the recovery of a business function or resource after a disaster occurs
question
Redundant Array of Inexpensive Disks (RAID)
answer
A technology that provides performance improvements and fault-tolerant capabilities, via hardware or software solutions, by writing to a series of multiple disks to improve performance and save large files simultaneously
question
Redundant site
answer
A recovery strategy involving the duplication of key information technology components, including data or other key business processes, whereby fast recovery can take place
question
Registration Authority
answer
A trusted entity that establishes and vouches for the identity of a subscriber to a CSP i.e binds physical identity to a logical identity such as a certificate. The RA may be an integral part of a CSP, or it may be independent of a CSP, but it has a relationship to the CSP(s)
question
Request for proposal (RFP)
answer
A request for proposal (RFP) is issued at an early stage in a procurement process, where an invitation is presented for suppliers, often through a bidding process, to submit a proposal on a specific commodity or service. The RFP process brings structure to the procurement decision and is meant to allow the risks and benefits to be identified clearly up front. The RFP may dictate to varying degrees the exact structure and format of the supplier's response. Effective RFPs typically reflect the strategy and short/long-term business objectives, providing detailed insight upon which suppliers will be able to offer a matching perspective
question
Replay Attacks
answer
An attack that involves the capture of transmitted authentication or access control information and its subsequent retransmission with the intent of producing an unauthorized effect or gaining unauthorized access.
question
Residual risk
answer
The remaining risk after management has implemented risk response
question
Resilience
answer
The ability of a system or network to resist failure or to recover quickly from any disruption, usually with minimal recognizable effect
question
Return on investment (ROI)
answer
A measure of operating performance and efficiency, computed in its simplest form by dividing net income by the total investment over the period being considered
question
Return on security investment (ROSI)
answer
An estimate of return on security investment based on how much will be saved by reduced losses divided by the investment.
question
Risk
answer
The combination of the probability of an event and its consequence. (ISO/IEC 73). Risk has traditionally been expressed as Threats X Vulnerabilities = Risk.
question
Risk assessment
answer
A process used to identify and evaluate risk and potential effects. Risk assessment includes assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event.
question
Risk avoidance
answer
The process for systematically avoiding risk, constituting one approach to managing risk
question
Risk mitigation
answer
The management and reduction of risk through the use of countermeasures and controls
question
Risk Tolerance
answer
The acceptable level of deviation from acceptable risk
question
Risk transfer
answer
The process of assigning risk to another organization, usually through the purchase of an insurance policy or outsourcing the service
question
Robustness
answer
The extent of the ability of systems to withstand attack; system strength. The ability of an Information Assurance entity to operate correctly and reliably across a wide range of operational conditions, and to fail gracefully outside of that operational range.
question
Role Based Access Control
answer
Role based access control assigns users to roles based on their organizational functions and determines authorization based on those roles.
question
Root
answer
Root is the name of the administrator account in Unix systems.
question
Router
answer
Routers interconnect logical networks by forwarding information to other networks based upon IP addresses.
question
Root cause analysis
answer
Process of diagnosis to establish origins of events, which can be used for learning from consequences, typically of errors and problems
question
Rootkit
answer
A rootkit is a set of software tools intended to conceal running processes, files or system data from the operating system. Rootkits have their origin in benign applications, but have been used increasingly by malware to help intruders maintain access to systems while avoiding detection. Rootkits exist for a variety of operating systems such as Microsoft Windows, Linux and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules.
question
Secret key
answer
A cryptographic key that is used with a secret key (symmetric) cryptographic algorithm, that is uniquely associated with one or more entities and is not made public. The same key is used to both encrypt and decrypt data. The use of the term "secret" in this context does not imply a classification level, but rather implies the need to protect the key from disclosure.
question
Secure Hash Algorithm (SHA)
answer
A hash algorithm with the property that is computationally infeasible 1) to find a message that corresponds to a given message digest, or 2) to find two different messages that produce the same message digest.
question
Security Attribute
answer
A security-related quality of an object. Security attributes may be represented as hierarchical levels, bits in a bit map, or numbers. Compartments, caveats, and release markings are examples of security attributes.
question
Security metrics
answer
A standard of measurement from one or more reference points used in management of security-related activities
question
Security information and event management (SIEM)
answer
Security Information and Event Management (SIEM) solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM (security event management). SIEM technology provides real-time analysis of security alerts generated by network hardware and applications. SIEM solutions come as software, appliances or managed services, and are also used to log security data and generate reports for compliance purposes.
question
SIEM Data Aggregation
answer
SIEM/LM (log management) solutions aggregate data from many sources, including network, security, servers, databases, applications, providing the ability to consolidate monitored data to help avoid missing crucial events.
question
SIEM Correlation
answer
The analysis of events for common attributes to link events together into meaningful bundles. This technology provides the ability to perform a variety of correlation techniques to integrate different sources, in order to turn data into useful information.
question
SIEM Alerting
answer
The automated analysis of correlated events and production of alerts, to notify recipients of immediate issues.
question
SIEM Dashboards
answer
SIEM/LM tools take event data and turn it into informational charts to assist in seeing patterns, or identifying activity that is not forming a standard pattern.
question
SIEM Compliance
answer
SIEM applications can be employed to automate the gathering of compliance data, producing reports that adapt to existing security, governance and auditing processes.
question
SIEM Retention
answer
SIEM/SIM solutions employ long-term storage of historical data to facilitate correlation of data over time, and to provide the retention necessary for compliance requirements.
question
Security Posture
answer
The security status of an enterprise's networks, information, and systems based on IA resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense of the enterprise and to react as the situation changes.
question
Sensitivity
answer
A measure of the impact that improper disclosure of information may have on an organization
question
Separation of Duties
answer
Separation of duties is the principle of splitting privileges among multiple individuals or systems to reduce risk of fraud or other malfeasance
question
Session Key
answer
In the context of symmetric encryption, a key that is temporary or is used for a relatively short period of time. Usually, a session key is used for a defined period of communication between two computers, such as for the duration of a single connection or transaction set, or the key is used in an application that protects relatively large amounts of data and, therefore, needs to be re-keyed frequently.
question
Service delivery objective (SDO)
answer
Directly related to business needs, SDO is the level of services to be reached during the alternate process mode until the normal situation is restored.
question
Service level agreement (SLA)
answer
An agreement, preferably documented, between a service provider and the customer(s)/user(s) that defines minimum performance targets for a service and how they will be measured
question
Shell programming
answer
A shell script is a script written for the shell, or command line interpreter, of an operating system. It is often considered a simple domain-specific programming language. Typical operations performed by shell scripts include file manipulation, program execution and printing text. Usually, shell script refers to scripts written for a Unix shell, while COMMAND.COM (DOS) and cmd.exe (Windows) command line scripts are usually called batch files. Many shell script interpreters double as command line interface such as the various Unix shells, Windows PowerShell or the MS-DOS COMMAND.COM. Others, such as AppleScript, add scripting capability to computing environments lacking a command line interface. Other examples of programming languages primarily intended for shell scripting include digital command language (DCL) and job control language (JCL).
question
Secure multipurpose internet mail extension (S/MIME)
answer
(Secure/Multipurpose Internet Mail Extensions is a standard for public key encryption and signing of MIME data.
question
Skimming
answer
The unauthorized use of a reader to read tags without the authorization or knowledge of the tag's owner or the individual in possession of the tag.
question
Smart Card
answer
A credit card-sized card with embedded integrated circuits that can store, process, and communicate information.
question
Sniffing
answer
The process by which data traversing a network are captured or monitored
question
Social engineering
answer
An attack based on deceiving users or administrators at the target site into revealing confidential or sensitive information
question
Specification
answer
An assessment object that includes document-based artifacts (e.g., policies, procedures, plans, system security requirements, functional specifications, and architectural designs) associated with an information system.
question
Split knowledge /split key
answer
A security technique in which two or more entities separately hold data items that individually convey no knowledge of the information that results from combining the items; a condition under which two or more entities separately have key components that individually convey no knowledge of the plaintext key that will be produced when the key components are combined in the cryptographic module.
question
Spoofing
answer
Faking the sending address of a transmission in order to gain illegal entry into a secure system
question
Secure shell (SSH)
answer
Secure Shell (SSH) is a network protocol for secure data communication, remote shell services or command execution and other secure network services between two networked computers that it connects via a secure channel over an insecure network.
question
Security steering group (SSG)
answer
The SSG is generally charged with incident management and response organization and oversight.
question
Single sign-on (SSO)
answer
SSO is a process to allow access to numerous systems using one set of authentication credentials.
question
Spyware
answer
Software that is secretly or surreptitiously installed into an information system to gather information on individuals or organizations without their knowledge; a type of malicious code.
question
Structured query language (SQL)
answer
Structured Query Language) is a programming language designed for managing data in relational database management systems
question
Standard
answer
An internal mandatory requirement defining allowable boundaries of people, processes and technologies or a specification approved by a recognized external standards organization, such as ISO
question
Standard operation procedure (SOP)
answer
An SOP is a written document or instruction detailing all steps and activities of a process or procedure. ISO 9001 essentially requires the documentation of all procedures used in any manufacturing process that could affect the quality of the product or service.
question
Steganography
answer
The art and science of communicating in a way that hides the existence of the communication. For example, a secret documentcan be hidden inside another graphic image file, audio file, or other file format.
question
Supervisory control and data acquisition (SCADA)
answer
A generic name for a computerized system that is capable of gathering and processing data and applying operational controls over long distances. Typical uses include power transmission and distribution and pipeline systems. SCADA was designed for the unique communication challenges (delays, data integrity, etc.) posed by the various media that must be used, such as phone lines, microwave, and satellite. Usually shared rather than dedicated.
question
Supply Chain
answer
A system of organizations, people, activities, information, and resources, possibly international in scope, that provides products or services to consumers
question
System development life cycle (SDLC)
answer
The scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation.
question
Symmetric Cryptography
answer
A branch of cryptography involving algorithms that use the same key for two different steps of the algorithm (such as encryption and decryption, or signature creation and signature verification). Symmetric cryptography is sometimes called "secret-key cryptography" (versus public-key cryptography) because the entities that share the key.
question
Symmetric Key
answer
A cryptographic key that is used in a symmetric cryptographic algorithm. Also called a secret key based on the notion of a shared secret.
question
System Owner
answer
Person or organization having responsibility for the development, procurement, integration, modification, operation and maintenance, and/or final disposition of an information system.
question
Technical Controls
answer
The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.
question
Threat
answer
Anything (e.g., object, substance, human) that is capable of acting against an asset in a manner that can result in harm. A potential cause of an unwanted incident. (ISO/IEC 13335)
question
Threat agent
answer
Methods and things used to exploit a vulnerability. Examples include determination, capability, motive and resources.
question
Threat analysis
answer
An evaluation of the type, scope and nature of events or actions that can result in adverse consequences; identification of the threats that exist against information assets and information technology. The threat analysis usually also defines the level of threat and the likelihood of it materializing.
question
Threat event
answer
Any event where a threat element/actor acts against an asset in a manner that has the potential to directly result in harm
question
Threat Assessment
answer
A threat assessment is the identification of types of threats that an organization might be exposed to.
question
Threat Model
answer
A threat model is used to describe a given threat and the harm it could to do a system if it has a vulnerability.
question
Threat Vector
answer
The method a threat uses to get to the target.
question
Transport Layer Security (TLS)
answer
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide communication security over the Internet.[1] TLS and SSL encrypt the segments of network connections above the Transport Layer, using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity.
question
Token
answer
Something that the claimant possesses and controls (typically a key or password) used to authenticate the claimant's identity.
question
Token-Based Access Control
answer
Token based access control associates a list of objects and their privileges with each user. (The opposite of list based.)
question
Token-Based Devices
answer
A token-based device is triggered by the time of day, so every minute the password changes, requiring the user to have the token with them when they log in.
question
Topology
answer
The geometric arrangement of a computer system. Common topologies include a bus, star, and ring. The specific physical, i.e., real, or logical, i.e., virtual, arrangement of the elements of a network. Note 1: Two networks have the same topology if the connection configuration is the same, although the networks may differ in physical interconnections, distances between nodes, transmission rates, and/or signal types.
question
Total cost of ownership (TCO)
answer
The computation of all costs related to acquisition, deployment, training, testing, maintenance, and end of life costs.
question
Transmission control protocol (TCP)
answer
The Transmission Control Protocol (TCP) is one of the core protocols of the Internet Protocol Suite. TCP is one of the two original components of the suite, complementing the Internet Protocol (IP), and therefore the entire suite is commonly referred to as TCP/IP. TCP provides reliable, ordered delivery of a stream of bytes from a program on one computer to another program on another computer. TCP is the protocol that major Internet applications such as the World Wide Web, email, remote administration and file transfer rely on
question
Transmission control protocol/ internet protocol (TCP/IP)
answer
IP is one of the core protocols of the Internet protocol suite and combined with TCP is referred to as TCP/IP
question
Transport Layer Security (TLS) and Secure sockets layer (SSL)
answer
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide communication security over the Internet.[1] TLS and SSL encrypt the segments of network connections above the Transport Layer, using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity.
question
Trojan horse
answer
A Trojan horse, or Trojan, is a standalone malicious program which may give full control of infected PC to another PC[1]. It may also perform typical computer virus activities. Trojan horses may make copies of themselves, steal information, or harm their host computer systems.
question
Two-factor authentication
answer
The use of two independent mechanisms for authentication, for example, requiring a smart card and a password. Typically the combination of something you know, are or have.
question
Trusted Computer System
answer
A system that employs sufficient hardware and software assurance measures to allow its use for processing simultaneously a range of sensitive or classified information.
question
Trusted Computing Base (TCB)
answer
Totality of protection mechanisms within a computer system, including hardware, firmware, and software,
question
Tunneling
answer
Technology enabling one network to send its data via another network's connections. Tunneling works by encapsulating a network protocol within packets carried by the second network.
question
Unauthorized Access
answer
A person gains logical or physical access without permission to a network, system, application, data, or other IT resource. Any access that violates the stated security policy.
question
Unauthorized Disclosure
answer
An event involving the exposure of information to entities not authorized access to the information.
question
Uniform Resource Locator (URL)
answer
The global address of documents and other resources on the World Wide Web. The first part of the address indicates what protocol to use, and the second part specifies the IP address or the domain name where the resource is located. For example, http://www.pcwebopedia.com/index.html.
question
Unix
answer
A popular multi-user, multitasking operating system developed at Bell Labs in the early 1970s. Created by just a handful of programmers, Unix was designed to be a small, flexible system used exclusively by programmers.
question
User datagram protocol (UDP)
answer
The User Datagram Protocol (UDP) is one of the core members of the Internet Protocol Suite, the set of network protocols used for the Internet. With UDP, computer applications can send messages, in this case referred to as datagrams, to other hosts on an Internet Protocol (IP) network without requiring prior communications to set up special transmission channels or data paths.
question
Uninterruptable power supply (UPS)
answer
UPS is typically battery power converted to standard AC operating current using an inverter. It is designed to automatically supply power in the event the primary source fails.
question
Validation
answer
The process of demonstrating that the system under consideration meets in all respects the specification of that system.
question
Value at risk (VAR)
answer
VAR computes the probability of the maximum loss at a 95 or 99% certainty over a defined period based on historical information and exercising all the variables using Monte Carlo simulations. While primarily used in financial analysis, it has been shown to have significant potential value in generally managing risk.
question
Virtual Machine (VM)
answer
Software that allows a single host to run one or more guest operating systems.
question
Virtual private network (VPN)
answer
A secure private network that uses the public telecommunications infrastructure to transmit data. In contrast to a much more expensive system of owned or leased lines that can only be used by one company, VPNs are used by enterprises for both extranets and wide areas of intranets. Using encryption and authentication, a VPN encrypts all data that pass between two Internet points, maintaining privacy and security.
question
Virus signature files
answer
The file of virus patterns that are compared with existing files to determine if they are infected with a virus or worm
question
Voice over IP (VOIP)
answer
Voice over IP (VoIP) commonly refers to the communication protocols, technologies, methodologies, and transmission techniques involved in the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet
question
Vulnerability
answer
A weakness in the design, implementation, operation or internal controls in a process that could be exploited to violate system security
question
Vulnerability analysis
answer
Process of identifying and classifying vulnerabilities
question
Warm site
answer
A warm site is similar to a hot site; however, a warm site is not fully equipped with all necessary hardware needed for recovery.
question
Web hosting
answer
The business of providing the equipment and services required to host and maintain files for one or more web sites, and provide fast Internet connections to those sites. Most hosting is "shared," which means that web sites of multiple companies are on the same server to share/reduce costs.
question
Web server
answer
Using the client-server model and the World Wide Web's Hypertext Transfer Protocol (HTTP), Web server is a software program that serves web pages to users.
question
Wide area network (WAN)
answer
A Wide Area Network (WAN) is a telecommunication network that covers a broad area (i.e., any network that links across metropolitan, regional, or national boundaries).
question
Wiki
answer
Web applications or similar tools that allow identifiable users to add content (as in an Internet forum) and allow anyone to edit that content collectively.
question
Wired Equivalent Privacy (WEP)
answer
A security protocol, specified in the IEEE 802.11 standard, that is designed to provide a WLAN with a level of security and privacy comparable to what is usually expected of a wired LAN. WEP is no longer considered a viable encryption mechanism due to known weaknesses.
question
Wireless Access Point (WAP)
answer
A device that acts as a conduit to connect wireless communication devices together to allow them to communicate and create a wireless network.
question
Worm
answer
A programmed network attack in which a self-replicating program does not attach itself to programs, but rather spreads independently of users' actions
question
Wi-Fi Protected Access 2 (WPA2)
answer
The follow on security method to WPA for wireless networks that provides stronger data protection and network access control. It provides enterprise and consumer Wi-Fi users with a high level of assurance that only authorized users can access their wireless networks. Based on the ratified IEEE 802.11i standard, WPA2 provides government grade security by implementing the National Institute of Standards and Technology (NIST) FIPS 140-2 compliant AES encryption algorithm and 802.1X-based authentication
question
Cryptographic Hash Function
answer
A function that maps a bit string of arbitrary length to a fixed length bit string. Approved hash functions satisfy the following properties: 1. (One-way) It is computationally infeasible to find any input which maps to any pre-specified output, and 2. (Collision resistant) It is computationally infeasible to find any two distinct inputs that map to the same output.
question
Governance
answer
Process that ensures that stakeholders needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved. Process also monitors performance and compliance to objectives.
Get an explanation on any task
Get unstuck with the help of our AI assistant in seconds
New