CISSP

Permutation

(Also called transposition) provides confusion by rearranging the characters of the plaintext, anagram-style

Clipper Chip

(Failed) 1993 Escrowed Encryption Standard (EES), which used the Skipjack algorithm

E3

24 E1s

T3

28 bundled T1s

Grandfather-Father-Son Tape Rotation

3 sets of tapes: 7 daily tapes (the son), 4 weekly tapes (the father), and 12 monthly tapes (the grandfather). Once per week a son tape graduates to father. Once every 5 weeks a father graduates into a grandfather. After running for a year this method ensures there are backup tapes available for the past 7 days, weekly tapes for the past 4 weeks, and monthly tapes for the past 12 months.

Triple DES

56-bit DES applied three times per block

Managed mode

802.11 mode that clients use to connect to an AP

802.11b

802.11 mode that operates at 11 mbps using the 2.4 GHz frequency

802.11g

802.11 mode that operates at 54 mbps using the 2.4 GHz frequency

802.11a

802.11 mode that operates at 54 mbps using the 5 GHz frequency

802.11n

802.11 mode that uses both 2.4 and 5 GHz frequencies and allows speeds of 144 mbps and beyond

Master mode

802.11 mode used by Aps

Ad hoc mode

802.11 peer-to-peer mode with no central AP

Monitor mode

802.11 read-only mode used for sniffing

Bluetooth

802.15 networking, a PAN wireless technology

Object

A "black box" that combines code and data, and sends and receives messages

Attribute

A Column in a relational database table

Cipher

A Cryptographic algorithm

Data Warehouse

A Large collection of Data

SLIP / Serial Line Internet Protocol

A Layer 2 protocol which provides IP connectivity via asynchronous connections such as serial lines and modems.

Dumpster diving

A Physical attack in which a person recovers trash in hopes of finding sensitive information that has been merely discarded in whole rather than being destroyed

RADIUS / Remote Authentication Dial In User Service

A UDP-based third-party authentication system.

Background checks

A Verification of a person's background and experience, Also called pre-employment screening

SIP / Session Initiation Protocol

A VoIP signaling protocol.

ATM/Asynchronous Transfer Mode

A WAN technology that uses fixed length cells

failover

A backup operation that automatically switches to a standby system if the primary system fails or is taken offline. It is an important fault-tolerant function that provides system availability.

GFS / Grandfather Father Son

A backup rotation method

Warm site

A backup site with all the necesssary hardware and connectivity, and configured computes without live data

Cold Site

A backup site with raised floor, power, utilities, and physical security, and no configured systems or data

Cracker

A black hat hacker

Zero knowledge test

A blind penetration test where the tester has no inside information at the start of the test

ISO 17799

A broad-based approach for information security code of practice by the International Organization for Standardization

Capability

A capability outlines the objects a subject can access and the operations the subject can carry out on the different objects. It indicates the access rights for a specific subject; many times, the capability is in the form of a ticket.

Botnet

A central bot command and control (C&C) network, managed by humans

Audit Trail

A chronological set of logs and records used to provide evidence of a system's performance or activity that took place on the system. These logs and records can be used to attempt to reconstruct past events and track the activities that took place, and possibly detect and identify intruders.

Compartment

A class of information that has need-to-know access controls beyond those normally provided for access to confidential, secret, or top-secret information. A compartment is the same thing as a category within a security label. Just because a subject has the proper classification, that does not mean it has a need to know. The category, or compartment, of the security label enforces the subject's need to know.

multilevel security

A class of systems containing information with different classifications. Access decisions are based on the subject's security clearances, need to know, and formal approval.

Savepoint

A clean snapshot of the database tables.

TACACS (Terminal Access Controller Access Control System)

A client/server authentication protocol that provides the same type of functionality as RADIUS and is used as a central access control mechanism mainly for remote users.

covert channel

A communications path that enables a process to transmit information in a way that violates the system's security policy

Distributed Network Protocol 3 (DNP3)

A communications protocol designed for use in SCADA systems, particular those within the power sector, that does not include routing functionality.

Trojan Horse

A computer program that has an apparently or actually useful function, but that also contains hidden malicious capabilities to exploit a vulnerability and/or provide unauthorized access into a system.

Trojan horse

A computer program that has an apparently or actually useful function, but that also contains hidden malicious capabilities to exploit a vulnerability and/or provide unauthorized access into a system.

Accredited

A computer system or network that has received official authorization and approval to process sensitive data in a specific operational environment. There must be a security evaluation of the system's hardware, software, configurations, and controls by technical personnel.

Bot

A computer system running malware that is controlled via a botnet

Extranet

A connection between private Intranets

Best practice

A consensus of the best way to protect the confidentiality, integrity and availability of assets

countermeasure

A control, method, technique, or procedure that is put into place to prevent a threat agent from exploiting a vulnerability. A countermeasure is put into place to mitigate risk. Also called a safeguard or control

Multiprotocol Label Switching (MPLS)

A converged data communications protocol designed to improve the routing speed of high-performance networks.

Fiber Channel over Ethernet (FCoE)

A converged protocol that allows Fiber Channel frames to ride over Ethernet networks

Internet Small Computer System Interface (iSCSI)

A converged protocol that encapsulates SCSI data on TCP segments in order to allow peripherals to be connected to computers across networks.

covert timing channel

A covert channel in which one process modulates its system resource (for example, CPU cycles), which is interpreted by a second process as some type of communication.

covert storage channel

A covert channel that involves writing to a storage location by one process and the direct or indirect ready of the storage location by another process. Covert storage channels typically involve a resource (for example, sectors on a disk) that is shared by two subjects at different security levels.

Object

A data file

Network model (telecommunications)

A description of how a network protocol suite operates

Certification

A detailed inspection that verifies whether a system meets the documented security requirements

Clearance

A determination, typically made by a senior security professional, about whether or not a user can be trusted with a specific level of information

Lightweight Directory Access Protocol (LDAP)

A directory service based on a subset of the X.500 standard that allows users and applications to interact with a directory.

key

A discrete data set that contorls the operation of a cryptography algorithm. In encryption, a key specifies the particular transformation of plaintext to ciphertext, or vice versus, during encryption. Keys are also used in other cryptographic algorithms, such as digital signatures and keyed-hash functions (also known as HMACs), which are often used for authentication and integrity.

RIP / Routing Information Protocol

A distance vector routing protocol that uses hop count as its metric.

Annualized loss expectancy (ALE)

A dollar amount that estiamtes the loss potenial from a risk in a span of a year. Single Loss Expectancy (SLE) x annualized rate of occurrence (ARO) = ALE

Ciphertext

A encrypted message

dictionary attack

A form of attack in which an attacker uses a large set of likely combinations to guess a secret, usually a password.

Packet-switched network

A form of networking where bandwidth is shared and data is carried in units called packets

EULA / End User License Agreement

A form of software licensing agreement

Biba Model

A formal state transition system of a computer security policy that describes a set of access control rules designed to ensure data integrity.

Public Key Infrastructure (PKI)

A framework of programs, procedures, communication protocols, and public key cryptography that enables a diverse group of individuals to communicate securely.

Business Impact Analysis (BIA)

A functional analysis in which a team collects data, documents business functions, develops a hierarchy of business functions, and applies a classification scheme to indicate each individual function's criticality level.

fail-safe

A functionality that ensure that when software or system fails for any reason, it does not end up in a vulnerable state. After a failure, software might default to no access instead of allowing full control, which would be an example of a fail-safe measure.

GAN / Global Area Network

A global collection of WAN's

Delphi technique

A group decision method used to ensure that each member of a group gives an honest and anonymous opinion pertaining to the company's risks.

SHA-1 / Secure Hash Algorithm 1

A hash function that creates a 160-bit message digest.

SHA-2 / Secure Hash Algorithm 2

A hash function that includes SHA-224, SHA-256, SHA-384, and SHA-512, named after the length of the message digest each creates.

Security assessments

A holistic approach to assessing the effectiveness of access control. May use other tests as a subset, including penetration tests and vulnerability scans.

Ticket Granting Service (TGS)

A kerberos service which grants access to services

Foreign key

A key in a related database table that matches a primary key in the parent database

EAP / Extensible Authentication Protocol

A layer 2 authentication framework that describes many specific authentication protocols

Entrapment

A legal defense wher the defendant claims an agent of law enforcement persuaded the defendant to commit a crime that he or she would otherwise not have committed

trademark

A legal right that protects a word, name, product shape, symbol, color, or a combination of these used to identify a product or a company.

Trademark

A legal right that protects a word, name, product shape, symbol, color, or combination of these used to identify a product or company.

Copyright

A legal right that protects the expression of ideas.

operational assurance

A level of confidence of a trusted system's architecture and implementation that enforces the system's security policy. This can include system architecture, covert channel analysis, system integrity, and trusted recovery.

Thread

A lightweight process (LWP)

Access Control list (ACL)

A list of subjects that are authorized to access a particular object. Typically, the types of access are read, write, execute, append, modify, delete, and create.

Database Journal

A log of all database transactions. Should a database becomes corrupted, the database can be reverted to a backup copy, and then subsequent transactions can be "replayed" from the journal, restoring database integrity

Passphrase

A long static password, comprised of words in a phrase or sentence

logic bomb

A malicious program that is triggered by a specific event or condition.

Logic bomb

A malicious program that is triggered when a logical condition is met, such as after a number of transactions have been processes, or on a specific date

Data Owner

A management employee responsible for assuring that specific data is protected

XML / Extensible Markup Language

A markup language designed as a standard way to encode documents and data

lattice-based access control mode

A mathematical model that allows a system to easily represent the different security levels and control access attempts based on those levels. Every pair of elements has a highest lower bound and a lowest upper bound of access rights. The classes stemmed from military designations.

formal security policy model

A mathematical statement of a security policy. When an operating system is created, it can be built upon a predeveloped model that lays out how all activates will take place in each and every situation. This model can be expressed mathematically, which is then translated into a programming language.

Parity

A means to achieve data redundancy without incurring the same degree of cost as that of mirroring in terms of disk usage and write performance

data remanence

A measure of the magnetic flux density remaining after removal of the applied magnetic force, which is used to erase data, Refers to any data remaining on magnetic storage media

Trusted Path

A mechanism within the system that enables the user to communicate directly with the TCB. This mechanism can be activated only by the user or the TCB and not by an untrusted mechanism or process.

trusted path

A mechanism within the system that enables the user to communicate directly with the TCB. This mechanism can be activated only by the user or the TCB and not by an untrusted mechanism or process.

one-time pad

A method of encryption in which the plaintext is combined with a random "pad," which should be the same length as the plaintext. This encryption process uses a nonrepeating set of random bits that are combined bitwise (XOR) with the message to produce ciphertext. A one-time pad is a perfect encryption scheme because it is unbreakable and each pad is used exactly once, but it is impractical because of all of the required overhead.

Risk Analysis

A method of identifying risks and assessing the possible damage that could be caused in order to justify security safeguards.

Remote Journaling

A method of transmitting changes to data to an offsite facility. This takes place as a parallel processing of transactions, meaning that changes to that data are saved locally and to an off-site facility. These activities take place in real time and provide redundancy and fault tolerance.

Challenge/Response Method

A method used to verify the identity of a subject by sending the subject an unpredictable or random value. If the subject responds with the expected value in return, the subject is authenticated.

Clipping level

A minimum reporting threshold level

database shadowing

A mirroring technology used in databases, in which information is written to at least two hard drives for the purpose of redundancy.

Microkernels

A modular kernel

DevOps

A more agile development and support model, echoing agile programming methods including Sashimi and Scrum. Developers directly support operational function

OSI Model

A network model with seven layers: physical, data link, network, transport, session, presentation, application

Network stack

A network protocol suite programmed in software or hardware

object

A passive entity that contains or receives information. Access to an object potentially implies access to the information that it contains. Examples of objects include records, pages, memory segments, files, directories, directory trees, and programs.

overt channel

A path within a computer system or network that is designed for the authorized transfer of data.

Full knowledge test

A penetration test where the tester is provided with inside information at the start of the test

Partial Knowledge Test

A penetration test where the tester is provided with partial inside information at the start of the test

User

A person or process that is accessing a computer system.

user

A person or process that is accessing a computer system.

disaster recovery plan

A plan developed to help a company recover from a disaster. It provides procedures for emergency response, extended backup operations, and post-disaster recovery when an organization suffers a loss of computer processing capability or resources and physical facilities.

Contingency Plan

A plan put in place before any potential emergencies, with the mission of dealing with possible future emergencies. It pertains to training peronnel, performing backups, preparing critical facilities, and recoving from an emergency or disaster so that business operations can continue.

Bollard

A post designed to stop a car, typically deployed in front of building entrances

Threat

A potentially negative ocurrence

Mantrap

A preventive physical control with two doors. Each door requires a separate form of authentication to open

Intranet

A privately owned network running TCP/IP

Callback

A procedure for identifying a system that accessed an environment remotely. In a callback, the host system disconnects the caller and then dials the authorized telephone number of the remote terminal in order to reestablish the connection. Synonymous with dialback.

Capability Maturity Model Integration (CMMI)

A process model that captures the organization's maturity and fosters continuous improvement.

Vulnerability Scanning

A process to discover poor configurations and missing patches in an environment

TPM (Trusted Platform Module)

A processor that can provide additional security capabilities at the hardware level, allowing for hardware-based cryptographic operations

Risk Analysis Matrix

A quadrant used to map the likelihood of a risk occurring against the consequences (or impact) that risk would have.

Salt

A random number that is hashed with a password. Allows one password to hash multiple ways.

Guideline

A recommendation, administrative control

Asset

A resource that is valuable to an organization and must be protected

Deadbolt

A rigid locking mechanism that is held in place by a key, and prevents the door from opening or fully closing when extended

quantitative risk analysis

A risk analysis method that attempts to use percentages in damage estimations and assigns real numbers to the costs of countermeasures for particular risks and the amount of damage that could result from the risk. Compare to qualitative risk analysis.

qualitative risk analysis

A risk analysis method that uses intuition and experience to judge an organization's exposure to risks. It uses scenarios and ratings systems. Compare to quantitative risk analysis.

Caesar Cipher

A rot-3 substitution cipher

Tuple

A row in a relational database table

SSH / Secure Shell

A secure replacement for Telnet, FTP and the UNIX "R" commands.

Accountability

A security principle indicating that individuals must be identifiable and must be held responsible for their actions.

need to know

A security principle stating that users should have access only to the information and resources necessary to complete their tasks that fulfill their roles within an organization. Need to know is commonly used in access control criteria by operating systems and applications.

privacy

A security principle that protects an individual's information and employs controls to ensure that this information is not disseminated or accessed in an unauthorized manner.

Confidentiality

A security principle that works to ensure that information is not disclosed to unauthorized subjects.

RADIUS (Remote Authentication Dial-in User Service)

A security service that authenticates and authorizes dial-up users and is a centralized access control mechanism.

password

A sequence of characters used to prove one's identity. It is used during a logon process and should be highly protected.

nonrepudiation

A service that ensures the sender cannot later falsely deny sending a message.

Blacklist

A set of known bad resources such as IP addresses, domain names, or applications.

Whitelist

A set of known good resources such as IP addresses, domain names, or applications.

whitelist

A set of known good resources such as IP addresses, domain names, or applications.

Trusted Recovery

A set of procedures restores a system and its data in a trusted manner after system has been disrupted or a system failure has occurred.

trusted recovery

A set of procedures that restores a system and its data in a trusted manner after the system has been disrupted or a system failure has occurred.

protocol

A set of rules and formats that enables the standardized exchange of information between different systems.

Backdoor

A shortcut in a system that allows a user to bypass security checks

Packet Filter

A simple and fast firewall that has no concept of state

SA / Security Association

A simplex connection which may be used to negotiate ESP or AH parameters.

Virus

A small application, or string of code, that infects applications. The main function of a virus is to reproduce, and it requires a host application to do this. It can damage data directly or degrade system performance.

virus

A small application, or string of code, that infects applications. The main function of a virus is to reproduce, and it requires a host application to do this. It can damage data directly or degrade system performance.

Flash memory

A specific type of EEPROM, used for small portalbe disk drives

TEMPEST

A standard for shielding electromagnetic emanations from computer equipment

Monolithic kernel

A statically compiled kernel

SMTP / Simple Mail Transfer Protocol

A store-and-forward protocol used to exchange email between servers.

Database

A structured collection of related data

Access

A subject's ability to view, modify, or communicate with an object. Access enables the flow of information between the subject and the object.

SDLC / Synchronous Data Link Control (Telecommunications)

A synchronous layer 2 WAN protocol that uses polling to transmit data.

SDLC / Systems Development Life Cycle (Applications)

A system development model that focuses on security in every phase.

Trusted Computer System

A system that has the necessary controls to ensure that the security policy will not be compromised and that can process a range of sensitive or classified information simultaneously.

trusted computer system

A system that has the necessary controls to ensure that the security policy will not be compromised and that can process a range of sensitive or classified information simultaneously.

node

A system that is connected to a network.

Classification

A systematic arrangement of objects into groups or categories according to a set of established criteria. Data and resources can be assigned a level of sensitivity as they are being created, amended, enhanced, stored, or transmitted. The classification level then determines the extent to which the resource needs to be controlled and secured, and is indicative of its value in terms of information assets.

end-to-end encryption

A technology that encrypts the data payload of a packet.

Security audit

A test against a published standard.

Kerberos

A third-party authentication service that may be used to support Single Sign On

keystroke monitoring

A type of auditing that can review or record keystrokes entered by a user during an active session.

Fuzzing / Fuzz testing

A type of black box testing that enters random malformed data as inputs into software programs to determine if they will crash

RFID / Radio-Frequency Idnetification

A type of contact less card technology.

link encryption

A type of encryption technology that encrypts packets' headers, trailers, and the data payload. Each network communications node, or hop, must decrypt the packets to read its address and routing information and then re-encrypt the packets. This is different from end-to-end encryption.

public key encryption

A type of encryption that uses two mathematically related keys to encrypt and decrypt messages. The private key is known only to the owner, and the public key is available to anyone.

User ID

A unique set of characters or code that is used to identify a specific user to a system.

user ID

A unique set of characters or code that is used to identify a specific user to a system.

Compromise

A violation of the security policy of a system or an organization such that unauthorized disclosure or modification of sensitive information occurs.

Vulnerability

A weakness in a system

Twofish

AES finalist,encrypting 128-bit blocks usinf 128 through 256 bit keys

Access Control Lists/ACL

Access Control List

Domains of trust

Access control Module used by windows active directory

Nondiscretionary access control

Access control based on subjects' roles or tasks

Color of law

Acting on the authority of law enforcement

Sanction

Action taken as a result of policy violation.

Authorization

Actions an individual can perform on a system

Microwave motion detector

Active motion detector that uses microwave energy

SSID / Service Set Identifier

Acts as a wireless network name.

Ultrasonic motion detector

Actuve motion detector that uses ultrasonic energy

Compensation controls

Additional security controls put in place to compensate for weaknesses in other controls

ASLR

Address Space Layout Randomization, seeks to decrease the likelihood of successful exploitation by making memory address employed by the system less predictable

Address Space Layout Randomization/ASLR

Address Space Layout Randomization, seeks to decrease the likelihood of successful exploitation by making memory address employed by the system less predictable

Virtualization

Adds a software layer between an operating system and the inderlying computer hardware

Content-dependent access controls

Adds additional criteria beyond identification and authentication: the actual content the subject is attempting to access

Context-dependent access control

Adds additional criteria beyond identification and authentication: the context of the access, such as time

Access Control Mechanism

Administrative, physical, or technical control that is designed to detect and prevent unauthorized access to a resource or environment.

Advanced Encryption Standard/AES

Advanced Encryption Standard, a block cipher using 128 bit, 192 bit, or 256 bit keys to encrypt 128-bit blocks of data

Scrum

Agile development model that uses small teams, roles include Scrum Master and Product Owner.

Integrated Circuits Cards (ICC)

Alias for "Smart Card". Physical access control device that's contains a computer circuit

trusted computing base (TCB)

All of the protection mechanisms within a computer system (software, hardware, and firmware) that are responsible for enforcing a security policy.

Convergence

All routers on a network agree on the state of routing

Trusted Computing Base (TCB)

All the protection mechanisms within a computer system (software, hardware, and firmware) that are responsible for enforcing a security policy.

First sale doctrine

Allows a legitimate purchaser of copyrighted material to sell it to another person

API/Application Programmers Interface

Allows an application to communicate with another application, or an operating system, database, network, etc. For example, The Google Maps API allows an application to integrate 3rd-party content such as restaurants overlaid on a Google Map

Multitasking

Allows multiple tasks (heavy weight processes) to run simultaneously on one CPU

Fair use doctrine

Allows someone to duplicate copyrighted material without requiring the payment, consent, or even knowledge of the copyright holder

Business Owners

Also called Mission Owners, members of senior management who create the information security program and ensure that it is properly staffed, funded, and has organization priority

Synthetic Transactions

Also called synthetic monitoring, involves building scripts or tools that simulate activities normally performed in an application

Walkthrough drill

Also known as a simulation test, recovery form a pretend disaster, goes beyond talking about the process and actually has teams carry out the recovery process

Divestitures

Also known as de-mergers and de-acquisitions, and represent flip side of acquisition: one company becomes two or more

RFI / Remote File Inclusion

Altering web URLs to include remote content.

Assurance

Ameasurement of confidence in the level of protection that a specific security control delivers and the degree to which is enforces the security policy.

XP / Extreme Programming

An Agile development method that uses pairs of programmers who work off a detailed specification

SAML / Security Assertion Markup Language

An XML-based framework for exchanging security information, including authentication data.

Reference Monitor Concept

An access control concept that refers to an abstract machine that mediates all accesses to objects by subjects. The security kernel enforces the reference monitor concept.

discretionary access control (DAC)

An access control model and policy that restricts access to objects based on the identity of the subjects and the groups to which those subjects belong. The data owner has the discretion of allowing or denying others access to the resources it owns.

Message Authention Code (MAC)

An access policy that restricts subjects' access to objects based on the security clearance of the subject and the classification of the object. The system enforces the security policy, and users cannot share their files with other users.

declassification

An administrative decision or procedure to remove or reduce the security classification information.

Collusion

An agreement between two or more individuals to subvert the security of a system

pseudo-flaw

An apparent loophole deliberately implanted in an operating system or program as a trap for intruders.

Waterfall model

An application development model that uses riged phases; when one phase end, the next begins

Top-down Approach

An approach in which the initiation, support, and direction for a project come from top management and work their way down through middle management and then to staff members.

top-down approach

An approach in which the initiation, support, and direction for a project come from top management and work their way down through middle management and then to staff members.

protection ring

An architecture that provides hierarchies of privileged operation modes of a system, which gives certain access rights to processes that are authorized to operate in that mode. Supports the integrity and confidentiality requirements of multitasking operating systems and enables the operating system to protect itself from user programs and rogue processes.

Full backup

An archive of all files

Differential backup

An archive of any files that have been changed since the last full backup was performed

cost/benefit analysis

An assessment that is performed to ensure that the cost of a safeguard does not outweighs the benefit of the safeguard. Spending more to protect an asset than the asset is actually worth does not make good business sense. All possible safeguards must be evaluated to ensure that the most security-effective and cost-effective choice is made.

War Dialing

An attack in which a long list of phone numbers I inserted into a war-dialing program in the hope of finding a modem that can be exploited to gain unauthorized access.

war dialing

An attack in which a long list of phone numbers is inserted into a war-dialing program in the hope of finding a modem that can be exploited to gain unauthorized access.

Brute-Force Attack

An attack that continually tries different inputs to achieve a predefined goal, which can be used to obtain credentials for unauthorized access.

Attack

An attempt to bypass security controls in a system with the mission of using that system or compromising it. An attack is usually accomplished by exploiting a current vulnerability.

digital signature

An electronic signature based upon cryptographic methods of originator authentication, computer by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

Zero-day exploit

An exploit for a vulnerability with no available vendor patch

EGP / Exterior Gateway Protocol

An exterior gateway protocol used by Private networks like Intreanets

Worm

An independent program that can reproduce by copying itself from one system to another. It may damage data directly or degrade system performance by tying up resources.

worm

An independent program that can reproduce by copying itself from one system to another. It may damage data directly or degrade system performance by tying up resources.

data custodian

An individual who is responsible for the maintenance and protection of the data. This role is usually filled by the IT department (usually the network administrator). The duties include performing regular backups of the data; implementing security mechanisms; periodically validating the integrity of the data; restoring the data from backup media; and fulfilling the rudiments specified in the company's security policy, standards, and guidelines that pertain to information security and data protection.

operator

An individual who supports the operations of computer systems—usually a mainframe. The individual may monitor the execution of the system, control the flow of jobs, and develop and schedule batch jobs.

Payment Card Industry Data Security Standard (PCI-DSS)

An information security standard for organizations that are involved in payment card transactions.

exposure

An instance of being exposed to losses from a threat. A weakness or vulnerability can cause an organization to be exposed to possible damages.

Clark-Wilson Model

An integrity model that addresses all three integrity goals: prevent unauthorized users from making modification, prevent authorized users from making improper modifications, and maintain internal and external consistency through auditing.

Common Criteria

An internationally agreed upon standard for describing and testing the security of IT projects

Java

An object-oriented language used not only to write applets, but also as a general-purpose programming language

Password Cracking

An offline technique in which the attacker has gained access to the password hashes or database

Password guessing

An online technique that involves attempting to authenticate as a particular user to the system

write

An operation that results in the flow of information from a subject to an object

Write

An operation that results in the flow of information from a subject to an object.

Read

An operation that results in the flow of information from an object to a subject and does not give the subject the ability to modify the object or the data within the object.

Recovery Planning

An operation that results in the flow of information from an object to a subject and does not give the subject the ability to modify the object or the data within the object.

Back Door

An undocumented way of gaining access to a computer system. After a system is compromised, an attacker may load a program that listens on a port )back door) so that the attacker can enter the system at any time. A back door is also referred to as a trapdoor.

denial of service (DoS)

Any action, or series of actions, that prevents a system, or its resources, from functioning in accordance with its intended purpose.

Candidate keys

Any attribute (column) in the table with unique values

Covert channel

Any communications that violates security policy

Disaster

Any disruptive event that interrupts normal systems, operations.

Bastion Host

Any host placed on the internet that is not protected by another device

Threat

Any potential danger that a vulnerability will be exploited by a threat agent.

threat

Any potential danger that a vulnerability will be exploited by a threat agent.

Defense in Depth

Application of Multiple safeguards that span multiple domains to protect an asset

FIdM / Federated Identity Management

Applies Single Sign On at a much wider scale: tanging from cross-organization to Internet scale

data classification

Assignments to data that indicates the level of availability, integrity, and confidentiality that is required for each type of information

Non-repudiation

Assurance that a specific user performed a specific transaction and assurance that that the transaction did not change

Availability

Assures information is available when needed

ADSL

Asymmetric Digital Subscriber Line, DSL featuring faster download speeds than upload

ABM

Asynchronous Mode HDLC combined mode where nodes may act as primary or secondary, initiating transmission without receiving permission

ARCNET

Attached Resource Computer Network, a Legacy LAN technology that uses tokens

Server-side attack

Attack launched directly from an attacker to a listening service. Also called service-side attack

Lock bumping

Attack on locks using a shaved key, which bumps the pins, allowing the lock to turn

Brute force attack

Attack that attempts every possible key or combination

Client-side attacks

Attack where a user downloads malicious content

Script kiddies

Attackers who target computer systems with tools they have little or no understanding of.

Disassembler

Attempt to convert machine language into assembly

SSL / Secure Sockets Layer

Authenticates and provides confidentiality to network traffic such as web traffic.

AH/Authentication Header

Authentication Header, Ipsec protocol that provides authentication and integrity for each packet of network data

Asynchronous Dynamic Token

Authentication that is not synchronized with a central server, includes challenge-response tokens

Overt Channel

Authorized communication that complies with security policy

BIOS

Basic Input output System, typically stored in firmware

BRI

Basic Rate interface, provides two 64 K digital ISDN channels

Electronic vaulting

Batch process of electronically transmitting data that is to be backed up on a routine, regularly scheduled time interval

Simple Security Property

Bell-LaPadula property that states "no read up" (NRU).

Security property

Bell-LaPadula property that states "no write-down"

Strong Tranquility property

Bell-LaPudula property that states security labels will not change while the system is operating

Weak tranquility property

Bell-Lapadula property that states security labels wil not change in a way that violates security policy

Simple integrity axiom

Biba property that states "no read down".

Integrity Axiom

Biba property which states "no write-up"

Facial Scan

Bimetric control that compares a picture of a face to pictures stored in a database

Exclusive Or

Binary operation that is true if one of two inputs (but not both) are true

Dynamic signatures

Biometric control that measures the process by which someone signs their name

Keyboard dynamics

Biometric control that refers to how hard a person presses each key and the rhythm by which the keys are pressed

Retina scan

Biometric laser scan of the capillaries which feed the retina.

Fingerprint scan

Biometric scan of the minutae (specific details of the fingerprint)

Binary image

Bit-level copy of memory

Combinatorial software testing

Black box testing method that seeks to identify and test all unique combinations of software inputs

Chaining

Block cipher mechanism that seeds the previous encrypted block into the next block to be encrypted

Blowfish

Block cipher using from 32 through 448 bit (the default is 128) keys to encrypt 64 bits of data

BOOTP

Bootstrap Protocol, used for bootstrapping via a network by diskless systems

Bootstrap Protocol - BOOTP

Bootstrap Protocol, used for bootstrapping via a network by diskless systems

BGP

Border Gateway Protocol, the routing protocol used on the Internet

Border Gateway Protocol - BGP

Border Gateway Protocol, the routing protocol used on the Internet

BCP

Business Continuity Plan, A long-term plan to ensure the continuity of business operations

Business Continuity Plan - BCP

Business Continuity Plan, A long-term plan to ensure the continuity of business operations

BRP

Business Recovery Plan, details the steps required to restore normal business operations after recovering from a disruptive event. Also known as the Business Resumption Plan

Business Recovery Plan - BRP

Business Recovery Plan, details the steps required to restore normal business operations after recovering from a disruptive event. Also known as the Business Resumption Plan

Business Resumption Plan - BRP

Business Recovery Plan, details the steps required to restore normal business operations after recovering from a disruptive event. Also known as the Business Resumption Plan

Trade secret

Business-propriety information that is important to an organizations ability to compete

Repeatable

CMM / Capability Maturity Model phase 2.

Optimizing

CMM Phase 5

Defined

CMM phase 3

Managed

CMM phase 4

ALU/Arithmetic Logic Unit

CPU Component that performs mathematical calculations

I/O Controller Hub (ICH)

CPU Southbridge bus connects input/output (I/O) devices such as disk, keyboard, mouse, CD drive, USB ports,etc..

Control unit

CPU component that acts as a traffic cop, sending instructions to the ALU

piplining

CPU feature that combines multiple steps into on combined process, allowing simultaneous fetch, decode, execuet and write steps for different instructions

RISC / Reduced Instruction Set Computer

CPU instructions which are short and simple.

CMM

Capability Maturity Model, a maturity framework for evaluating and improving the software development process

Capability Maturity Model - CMM

Capability Maturity Model, a maturity framework for evaluating and improving the software development process

playback attack (same as replay attack?)

Capturing data and resending the data at a later time in the hope of tricking the receiving system. This is usually carried out to obtain unauthorized access to specific resources.

CSMA

Carrie Sense Multiple Access, a method used by Ethernet networks to allowed shared usage of a baseband network, and avoid collisions

Carrier Sense Multiple Access - CSMA

Carrier Sense Multiple Access, a method used by Ethernet networks to allowed shared usage of a baseband network, and avoid collisions

CPU

Central Processing unit, the "brains" of the computer, capable of controlling and performing mathematical calculations

Central Processing Unit - CPU

Central Processing unit, the "brains" of the computer, capable of controlling and performing mathematical calculations

CRL

Certificate Revocation Lists, PKI component which lists digital certificates that have been revoked

Certificate Revocation List

Certificate Revocation Lists, PKI component which lists digital certificates that have been revoked

CHAP

Challenge Handshake Authentication Protocol, a more secure network authentication protocol that uses a shared secret

Challenge Handshake Authentication Protocol - CHAP

Challenge Handshake Authentication Protocol, a more secure network authentication protocol that uses a shared secret

Dynamic password

Changes at regular intervals

CSU/DSU

Channel Service Unit/Data Service Unit, DCE device

Channel Service Unit/Data Service Unit - CSU/DSU

Channel Service Unit/Data Service Unit, DCE device.

CCD

Charged Couple Discharge, a digital CCTV

Charged Couple Discharge - CCD

Charged Couple Discharge, a digital CCTV

CBC

Cipher Block Chaining, a block mode of DES that XORs the previous encrypted block of ciphertext to the next block of plaintext to be encrypted

Cipher Block Chaining - CBC

Cipher Block Chaining, a block mode of DES that XORs the previous encrypted block of ciphertext to the next block of plaintext to be encrypted

CFB

Cipher Feedback, a stream mode DES that is similar to block-mode CBC

Cipher Feedback - CFB

Cipher Feedback, a stream mode DES that is similar to block-mode CBC

Rijndael

Cipher which became AES, named after authors Vincent Rijmen and Joan Daemen.

Well-formed transactions

Clark-Wilson control to enforce contol over applications

CIDR

Classless Inter-Domain Routing, allows for many network sizes beyond the arbitrary stateful network sizes

Classless Inter-Domain Routing - CIDR

Classless Inter-Domain Routing, allows for many network sizes beyond the arbitrary stateful network sizes

CCTV

Closed Circuit Television, a detective device used to aid guards in detecting the presence of intruders in restricted areas

Closed Circuit Television - CCTV

Closed Circuit Television, a detective device used to aid guards in detecting the presence of intruders in restricted areas

Traceroute

Command the ues ICMP Time Exceeded messages to trace a network route

COTS

Commercial Off-the-Shelf Software, third-party developed commercial software available to the generic public

Class II gate

Commercial gate, such as a parking garage gate

COCOM

Committee for Multilateral Export Controls, a munitions law which was in effect from 1947 to 1994. It was designed to control the export of critical technologies (including cryptography) to "Iron Curtain" countries during the cold war

CORBA

Common Object Request Broker Architecture, an open vendor-neutral networked object broker framework

Digital

Communication that transfers data in bits: ones and zeroes

Analog

Communications that sends a continuous wave of information

Mirroring

Complete duplication of data to another disk, used by some levels of RAID

SaaS / Software as a Service

Completely configured cloud-based application, from the operating system on up.

CISC

Complex Instruction Set Computers, CPU instructions that are longer and more powerful

COM

Component Object Model, locates, and connects objects locally

Session hijacking

Compromise of an existing network sessions.

CIRT

Computer Incident Response Team, a team that performs incident handling

CSIRT

Computer Security Incident Response Team, the group that is tasked with monitoring, identifying, and responding to security incidents

Diskless workstation

Computer systems that contains CPU, Memory, and Firmware, but no hard drive, type of thin client

CASE

Computer-Aided Software Engineering, uses programs to create assist in the creation and maintenance of other computer programs

Computer Fraud

Computer-related crimes involving deliberate misrepresentation, modification, or disclosure of data in order to compromise a system or obtain something of value.

Centralized access control

Concentrates access control in one logical point for a system or organization

Buffer overflow

Condition where an attacker can inset data beyond the end of a buffer variable

life-cycle assurance

Confidence that a trusted system is designed, developed, and maintained with formal designs and controls. This includes design specification and verification, implementation, testing, configuration management, and distribution.

CIA triad

Confidentiality, Integrity and Availability

DTE/DCE

Connection that spans the Demarc

Middleware

Connects programs to programs

Northbridge

Connects the CPU to RAM and video memory, also called the memory controller hub (MCH)

Host-To-Host Transport Layer (TCP/IP transport layer)

Connects the internet layer to the application layer. Where applications are addressed on a network via ports.

Data dictionary

Contains a description of the database tables, including the schema, database view information, and information about authorized database administrator and user accounts

Encapsulation / Object

Contains and hides the details of an object's method

Motherboard

Contains computer hardware including the CPU, memory slots, firmware, and peripheral slots such as PCI (Peripheral Component Interconnect) slots

Relational database

Contains two-dimensional tables of related data.

CDN

Content Distribution networks (also Content Delivery Networks) use a series of distributed caching servers to improve performance and lower the latency of downloaded online content

CPPT

Continuity Planning Project Team, a team comprised of stakeholders within an organization and focuses on identifying who would need to play a role in specific emergency event were to occur

COOP

Continuity of Operations Plan, a plan to maintain operations during a disaster

BS-25999

Continuity standard by the British Standards institution (BSI)

SLA / Service Level Agreement

Contractual agreement that helps assure availability.

COBIT

Control Objectives for Information and related Technology, a control framework for employing information security governance best practices within an organization

Confinement

Controlling information in a manner that prevents sensitive data from being leaked from a program to another program, subject, or object in an unauthorized manner.

physical security

Controls and procedures put into place to prevent intruders from physically accessing a system or facility. The controls enforce access control and authorized access.

Communications Security

Controls in place to protect information as it is being transmitted, especially by telecommunications mechanisms.

Detection controls

Controls that alert during or after a successful attack

Compensating Controls

Controls that are alternative procedures designed to reduce the risk. They are used to "counterbalance" the effects of an internal control weakness.

Corrective controls

Controls that correct a damaged system or process

physical controls

Controls that pertain to controlling individual access into the facility and different departments, locking systems and removing unnecessary floppy or CD-ROM drives, protecting the perimeter of the facility, monitoring for intrusion, and checking environmental controls.

Free software

Controversial term that is defined differently by different groups. "Gree" may mean free of charge, or "free" may mean the user is free to use the software in any way they would like, including modifying it

Hacker

Controversial term that may mean explorer or someone who maliciously attacks systems

Compiler

Convert source code, such as C or Basic, and compile it into machine code

Encryption

Converts the plaintext to a ciphertext

Back up

Copy and move data to a medium so that it may be restored if the original data is corrupted or destroyed. A full backup copies all the data from the system to the backup medium. An incremental backup copies only the files that have been modified since the previous backup. A differential backup backs up all files since the last full backup.

CCMP

Counter Mode CBC MAC Protocol, used by WPA2 to create a MIC

CTR

Counter, a stream mode of DES that uses a counter for feedback

Search Warrant

Court order that allows a legal search.

Timing Channel

Covert channel that relies on the system clock to inder sensitve information

Storage Channel

Covert channel that uses shared storage, such as a temporary directory to allow two subjects to signal each other

Genetic algorithms

Creating computer algorithms via Darwinian evolution principals

Genetic programming

Creating entire software programs (usually in the form of Lisp source code) via Darwinian evolution principals

Computer crimes

Crimes using computers

CMP

Crisis Management Plan

XSS

Cross Site Scripting, third-party execution of web scripting languages such as Javascript within the security content of a trusted site

CSRF

Cross-Site Request Forgery, third-party redirect of static content within the security context of a trusted site

CER

Crossover Error Rate, describes the point where the False Reject Rate (FRR) and the False Accept Rate (FAR) are equal

Side-Channel attack

Cryptographic attack which uses physical data to break a cryptosystem, such as monitoring CPU cycles or power consumption used while encrypting or decrypting.

Jefferson Disks

Cryptographic device invented by Thomas Jefferson that used multiple wheels, each with an entire alphabet along the ridge

Cipher disk

Cryptographic device that uses two concentric disks, each with an alphabet around the periphery

Book cipher

Cryptographic method that uses whole words from a well-known text such as a dictionary as a one-to-one replacement for plaintext

Running-key cipher

Cryptographic method that uses whole words from a well-known text such as a dictionary, "adding" letters to plaintext using modular math.

Customary Law

Customs or practices that are so commonly accepted by a group that the custom is treated as law

Distributed component object model

DCOM

Mobile sites

DRP backup site option that is a "data centers on wheels"; towable trailers that contain racks of computer equipment, as well as HVAC, fire suppression and physical security

SDSL / Symmetric Digital Subscriber Line

DSL with matching upload and download speeds.

operational goals

Daily goals to be accomplished to ensure the proper operation of an environment.

Compensatory damages

Damages provided as compensation

Ticket

Dara that authenticates a Kerberos principal's identity

DCE

Data Circuit-Terminating equipment, a device that networks DTEs, such as a router

DDL

Data Definition language, used to create, modify, and delete tables

DEA

Data Encryption Algorithm, described by DES

DES

Data Encryption Standard, a symmetric block cipher using a 56-bit key and 64-bit block size

DEP

Data Execution Prevention, which can be enabled within hardware and/or software, and makes specific pages of the stack non-executable

DML

Data Manipulation language, used to query and update data stored in the tables

Data Manipulation Language

Data Manipulation language, used to query and update data stored in the tables

DTE

Data terminal equipment, a Network "terminal," such as a desktop, server, or actual terminal

Data Terminal Equipment

Data terminal equipment, a Network "terminal," such as a desktop, server, or actual terminal

Ciphertext

Data that has been encrypted and is unreadable until it has been converted into plaintext.

data in transit or data in motion (DIM)

Data that is moving between computing nodes over a data network such as the Internet.

Electronic Backups

Data that is stored electronically and can be retrieved in case of disruptive event or disaster

Remanence

Data that might persist after removal attemps.

data a rest (DAR)

Data that resides in external or auxiliary storage devices such as hard disk drives, solid-states drives, or DVDs.

data in use

Data that temporarily resides in primary storage such as registers, caches, or RAM while the CPU is using it.

DBA

Database Administrator, role that manages databases

Database Administrators

Database Administrator, role that manages databases

DBMS

Database management system, controls all across all access to the database and enforces database security

Database management system

Database management system, controls all across all access to the database and enforces database security

Object-Oriented Database

Database that combines data with functions (code) in an object-oriented framework

Hierarchical Database

Database that forms a tree

Codebreakers (The)

David Kahn's history of cryptography

E1

Dedicated 2.048 megabit circuits that carries 30 channels

Modes of Operation

Dedicated, system-high, compartmented, and multilevel modes

Inference

Deductive attack where a user is able to use lower-level access to learn restricted information

DARPA

Defense Advanced Research Projects Agency, funders of the original MILNET and ARPANET

Demarc

Demarcation point, where the ISP's responsibility end, and the customer's begins

DMZ

Demilitarized Zone network, used to separate trusted from untrusted networks

Demilitarized Zone

Demilitarized Zone network, used to separate trusted from untrusted networks

Denial of Service

Denial of Service, an attack on availability

DoS

Denial of Service, an attack on availability

Schema

Describes the attributes and values of the database tables.

Cryptographic Protocol Governance

Describes the process of selecting the right cipher and implementation for the right job

Standard

Describes the specific use of technology, often applied to hardware and software administrative control

4GL / Fourth-generation programming language

Designed to increase programmer's efficiency by automating the creation of computer programming code

Degaussing

Destroying the integrity of the magnetization of the storage media, making the data unrecoverable

procedure

Detailed step-by-step instructions to achieve a certain task, which are used by users, IT staff, operations staff, security members, and others.

Deterrent controls

Deter users from performing actions on a system

Executive Succession Planning

Determines an organizations line of succession

Take-Grant Protection Method

Determines the safety of a given computer system that follows specific rules

Sashimi Model

Development model with highly overlapping steps; it can be thought of as a real-world successor to the Waterfall Model.

Turnstile

Device designed to prevent tailgating by enforcing a 'one person per authentication' rules

Firewall

Device that filters traffic based on layers 3 (IP Addresses) and 4 (ports)

DSl

Digital subscriber Line, uses existing copper pairs to provide digital service to homes and small offices

Digital subscriber line

Digital subscriber Line, uses existing copper pairs to provide digital service to homes and small offices

DSSS

Direct Sequence Spared Spectrum, uses the entire wireless band at once

Direct sequence spread spectrum

Direct Sequence Spared Spectrum, uses the entire wireless band at once

Account Lockout

Disables an account after a set number of failed logins, sometimes during a specific time period

DRP

Disaster Recovery Plan, a short-term plan to recover from a disruptive event

Disaster recovery plan

Disaster Recovery Plan, a short-term plan to recover from a disruptive event

DAD

Disclosure, Alteration, and Destruction, the opposite of Confidentiality, Integrity and Availability

DAC

Discretionary Access Control, gives subjects full control of objects they have or been given access to, including sharing objects with other subjects

Split horizon

Distance vector routing protocol safeguard will not send a route update via an interface it learned the route from

Ddos

Distributed Denial of Service, an availability attack using many systems

Distributed Denial of Service

Distributed Denial of Service, an availability attack using many systems

DNP3

Distributed Network Protocol, provides an open standard used primarily within the energy sector for interoperability between various vendors' SCADA and smart grid applications

DCOM

Distributed component object model, locates, and connects objects across a network

Seperation of duties

Dividing sensitive transactions among multiple subjects

LAND attack

DoS attack which uses a spoofed SYN packet that includes the victim's IP address as both source and destination

ping of death (malformed packets)

DoS that sends a malformed ICMP Echo Request (ping) that is larger than the maximum size of an IP packet

Formal access approval

Documented approval from the data owner for a subject to access certain objects

Ethics

Doing what is morally right

DNS

Domain Name System, a distributed global hierarchical database that translates names to IP Addresses, and vice versa

Domain Name systems

Domain Name System, a distributed global hierarchical database that translates names to IP Addresses, and vice versa

DNSSEC

Domain Name server security extensions, provides authentication and integrity to DNS reponces via the use of public key encryption

Domain Name Server security extensions

Domain Name server security extensions, provides authentication and integrity to DNS response via the use of public key encryption

Ethernet

Dominant local area networking technology that transmits network data via frames

DHCP

Dynamic Host Configuration protocol, assigns temporary IP address leases to systems, as well as DNS and default gateway configurations

Dynamic host configuration protocol

Dynamic Host Configuration protocol, assigns temporary IP address leases to systems, as well as DNS and default gateway configurations

DRAM

Dynamic Random Access Memory, stores bits in small capacitors (Like small batteries), cheaper, and slower than SRAM

EAP OVER LAN

EAP Over LAN, a Layer 2 protocol for varying EAP

EAPOL

EAP Over LAN, a Layer 2 protocol for varying EAP

EAP tunneled transport layer security

EAP tunneled transport layer security, simplifies EAP-TLS by dropping the client side certificate requirement

EAP-TTLS

EAP tunneled transport layer security, simplifies EAP-TLS by dropping the client side certificate requirement

EAP-FAST

EAP-Flexible Authentication via Secure Tunneling, designed by Cisco to replace LEAP

EAP-TLS

EAP-Transport Layer security, uses PKI, requiring both server-side and client side certificates

EAP-Transport Layer Security

EAP-Transport Layer security, uses PKI, requiring both server-side and client side certificates

Integrated Services Digital Network (ISDN)

Earlier attempt to provide digital service via 'copper pair'. Commonly used for teleconferencing and videoconferencing.

Panic bar

Egress device that opens externally facing doors from the inside

emanations

Electrical and electromagnetic signals emitted from electrical equipment that can transmit through the airwaves. These signals carry information that can be captured and deciphered, which can cause a security breach. These are also called emissions.

EEPROM / Electrically -Erasable Programmable Read Only Memory

Electrically erasable memory via the use of flashing program

Symmetric Encryption

Encryption that uses one key to encrypt and decrypt

Asymmetric Encryption

Encryption that uses two keys: if you encrypt with one you may decrypt with the other

Emanations

Energy which escape an slectronic system, and which may be remotely monitored under certain circumstances

Noninterference model

Ensures that data at different security domains remain separate from one another

Directory path traversal

Escaping from the root of a webserver (such as /var/www) into the regular file system by referencing directories such as "../.."

Secondary Evidence

Evidence consisting of copies of original documents and oral descriptions.

Corroborative evidence

Evidence that provides additional support for a fact that might have been called into question

Circumstantial evidence

Evidence that servers to establish the circumstances related to particular points or even other evidence

XOR

Exclusive OR, binary operation that is true if one of two inputs (but not both) are true

Knowledge base

Expert system component that consists of "if/then" statements

Inference Engines

Expert system component that follows the tree formed by knowledge base, and fires a rule where there is a match

Backward chaining

Expert system mode that starts with begins with a premise and works backwards

Forward chaining

Expert system mode that starts with no premise, and works forward to determine a solution

EAP

Extensible Authentication Protocol, a Layer 2 authentication framework that describes many specific authentication protocols

Whole Disk Encryption

FDE - Full Disk Encryption

Type II Error

False Acceptance Rate (FAR) , occurs when an authorised subject is accepted as valid

Type I error

False Reject Rate (FRR) occurs when an authorised subject is rejected as invalid

Develop an IT contingency plan

Fifth step of the NIST SP 800-34 contingency planning process

Stateful firewall

Firewall with a state table that allows the firewall to compare current packets to previous

protect society, the commonwealth, and the infrastructure

First canon of the (ISC)2 Code of Ethics

Develop the contingency planning policy statement

First step of the NIST SP 800-34 contingency planning process

Information Technology Security Evaluation Criteria (ITSEC)

First successful evaluation model that separates functionality (how well a system works) from assurance ( the ability to evaluate the security of a system)

Static Route

Fixed routing entries

Agile Software Development

Flexible software development model that evolved as a reaction to rigid software development models such as the Waterfall Model

Continuity of Support Plan

Focuses narrowly on support of specific IT systems and applications

Mandatory leave

Forcing staff to take vacation or time away from the office. Also known as forced vacation

Ring model

Form of CPU hardware layering that separates and protects domains (such as kernel mode and user mode) from each other.

Pairwise testing

Form of combinatorial software testing that tests unique pairs of inputs

All pairs testing

Form of combinatorial software testing that tests unique pairs of inputs otherwise known as (Pairwise testing)

Develop recovery strategy

Forth step of the NIST SP 800-34 contingency planning process

Advance and protect the profession

Fourth canon of the (ISC)2 Code of Ethics

4GL

Fourth-generation programming language designed to increase programmers efficiency by automating the creation of computer programming code

Information Technology Infrastructure Library (ITIL)

Framework for providing best services in IT Service Management (ITSM).

Shareware

Fully functional proprietary software that may be initially used free of charge. If the user continues to use the Shareware for a specific period of time, the shareware license typically requires payment.

Fitness function

Genetic algorithm concept that assigns a score to an evolved algorithm

Crossover

Genetic algorithm concept that combines two algorithms

Mutation

Genetic algorithm concept that introduces random changes to algorithms

Black box software testing

Gives the tester no internal details: the software is treated as a black box that receives inputs

"Bad" Blocks/Clusters/sectors

Good disk blocks marked as bad

ARM/Asynchronous Response Mode

HDLC mode where secondary nodes may initiate communication with the primary

Hacktivist

Hacker activist, someone who attacks computer systems for political reasons

ATA Secure Erase

Hardware-level secure erase command available on Solid State Drives (SSD's) that erases all blocks and also generates a new encryption key

Hash of Variable Length

Hash algorithm that creates message digests of 128, 160, 192, 224, or 256 bits in length, using 3, 4, or 5 rounds.

Hashed Message Authentication Code (HMAC)

Hash function that uses a key

Health Insurance Portability and Accountability Act (HIPAA)

Health insurance portability and accountability act, united states regulation which protects healthcare information

Abstraction

Hides unnecessary details from the user

Accountability

Holds individuals accountable for their actions

Host-Based Intrusion Detection Systems (HIDS)

Host based intrusion detection systems, a detective technical control

Host-Based Intrusion Prevention Systems (HIPS)

Host based intrusion prevention system, preventative device that processes information within the host

Dual homed host

Host with 2 Network interfaces one connected to a trusted network and the other connected to an untrusted network

Classful address

IPv4 networks in classes A through E

Caller ID

Identifies the calling phone number, sometimes used as a weak authentication method

Identity as a Service (IDaaS)

Identity as a service, also called cloud identity, allows organizations to leverage closed service for identity management

masquerading

Impersonating another user, usually with the intention of gaining unauthorized access to a system.

Administrative Controls

Implemented by creating and following organizational policy, procedures, or regulation. Also called directive controls

Technical Controls

Implemented using software, hardware or firmware that restricts logical access on an information technology system

plaintext

In cryptography, the original readable text before it is encrypted.

Cleartext

In data communications, cleartext is the form of a message or data, which is transferred or stored without cryptographic protection.

Detection phase

Incident response phase that analyses events in order to determine weather they might comprise a security incident

Containment phase

Incident response phase that attempts to keep further damage from occurring as a result of the incident

Eradication phase

Incident response phase that cleans a compromised system

Reporting phase

Incident response phase that provides a final report on the incident.

Interrupt

Indicates an asynchronous CPU event has occurred

ISM

Industrial, Scientific, and Medical, wireless bands set aside for unlicensed use

Class III gate

Industrial/limited access gate, such as a loading dock

ITIL

Information Technology Infrastructure Library, is a framework for providing best services in IT Service Management

ITSEC

Information Technology Security Evaluation Criteria, the first successful

maintenance hook

Instructions within a program's code that enable the developer or maintainer to enter the program without having to go through the usual access control and authentication processes. Maintenance hooks should be removed from the code before it is released to production; otherwise, they can cause serious security risks. Also called trapdoor or back door.

ISDN

Integrated Services Digital Network, provides digital service via copper pair

Integrated Product Team (IPT)

Integrated product team, a customer-focused group that focuses on the entire lifecycle of a project

Big Bang testing

Integration testing that tests all integrated software components

Trademark

Intellectual property protection that allows for the creation of a brand that distinguishes the source of products

Servicemark

Intellectual property protection that allows for the creation of a brand that distinguishes the source of services.

Patent

Intellectual property protection that grants a monopoly on the right to use, make, or sell an invention for a period of time

Interface Definition Language (IDL)

Interface definition language, used by COBRA objects to communicate

International Data Encryption Algorithm (IDEA)

International data encryption algorithm, a symmetric block cipher using a 128 bit key and 64 bit block size

Internet Security Association and Key Management Protocol (ISAKMP)

Internet Security Association and Key Management Protocol manages the Ipsec Security Association process

iSCSI

Internet Small Computer System Interface, Storage Area Network (SAN) protocol transmitted via Ethernet and TCP/IP

Internet Control Message Protocol (ICMP)

Internet control message protocol

Internet Key Exchange (IKE)

Internet key exchange, manages the IPSec encryption algorithm

Internet Message Access Protocol (IMAP)

Internet message access protocol, an email client protocol

Internet of Things (IOT)

Internet of Things, Internet-connected embedded devices such as thermostats, baby monitors, appliances, light bulbs, smart meters, etc...

IPv4

Internet protocol Version 4, commonly called IP. It's the fundamental protocol of the internet

IPv6

Internet protocol Version 6, the successor of IPv4, featuring the far larger address space, simpler routing, and simpler address assignment

IP

Internet protocol, includes all IPV4 and IPv6

Intrusion Detection System (IDS)

Intrusion detection system, a detective technical control

Active-passive Cluster

Involves devices or systems that are already in place, configured, powered on and ready to begin processing network traffic should a failure occur on the primary system

Active-active Cluster

Involves multiple systems all of which are online and actively processing traffic or data

ESP / Encapsulating Security Payload

Ipsec protocol which Payload primarily provides confidentiality by encrypting packet data

JSON

JavaScript Object Notation, a data interchange format

Ticket Granting Ticket (TGT)

Kerberos credentials encrypted with the TGS' key

KDC

Key Distribution Center, a Kerberos service that authenticates principals

Diffie-Hellman Key Agreement protocol

Key agreement allows two parties to securely agree on a symmetric key via public channel with no prior key exchange

Linear cryptanalysis

Known plaintext attack where the cryptanalyst finds large amounts of plaintext/ciphertext pairs created with the same key

VLAN

LAN, which can be thought of as a virtual switch

Administrative Law

Law enacted by government agencies, aka regulatory law

Civil law

Law that resolves disputes between individuals or organizations

Criminal law

Law where the victim can be seen as society itself

Repeater

Layer 1 device that receives bits on one port, and "repeats" them out the other port.

Hub

Layer 1 network access device that acts as a multiport repeater

L2F

Layer 2 Forwarding, designed to tunnel PPP

Frame

Layer 2 PDU

L2TP

Layer 2 Tunneling Protocol, combines PPTP and L2F

MAC address

Layer 2 address of a NIC

Switch

Layer 2 device that carries traffic on one LAN

Bridge

Layer 2 device that has two ports and connects network segments together

Data link layer

Layer 2 of the OSI model, handles access to the physical layer as well as local area network communication

Packet

Layer 3 PDU

Router

Layer 3 device that routes traffic from one LAN to another, based on IP addresses.

Network layer

Layer 3 of the OSI model, describes routing data from a system on one LAN to a system on another

Segment

Layer 4 PDU / Protocol Data Unit.

Session layer

Layer 5 of the OSI model, manages sessions, which provide maintenance on connections.

Application Layer (OSI)

Layer 7 of the OSI model where the user interfaces with the computer application.

FDDI / Fiber Distributge Data Interface

Legacy LAB technology that uses light

Token Ring

Legacy LAN techniology that uses tokens

Civil law (legal system)

Legal system that leverages codified laws or statues to determine what is considered within the bounds of law

Common law

Legal system that places significant emphasis on particular cases and judicial precedent as a determinant of laws

Religious law

Legal system that uses religious doctrine or interpertation as a source of legal understanding and statutes.

S/MIME / Secure/Multipurpose Internet Mail Extensions

Leverages PKI to encrypt and authenticate MIME-encoded email.

Legal liability

Liability enforced through civil law

LDAP

Lightweight Directory Access Protocol, open protocol for interfacing and querying directory service information provided by network operating systems. Uses port 389 via TCP or UDP

LEAP

Lightweight Extensible Authentication Protocol, a Cisco-proprietary protocol released before 802.1X was finalized

LCP

Link Control Protocol, the initial unauthenticated connected used by CHAP

Checklist testing

Lists all necessary components required for successful recovery, and ensures that they are, or will be, readily available should a disaster occur. Also knows as consistency testing

LAN

Local Area Network, a comparatively small network, typically confined to a building or an area within one

LLC

Logical Link Control, layer 2 protocol that handles LAN communications

Assembly Language

Low-level computer programming Language with instructions that are short mnemonics, such as "ADD", "SUB" (subtract) and "JMP" (jump) that match to machine language instructions

Unit Testing

Low-level tests of software components, such as functions, procedures or objects

Bytecode

Machine-independent interpreted code, used by Java

Commit

Makes changes to a database permanent

Enticement

Making the conditions for commission of a crime favorable for those already intent on breaking the law

Phishing

Malicious attack that poses as a legitimate site such as a bank, attempting to steal account credentials

Malware

Malicious software, any type of software which attacks an application or system

malware

Malicious software. Code written to perform activities that circumvent the security policy of a system. Examples are viruses, malicious applets, Trojan horses, logical bombs, and worms.

Trojan

Malware that performs two functions: one benigns (such as a game) and one malicious. Also called trojan horses

Rootkit

Malware that replaces portions of the kernel and/or operating system.

Vulnerability Management

Management of vulnerability information

ISO 22301

Management-focused business continuity guideline called "Business continuity management systems - Requirements"

MAC (Access Control)

Mandatory Access Control, system-enforced access control based on subject's clearances and object's labels

Traceability Matrix

Maps customers' requirements to the software testing plan: it 'traces' the 'requirements', and ensures they are being met

High-Data-Rate Digital Subscriber Line (HDSL)

Matches SDSL speeds using two pairs of copper. HDSL is used to provide inexpensive T1 service.

Aggregation

Mathematical attack where a user is able to use lower-level access to learn restricted information

MTD

Maximum Tolerable Downtime, the total time a system can be inoperable before an organization is severely impacted

MTTR

Maximum Transmission Unit, the maximum PDU size on a network

MTU

Maximum Transmission Unit, the maximum PDU size on a network

MTBF

Mean Time Between Failures, quantifies how long a new or repaired system will run on average before failing

FDX / Fetch and execute

Mechanism that allows the CPU to receive machine language instructions and execute them. Also called "Fetch, Decode, Execute"

Access Control

Mechanisms, controls, and methods of limiting access to resources to authorized subjects only.

MAC (Telecommunications)

Media Access Control, layer 2 protocol that transfers data to and from the physical layer

MD5

Message Digest 5, a hash function that creates a 128-bit message digest

MIC

Message Integrity Check, integrity protocol used by WPA2

MAN

Metropolitan Area Network, typically confined to a city, a zip code, or a campus or office park

Tactical Goals

Midterm goals to accomplish. These may be milestones to accomplish within a project or specific projects to accomplish in a year. Strategic, tactical, and operational goals make up a planning horizon.

tactical goals

Midterm goals to accomplish. These may be milestones to accomplish within a project or specific projects to accomplish in a year. Strategic, tactical, and operational goals make up a planning horizon.

MOR

Minimum Operating Requirements, describes the minimum environmental and connectivity requirements in order to operate computer equipment

Database replication

Mirrors a Live database, allowing simultaneous reads and writes to multiple replicated databases by clients

Brewer-Nash / Chinese Wall Model

Model designed to avoid conflicts of interest by prohibiting one person, like a consultant, from accessing multiple conflict of interest categories (CoIs)

Chinese Wall Model

Model designed to avoid conflicts of interest by prohibiting one person, like a consultant, from accessing multiple conflict of interest categories (CoIs)

Callback

Modem-based authentication system

Modem

Modulator/Demodulator; takes binary data and modulates it into analog sound that can be carried on phone networks

Return on Investment

Money saved by deploying a safeguard.

Failover cluster

Multiple systems that can be seamlessly leveraged to maintain the availability of the service or application being provided. Also called a failover cluster

MPLS

Multiprotocol Label Switching, provides a way to forward WAN data via labels

Wassenaar Arrangement

Munitions law that followed COCOM, beginning in 1996

NIST SP 800-34

NIST Special Publication 800-34 "Contingency Planning Guide for Information Technology Systems"

NAT

Network Address Translation, translates IP addresses

NIC

Network Interface Card, a card that connects a system to a network

NIDS

Network based intrusion detection system, a detective technical control

STP / Shielded Twisted Pair

Network cabling that contains additional metallic shielding around each twisted pair of wires.

Coaxial

Network cabling that has an inner copper core separated by an insulator from a metallic braid or shield

Unshielded Twister Pair (UTP)

Network cabling that uses pairs of wire twisted together

NIPS

Network intrusion prevention system, a device designed to prevent malicious network traffic

Circuit-switched network

Network that provides a dedicated circuit or channel between two nodes

Broadband

Network with multiple channels; can send multiple signals at a time, like cable TV

Baseband

Network with one channel; can only send one signal at a time

CWR

New TCP flag, Congestion Window Reduced

Remote meeting technology

Newer technology that allows users to conduct online meetings via the Internet, including desktop sharing functionality.

Fibre Channel

Non-Ethernet/IP fiber optic storage technology

NS

Nonce sum, the newest TCP flag, used for congestion notification

NDA

Nondisclosure agreement, a contractual agreement that ensures that an individual or organization appreciates their legal responsibility to maintain the confidentiality of sensitive information

Lattice-Based Access Controls

Nondiscretionary access control with defined upper and lower bounds implemented by the system

NRM

Normal response mode, SDLC/HDLC mode where secondar nodes can transmit when given permission by the primary

Breach notification

Notification of persons whose personal data has been, or is likely to have been, compromised

Openness Principle

OECD Privacy Guideline principle that states collection and use of personal data should be readily available

Security Safeguards Principle

OECD Privacy Guideline principle that states personal data should be reasonably protected against unauthorized use, disclosure, or alteration.

Use Limitation Principle

OECD Privacy Guideline principle that states personal data should never be disclosed without either consent of the individual or lgel requirement

Accountability Principle

OECD Privacy Guideline principle which states individuals should have the right to challenge the content of any personal data being held, and have a process for updating their personal data if found to be inaccurate or incomplete

Collection Limitation Principle

OECD Privacy Guideline principle which states personal data collection should have limits, be obtained in a lawful manner, and, unless there is a compelling reason to the contrary, with the individuals knowledge and approval.

Data Quality Principle

OECD Privacy guideline principle that states personal data should be complete, accurate, and maintained in a fashion consistent with the purposes for the data collection

Individual Participation Protocol

OECD privacy guideline principle that states indivdual should have control over their data

purpose specification principle

OECD privacy guidline principle that states the purpose for the data collection should be known, and the subsequent use of the data should be limited to the purposes outlined a the time of collection

polymorphism

OOP concept based on the Greek roots "polyu" and "morph" meaning many and forms, respectively): allows an object to overload an operator, for example

Parent Class

OOP concept that allows objects to inherit capabilites from parents

Coupling

OOP concept that connects objects to others. Highly coupled objects have low cohesion

Cohesion

OOP concept that describes as independent object. Objects with high cohesion have low coupling

Interior Gateway Protocol (IGP)

OSI Layer 3 Routing Protocol used for private networks, like Intranets

ORBs

Object Request Brokers, used to locate and communicate with objects

OOA

Object-Oriented Analysis, high-level approach to understanding a problem domain that identifies all objects and their interaction

OOD

Object-Oriented Design, a high-level object-oriented approach to designing software

OOP

Object-Oriented Programming, changes the older procedural programming methodology, and treats a program as a series of connected objects that communicate via messages

OLE

Oblject Linking and Embedding, part of DCOM which links documents to other documents

OEP

Occupant Emergency Plan, a facility-based plan focused on safety and evacuation

FRR / False Reject Rate

Occurs when an authorized subject is rejected as invalid, Also known as a type I error

FAR / False Accept Rate

Occurs when an unauthorized subject is accepted as valid, Also known as a type II error

Authorization Creep

Occurs when employees not only maintain old access rights but also gain new ones as they move from one division to another within an organization.

Screened host architecture

Older flat network design using one router to filter external traffic to and from a bastion host via an ACL.

X.25

Older packet switched Wan protocol

Thinnet

Older type of coaxial cable, used for Ethernet bus networking

Thicknet

Older type of coaxial cable, used for ethernet bus networking

Instance

One copy of an object

Footcandle

One lumen per square foot

Lux

One lumen per square meter

Vernam Cipher

One-time pad using a teletypewriter, invented by Gilbert Vernam

Multicast

One-to-many network traffic, and the "many" is preselected

Unicast

One-to-one netork traffi, such as a client surfing the web

Simplex

One-way communication, like a car radio tuned to a music station.

OCSP

Online Certificate Status Protocol

OSPF

Open Shortest Path First, an open link state routing protocol

OCTAVE

Operationally Critical Threat, Asset and Vulnerability Evaluation, a risk management framework from Carnegie Mellon University

OECD Privacy Guidelines

Organization for Economic Cooperation and Development privacy guidelines, containing eight principles

OUI

Organizationally unique identifier, first 24-bits of a MAC address

OFDM

Orthogonal Frequency-Division Multiplexing, a newer wireless multiplexing method, allowing simultaneous transmission using multiple independent wireless frequencies that do not interfere with each other

OFB

Output Feedback, a stream mode of DES that uses portions of the keyfor feedback

Offshoring

Outsourcing to another country

protocol data unit

PDU

protected EAP

PEAP

pretty good privacy

PGP

public key infrastructure

PKI

Certificate Authority

PKI component that authenticates the identity of a person or organization before issuing a certificate to them

programmable logic device

PLD

post office protocol

POP

power-on self-test

POST

point-to-point protocol

PPP

point-to-point tunneling protocol

PPTP

primary rate interface

PRI

programmable read only memory

PROM

platform as a service

Paas

RSN / Robust Security Network

Part of 802.11i that allows changes to cryptographic ciphers as new vulnerabilities are discovered.

Business interruption testing

Partial or complete failover to an alternate site

Crippleware

Partially functioning proprietary software, often with key features disabled. The user is typically required to make a payment to unlock the full functionality

Magnetic stripe card

Passive device that contains no circuits. Sometimes called swipe cards: they are used by swiping through a card reader

Passive infrared sensor

Passive motion detector that detects infrared energy created by body head

PAP

Password Authentication Protocol, an insecure network authentication protocol that exposes passwords in cleartext

Dictionary attack

Password cracking method that uses a [redefined list of words like a dictionary , running each word through a hash algorithm

One-Time password

Password that may be used for a single authentication

PCI-DSS

Payment Card Industry Data Security Standard, a security standard created by the Payment Card Industry Security Standards Council (PCI SSC)

penetration testing

Penetration testing is a method of evaluating the security of a computer system or network by simulating an attack that a malicious hacker would carry out. This is done so that vulnerabilities and weaknesses can be uncovered.

Transposition

Permutation - provides confustion by rearranging the characterso fthe plain-text, anagram style

PAN

Personal Area Network, a very small network with a range of 100 m or much less

PDA

Personal Data Assistant, a small networked computer that can fit in the palm of your hand

eDiscovery / Electronic Discovery

Pertains to legal counsel gaining access to pertinent ESI (Electronic Stored Information) during the pre-trial discovery phase of civil legal proceedings

Shoulder surfing

Physical attack where an attacker observes credentials, such as a key combination.

Bus

Physical network topology that connects network nodes in a string

Ring (physical)

Physical network topology that connects nodes in a physical ring.

Mesh

Physical network topology that interconnects network nodes to each other

Tree

Physical network topology with a root node, and branch node that are at least three level deep

POTS

Plain old telephone service, analog phone service (RJ11 fax machine)

Cyber Incident Response Plan

Plan designed to respond to disruptive cyber events, including network-based attacks, worms, computer viruses, Trojan horses, etc.

PaaS

Platform as a service, provides a pre-configured operating system, and the customer configures the application

Vigenere Cipher

Ployalphabetic cipher names after Blaise de Vignère, using a Vignère Square

Exfiltration

Policy-violating removal of sensitive data fram a secure perimeter

802.1X

Port-based Network Access Control layer 2 authentication

Unallocated space

Portions of a disk partition whoc do not contain active data

Allocated Space

Portions of disk partition that are marked as actively containing data

Active RFID

Powered RFID tags that can operate via larger distances

Constrained user interface

Presents a user with limited controls on information, such as an ATM keypad

PGP

Pretty Good Privacy, software that integrates asymmetric, symmetric and hash cryptography

Intrusion Prevention System (IPS)

Preventative device designed to prevent malicious actions

Warded lock

Preventative device that turn a key through channels (called wards) to unlock

Key lock

Preventive device that requires a physical key to unlock

EU Data Protection Directive

Privacy directive which allows for the free flow of information while still maintaining consistent protections of each member nations citizens data

RFC 1918 addresses

Private IPv4 addresses which may be used for internal traffic.

Agents of law enforcement

Private citizens carrying out actions on the behalf of law enforcement

degauss

Process that demagnetizes magnetic media so that a very low residue of magnetic induction is left on the media. Used to effectively erase data from media.

Authentication

Proof of an Identity claim

PDU

Protocol Data Unit, a header and data at one layer of a network stack

Cable modem

Provide Internet access via broadband cable TV

Zachman Framework

Provides 6 frameworks for providing information security, asking what, how, where, who, when and why, and mapping those frameworks across rules including planner, owner, designer, builder, programmer and user

SAN / Storage Area Network

Provides block-level disk storage via a network.

Custodian

Provides hands-on protection of assets

Graham-Denning Model

Provides more granuler approach for interaction between subjects and objects.

Digital signature

Provides nonrepudiation, which includes authentication of the identity of the signer, and proof of the document's integrity

ECPA / Electronic Communications Privacy Act

Provides search and seizure protection to non-telephony electronic communications

BRI/Basic Rate Interface

Provides two 64k digital ISDN channels

Virtual Memory

Provides virtual address mapping between applications and hardward memory

Circuit-level proxy

Proxy firewall that operates at Layer 5

Application-layer proxy

Proxy firewall that operates up to Layer 7

qualitative risk analysis

RA method which uses approximate values (different from quantitative - which is to quantify, how much, count, etc..)

rapid application development

RAD

redundant array of inexpensive disks

RAID

RAID 1 + 0

RAID 0 combined with RAID 1, sometimes called RAID 10

RAID 10

RAID 1 + 0

RAID 2

RAID hamming code

RAID 1

RAID mirrored set

RAID 0

RAID striped set

RAID 3

RAID striped set with dedicated parity (byte level)

RAID 4

RAID striped set with dediciated parity (block level)

RAID 5

RAID striped set with distibuted parity

RAID 6

RAID striped set with dual distrubuted parity

random access memory

RAM

radio-frequency identification

RFID (best known as scanning bar codes)

reduced instruction set computer

RISC

read only memory

ROM

recovery point objective

RPO

recovery time objective

RTO

real-time transport protocol

RTP

Industrial, Scientific, and Medical (ISM)

Radium Spectrum (bands) that are set aside for unlicensed use, meaning you do not need to acquire a license from an organization such as the FCC to use them

ROM

Read Only Memory

Clark-Wilson

Real-world integrity model that protects integrity by having subjects access objects via programs

object reuse

Reassigning to a subject media that previously contained information. Object reuse is a security concern because if insufficient measures were taken to erase the information on the media, the information may be disclosed to unauthorized personnel.

Watchdog timer

Recovers a system by rebooting after critical processes hang or crash

Simulation test

Recovery from a pretend disaster, goes beyond talking about the process and actually has teams carry out the recovery process.

Parallel Processing

Recovery of critical processing components at an alternate computing facility, without impacting regular production systems

Cybersquatting

Registering internet domain names associated with another organization's intellectual property

Typosquatting

Registering internet domain names comprised of likely misspellings or mistyping of legitmate domain trademarks

Need to know

Requirement that subjects need to know infomration before accessing it

GLBA / Gramm-Leach-Bliley Act

Requires financial institutions to protect the confidentiality and integrity of consumer financial information

Gramm-Leach-Bliley Act (GLBA)

Requires financial institutions to protect the confidentiality and integrity of consumer financial information

Rotation of Duties

Requires that critical functions or responsibilities are not continuously performed by the same person without interruption. Also known as job rotation.

Entity Integrity

Requires that each tuple has a unique primary key that is not null

Semantic integrity

Requires that each value is consistent with the attribute data type

Due care

Requires that key organizational stakeholders are prudent in carrying out their duties, aka that "prudent man rule"

Chain of custody

Requires that once evidence is acquired, full documentation regarding who, what, when and where evidence was handled is maintained

Strong Authentication

Requires that the user present more than one authentication factor, also called dual factor authentication

Best evidence rule

Requires use of the strongest possible evidence

Class I gate

Residential gate designed for home use

Rollback

Restores a database after a failed commit.

Class IV gate

Restricted access gate, used at an airport or prison

Static password

Reusable passwords that may or may not expire

Data controllers

Role that creates and manages sensitive data within the organization. Human resources employees are an example: they create and manage sensitive data, such as salary and benefit data, reports from employee sanctions, etc..

Data Processor

Role that manages data on behalf of data controllers. An outsourced payroll company is an example of data processor

Enigman

Rotor machine used by German Axis powers during World War II

SIGABA

Rotor machine used by the United States through World War II into the 1950s.

Distance vector

Routing protocol that uses a simple metric, such as hop count

Link state

Routing protocols that factor in additional metrics for determining the best route, including bandwidth

Multiprocessing

Runs multiple processes on multiple CPUs

Internet Small Computer System Interface (iSCSI)

SAN protocol that allows for leveraging existing networking infrastructure and protocols to interface with storage

FCIP / Fibre Channel over IP

SAN protocol that encapsulates Fibre Channel frames via Ethernet and TCP/IP

FCoE / Fibre Channel over Ethernet

SAN protocol that leverages Fibre Channel, but can be transmitted across standard Ethernet networks. Does not use TCP/IP

SOX

Sarbanes-Oxley Act of 2002, created regulatory compliance mandates for publicly traded companies

SOX / Sarbanes-Oxley Act

Sarbanes-Oxley Act of 2002, created regulatory compliance mandates for publicly traded companies.

Remote journaling

Saves database checkpoints and the database journal to a remote site. In the event of failure at the primary site, the database may be recovered.

Cryptography

Science of creating messages whose meaning is hidden

Browsing

Searching through storage media looking for specific information without necessarily knowing what format the information is in. A browsing attack is one in which the attacker looks around a computer system either to see what looks interesting or to find specific information.

Act honorably, justly, responsibly, and legally

Second canon of the (ISC)2 Code of ethics

Conduct the business impact analysis (BIA)

Second step of the NIST SP 800-34 contingency planning process

SRTP

Secure Real-time Transport Protocol used to provide secure VoIP

SSL

Secure Sockets Layer, authenticates and provides confidentiality to network traffic such as web traffic

Code Repositories

Secure service for storing source code of projects, a public example is GitHub

Awareness

Security Control designed to change user behavior

SPI

Security Parameter Index, used to identify Simplex IPsec security violations

Training

Security control designed to provide a skill set

Label

Security level assigned to an object, such as confidential, secret or top secret

Administrative Controls

Security mechanisms that are management's responsibility and referred to as "soft" controls. These controls include the development and publication of policies, standards, procedures, and guidelines; the screening of personnel; security-awareness training; the monitoring of system activity; and change control procedures.

Bell-LaPadula

Security model focused on maintaining the confidentiality of objects

Biba

Security model focused on maintaining the integrity of objects

Add-on Security

Security protection mechanisms that are hardware or software retrofitted to a system to increase that system's protection level.

Penetration test

Security test designed to determine if an attacker can penetrate an organization

Computer-Aided Software Engineer

See - CASE

Counter Mode CBC MAC Protocol

See - CCMP

Content Distribution Networks

See - CDN

Crossover Error Rate

See - CER

Computer Incident Response Team

See - CIRT

Complex Instruction Set Computer

See - CISC

Crisis Management Plan

See - CMP

Control Objectives for Information and related Technology

See - COBIT

Component Object Model

See - COM

Continuity of Operations Plan

See - COOP

Commercial Off-the-Shelf Software

See - COTS

Continuity Planning Project Team

See - CPPT

Computer Security Incident Response Team

See - CSIRT

Cross-Site Request Forgery

See - CSRF

Counter Mode

See - CTR

Consistency testing

See - Checklist testing

Data Circuit-Terminating Equipment

See - DCE

Data Definition Language

See - DDL

Data Encryption Algorithm

See - DEA

Data Execution Prevention

See - DEP

Date Encryption Standard

See - DES

Data hiding

See - Encapsulation (object)

Cross-Site Scripting

See - XSS

Discretionary access control

See --DAC

Distributed Network Protocol

See DPN3

JavaScript Object Notation

See JSON - JavaScript Object Notation, a data interchange format

Network Address Translation

See NAT

Nondisclosure agreement

See NDA

Network Interface Card

See NIC

Network-based Intrusion Detection Systems

See NIDS

Network Intrusion Prevention System

See NIPS

Normal Response Mode

See NRM

Nonce Sum

See NS

Online Certificate Status Protocol

See OCSP

Operationally Critical Threat, Asset, and Vulnerability Evaluation

See OCTAVE

Occupant Emergency Plan

See OEP

Output Feedback

See OFB

Orthogonal Frequency-Division Multiplexing

See OFDM

Object Linking and Embedding

See OLE

Object-Oriented Analysis

See OOA

Object-Oriented Design

See OOD

Object-Oriented Programming

See OOP

Object Request Brokers

See ORBs

Open Shortest Path First

See OSPF

Organizationally Unique Identifier

See OUI

Personal Area Network

See PAN

Password Authentication Protocol

See PAP

Payment Card Industry Data Security Standard

See PCI DSS

Personal Digital Assistant

See PDA

Personally Identifiable Information

See PII

Personal Identification Number

See PIN

Mutual Aid Agreement

See Reciprocal agreement

Dual Factor Authentication

See Strong Authentication

Orange Book

See TCSEC

Common Object Request Broker Architecture

See- COBRA

Disclosure, Alteration and Destruction

See--DAD

Data remanence

See-Remanence

Contraband check

Seek to identify objects that are prohibited to enter a secure perimeter (such as an airplane)

Differential cryptanalysis

Seeks to find the "difference" between related plaintexts that are encrypted

Normalization

Seeks to make the data in a database table logically concise, organized and consistent

Confidentiality

Seeks to prevent the unauthorized disclosure of information

Expert systems

Seeks to replicate the knowledge and decision-making capability of human experts

Mission Owners

See—Business Owners - Also called Mission Owners, members of senior management who create the information security program and ensure that it is properly staffed, funded, and has organizational priority

Layered defense

See—Defense-in-depth Application of multiple safeguards that span multiple domains to protect an asset

Key Distribution Center

See—KDC Key Distribution Center, a Kerberos service that authenticates principals

Layer 2 Tunneling Protocol

See—L2TP - Layer 2 Tunneling Protocol, combines PPTP and L2F

Local Area Network

See—LAN - Local Area Network, a comparatively small network, typically confined to a building or an area within one

Link Control Protocol

See—LCP -Link Control Protocol, the initial unauthenticated connected used by CHAP

Lightweight Directory Access Protocol

See—LDAP - Lightweight Directory Access Protocol, open protocol for interfacing and querying directory service information provided by network operating systems. Uses port 389 via TCP or UDP

Lightweight Extensible Authentication Protocol

See—LEAP - Lightweight Extensible Authentication Protocol, a Cisco-proprietary protocol released before 802.1X was finalized

Logical Link Control

See—LLC- Logical Link Control, layer 2 protocol that handles LAN communications

Logical Unit Numbers

See—LUN - Logical Unit Numbers, provide a way of addressing storage across the network. Also used for basic access control for network accessible storage

Media Access Control

See—MAC - Mandatory Access Control, system-enforced access control based on subject's clearances and object's labels

Mandatory Access Control

See—MAC - Media Access Control, layer 2 protocol that transfers data to and from the physical layer

Metropolitan Area Network

See—MAN - Metropolitan Area Network, typically confined to a city, a zip code, or a campus or office park

Message Digest 5

See—MD5 - Message Digest 5, a hash function that creates a 128-bit message digest

Message Integrity Check

See—MIC - Message Integrity Check, integrity protocol used by WPA2

Minimum Operating Requirements

See—MOR - Minimum Operating Requirements, describes the minimum environmental and connectivity requirements in order to operate computer equipment

Multiprotocol Label Switching

See—MPLS - Multiprotocol Label Switching, provides a way to forward WAN data via labels

Mean Time Between Failures

See—MTBF - Mean Time Between Failures, quantifies how long a new or repaired system will run on average before failing

MAD

See—MTD - Maximum Tolerable Downtime, the total time a system can be inoperable before an organization is severely impacted

Maximum Allowable Downtime

See—MTD - Maximum Tolerable Downtime, the total time a system can be inoperable before an organization is severely impacted

Maximum Tolerable Downtime

See—MTD - Maximum Tolerable Downtime, the total time a system can be inoperable before an organization is severely impacted

Mean Time to Repair

See—MTTR - Mean Time to Repair, describes how long it will take to recover a failed system

Maximum Transmission Unit

See—MTU - Maximum Transmission Unit, the maximum PDU size on a network

Malicious Code

See—Malware -Malicious software, any type of software which attacks an application or system

MCH

See—Northbridge - Connects the CPU to RAM and video memory, also called the Memory Controller Hub (MCH)

Memory Controller Hub

See—Northbridge - Connects the CPU to RAM and video memory, also called the Memory Controller Hub (MCH)

Least privilege

See—Principle of least privilege - Granting subjects the minimum amount of authorization required to do their jobs, also known as minimum necessary access

LWP

See—Thread - A lightweight process (LWP)

Scrum Master

Senior member of the organization who acts as a coach for the Scrum team.

SDN / Software Defined Networking

Separates a router's control plane from the data (forwarding) plane. Routing decisions are made remotely, instead of on each individual router.

Layering

Separates hardware and software functionality into modular tiers

SLIP

Serial Line Internet Protocol, a Layer 2 protocol which provides IP connectivity via asynchronous connections such as serial lines and modems

SLA

Service Level Agreement, contractual agreement that helps assure availability

SIP

Session Initiation Protocol, a VoIP signaling protocol

Time multiplexing

Shares system resources between mulitiple processes, eahc with a dedicated slice of time

STP

Shielded Twisted Pair, network cabling that contains additional metallic shielding around each twisted pair of wires

Faraday Cage

Shields enclosed objects from EMI

Maintenance hook

Shortcut installed by system designers and programmers to allow developers to bypass normal system checks during development

Shadow Database

Similar to a replicated database, with one key difference: a shadow database mirrors all changes made to a primary database, but clients do not access the shadow.

Thin clients

Simple computer systems the rely on centralise applications and data

SMTP

Simple mail transfer protocol, a store-and-forward protocol used to exchange email between servers

ANN/Artificial Neural Networks

Simulate neural networks found in humans and animals

SLE

Single Loss Expectancy, the cost of a single loss

SSO

Single Sign On, allows a subject to authenticate once and then access multiple systems

Applet

Small pieces of mobile code that are embedded in other software such as web browsers

Fraggle attack

Smurf attack variation which uses UDP instead of ICMP

Initial

Software Capability Maturity Model (CMM) Phase 1 : software process is characterized as ad hoc, and occassionally even chaotic. Few processes are defined, and success depends on individual effort

Spiral Model

Software Development model designed to control risk

Antivirus Software

Software designed to prevent and detect malware infections

Intrusion Detection System (IDS)

Software employed to monitor and detect possible attacks and behaviors that vary from the normal and expected activity. The IDS can be network based, which monitors network traffic, or host based, which monitors activities of a specific system and protects system files and control mechanisms.

firmware

Software instructions that have been written into read-only memory (ROM) or a programmable ROM (PROM) chip.

Closed source

Software released in executable form: the source code is kept confidential

Machine code

Software that is executed directly by the CPU

Freeware

Software that is free of charge

Operating System

Software that operates a computer

Antimalware

Software whose principal functions include the identification and mitigation of malware; also known as antivirus, although this term could be specific to only one type of malware.

Open source

Software with publicly published source code, allowing anyone to inspect, modify, or compile the code

SSD

Solid State Drive, a combination of flash memory (EEPROM) and DRAM

Type 3 Authenication

Something you are

Type 2 Authentication

Something you have

Type 1 Authentication

Something you know

Slack Space

Space on a disk between the end-of-file marker and the end of the cluster

Minutiae

Specific fingerprint details that include whorls, ridges, bifurcation, and others

DNS reflection attack

Spoofed Dos attack using third-party DNS servers

Striping

Spreading data across multiple disks to achieve performance gains, used by some levels of RAID

Top-Down Programming

Starts with the broadest and highest level requirements (the concept of the final program) works down towards the low-level tehcnical implementation details

Bottom-Up programming

Starts with the low-level technical implementation details and works up to the concept of the complete program

SRAM

Static Random Access Memory, expensive and fast memory that uses small latches called "flip-flops" to store bits

Firmware

Stores small programs that do not change frequently, such as a compute's BIOS

Feedback

Stream cipher mechanism that seeds the previous encrypted bit into the next bit to be encrypted

SQL

Structured Query Language, the most popular database query language

RBAC / Role-Based Access Controls

Subjects are grouped into roles and each defined role has access permissions based upon the role, not the individual.

Rotation Cipher

Substitution cipher that shifts each character of ciphertext a fixed amount past each plaintext character.

Monoalphabetic cipher

Substitution cipher using one alphabet

High-level Data link control (HDLC)

Successor to SDLC. HDLC adds error correction and flow control, as well as two additional modes (ARM and ABM).

SMDS

Switched Multimegabit Data Service, an older WAN technology that is similar to ATM

SVC

Switched Virtual Circuit, a circuit that is established on demand

SPAN port

Switched port analyzer, receives traffic forwarded from other switch ports

Data Encryption Standard (DES)

Symmetric key encryption algorithm that was adopted by the government as a federal standard for protecting sensitive unclassified information. DES was later replaced with Advanced Encryption Standard (AES).

SONET

Synchronous Optical Networking, carries multiple T-carrier circuits via fiber optic cable

Open system

System using open hardware and standards, using standard componenets from a variety of vendors

Closed system

System using proprietary hardware or software

PSH

TCP flac, push data to application layer

ACK

TCP flag, acknowledge received data

URG

TCP flag, packet contains urgent data

RST

TCP flag, reset (tear down) a connection.

SYN

TCP flag, synchronize a connection

FIN

TCP fral, finish a connection (gracefully)

Internet Protocol (TCP/IP)

TCP/IP model layer that aligns with layer 3 (network) layer of the OSI Model. This is where IP Addresses and routing lives.

Application Layer (TCP/IP)

TCP/IP model layer that combines Layers 5 through 7 of the OSI model

Network Access Layer

TCP/IP model layer that combines layers 1 and 2 of the OSI model. It describes Layer 1 issues such as energy, bits and the medium used to carry them

Transport Layer (OSI)

TCP/IP model layer that connects the internet layer to the application layer

Reserved ports

TCP/IP ports 1023 and lower.

Ephemeral ports

TCP/IP ports 1024 and higher

race condition

TOCTOU

Access Control Matrix

Table defining what access permissions exist between specific subjects and objects

Truth table

Table used to map all the results of a mathmatical operaiont such as XOR

Encapsulation / Network

Takes information from a higher network layer and adds a header to it, treating the higher-layer information as data

Live forensics

Taking a binary image of physical memory, gathering details about running processes, and gathering network connection data

Compartmentalization

Technical enforcement of need to know

ISO/IEC-27031

Technically-focused business continuity guideline that is part of the ISO 27000 series

TKIP

Temporal Key Integrity Protocol - user to provide integrity py WPA

TACACS

Terminal Access Controller Access Controller System, a SSO method often used for network equipment

TAP

Test Access Port, provides a way to tap into network traffic and see all unicast streams on a network

Direct evidence

Testimony provided by a witness regarding what the witness actually experienced

Acceptance Testing

Testing to ensure the software meets the customers operational requirements

Dynamic testing

Tests code while executing it

Flat file

Text file that contains multiple lines of data, each in a standard format

BCI

The Business Continuity Institute

Commandments of Computer Ethics

The Computer Ethics institute code of ethics

GIG / Global Information Grid

The US DoD global network, one of the largest private networks in the world

AV/Asset Value

The Value of a protected asset

Remote wipe

The ability to remotely erase a mobile device.

Vulnerability

The absence or weakness of a safeguard that could be exploited.

vulnerability

The absence or weakness of a safeguard that could be exploited.

Recovery Point Objective

The acceptable amount of data loss measured in time.

Aggregation

The act of combining information from separate sources of a lower classification level that results in the creation of information of a higher classification level, which the subject does not have the necessary rights to access.

Validation

The act of performing tests and evaluations to test a system's security level to see if it complies with security specifications and requirements.

validation

The act of performing tests and evaluations to test a system's security level to see if it complies with security specifications and requirements.

data leak prevention (DLP)

The actions that organizations take to prevent unauthorized external parties from gaining access to sensitive data.

Threat Agents

The actors causing the threats that exploit a vulerability

RPO / Recovery Point Objective

The amount of data loss or system inaccessibility (measured in time) that an organization can withstand.

Work factor

The amount of time required to break a cryptosystem (decrypt a ciphertext without a key)

data mining

The analysis of the data held in data warehouses in order to produce new and useful information.

Depth of Field

The area that is in focus

Lock picking

The art of unlocking a lock without a key

Reliability

The assurance of a given system, or individual component, performing its mission adequately for a specified period of time under the expected operating conditions.

Access aggregation

The collective entitlements granted by multiple systems to one user. Can lead to authorization creep

EOC / Emergency Operations Center

The command post established during or just after an emergency event

isolation

The containment of processes in a system in such a way that they are seperated from one another to ensure integrity and confidentiality.

Full disclosure

The controverial practice of releasing vulnerability details publicly

kernel

The core of an OS, a kernel manages the machine's hardware resources (including the processor and the memory) and provides and controls the way any other software component accesses these resources.

Total Cost of Ownership (TCO)

The cost of a safeguard

ALE/Annualized Loss Expectancy

The cost of loss due to a risk over a year

Accreditation

The data owners acceptance of the risk represented by a system

Field of view

The entire area viewed by a camera

Work Factor

The estimated time and effort required for an attacker to overcome a security control.

work factor

The estimated time and effort required for an attacker to overcome a security control.

Keyboard unit

The external keyboard

Cache memory

The fastest memory on the system, required to keep up with the CPU as it fetches and executes instructions

802.11i

The first 802.11 wireless security standard that provides reasonable security

Method

The function performed by an object

ActiveX controls

The functional equivalent of Java applets. They use digital certificates instead of a sandbox to provide security

cryptosystem

The hardware or software implementation of cryptography.

Kernel

The heart of the operating system, that usually runs in ring 0. It provides the interface between hardware and the rest of the operating system, including applications

Configuration Management

The identification, control, accounting, and documentation of all changes that take place to system hardware, software, firmware, supporting documentation, and test results throughout the lifespan of the system.

BCP/DRP project manager

The key point of contact for ensuring that a BCP/DRP is not only completed, but also routinely tested

Risk

The likelihood of a threat agent taking advantage of a vulnerability and the resulting business impact. A risk is the loss potential, or probability, that a threat will exploit a vulnerability.

Security domain

The list of objects a subject is allowed to access.

Due Diligence

The management of Due care

RTO / Recovery Time Objective

The maximum time allowed to recover business or IT systems.

Recovery Time Objective

The maximum time period within which a business process must be restored to a designated service level after a disaster to avoid unacceptable consequences.

Baseline

The minimum level of security necessary to support and enforce a security policy.

dedicated security mode

The mode in which a system operates if all users have the clearance or authorization to access, and the need to know about, all data processed within the system. All users have been given formal access approval for all information on the system and have signed nondisclosure agreements pertaining to this information.

Bell-LaPadula Model

The model uses a formal state transition model that describes its access controls and how they should perform. When the system must transition from one state to another, the security of the system should never be lowered or compromised. See also multilevel security, simple security proeprty, and start property (*-property).

ARO/Annual Rate of Occurrence

The number of losses suffered per year

Gross negligence

The opposite of due care

Diffusion

The order of plaintext should be dispersed in the ciphertext

802.11-1997

The original mode of 802.11 operated at 2mbs using the 2.4 GHz frequency

exposure factor

The percentage of loss a realized threat could have on a certain asset.

EF / Exposure Factor

The percentage of value an asset lost due to an iincident

Entitlements

The permissions granted to a user

Topology

The physical construction of how nodes are connected to form a network.

topology

The physical construction of how nodes are connected to form a network.

loss potential

The potential losses that can be accrued if a threat agent actually exploits a vulnerability.

cryptanalysis

The practice of breaking cryptosystems and algorithms used in encryption and decryption processes.

DevOps

The practice of incorporating developers and members of operations and quality assurance (QA) staff into software development projects to align their incentives and enable frequent, efficient, and reliable releases of software products.

Responsible Disclosure

The practice of privately sharing vulnerability information with a vendor, and withholding public release until a patch is available.

ARPAnet

The predecessor of the Internet

Computer bus

The primary communication channel on a computer system

personnel security

The procedures that are established to ensure that all personnel who have access to sensitive information have the required authority as well as appropriate clearances. Procedures confirm a person's background and provide assurance of necessary trustworthiness.

Throughput

The process of authenitcain to a system (such as a biometric authentication system)

Baselining

The process of capturing a point in time understanding of the current system security configuration

Scoping

The process of determining which portions of a standard will be employed by an organization.

Configuration management

The process of developing a consistent system security configuration that can be leveraged throughout an organization

Enrollment

The process of enrolling with a system (such as a biometric authentication system), creating an account for the first time

Risk Management

The process of identifying, assessing, and reducing the risk to an acceptable level and implementing the right mechanisms to maintain the level of risk.

Patch management

The process of managing software updates

electronic discovery (e-discovery)

The process of producing for a court or external attorney all electronically stored information pertinent to a legal proceeding.

Change management

The process of understanding, communicating, and documenting changes

Confusion

The relationship between the plaintext and ciphertext should be confused (or random) as possible

Availability

The reliability and accessibility of data and resources to authorized identified individuals in a timely manner.

Residual Risk

The remaining risk after the security controls have been applied. The conceptual formulas that explain the difference between total and residual risk are: threats x vulnerability x asset value = total risk (threats x vulnerability x asset value) x control gaps = residual risk

purge

The removal of sensitive data from a system, storage device, or peripheral device with storage capacity at the end of a processing period. This action is performed in such a way that there is assurance proportional to the sensitivity of the data that the data cannot be reconstructed.

Database view

The results of a database query

Cryptanalysis

The science of breaking encrypted messages (recovering their meaning)

Steganography

The science of hidden communication

Artificial Intelligence

The science of programming electronic computers to "think" more intelligently, sometimes mimicking the ability of mammal brains

Cryptology

The science of secure communications

least privilege

The security principle that requires each subject to be granted the most restrictive set of privileges needed for the performance of authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized use.

dial-up

The service whereby a computer terminal can use telephone lines, usually via a modem, to initiate and continue communications with another computer system.

domain

The set of objects that a subject is allowed to access. Within this domain, all subjects and objects share a common security policy, procedures, and rules, and they are managed by the same management system.

Impact

The severity of damage, sometimes expressed in dollars (value)

ECB / Electonic Code Book mode

The simplest and weakest mode of DES

Control Zone

The space within a facility that is used to protect sensitive processing equipment. Controls are in place to protect equipment from physical or technical unauthorized entry or compromise. The zone can also be used to prevent electrical waves carrying sensitive data from leaving the area.

Tempest

The study and control of spurious electronic signals emitted by electrical equipment. Tempest equipment is implemented to prevent intruders from picking up information through the airwaves with listening devices.

Tempest

The study and control of spurious electronic signals emitted by electrical equipment. Tempest equpment is implemented to prevent intruders from picking up information through the airwaves with listening devices.

cryptology

The study of cryptography and cryptanalysis.

Certification

The technical evaluation of the security components and their compliance for the purpose of accreditation. A certification process can use safeguard evaluation, risk analysis, verification, testing, and auditing techniques to assess the appropriateness of a specific system processing a certain level of information within a particular environment. The certification is the testing of the security component or system, and the accreditation is the approval from management of the security component or system.

AIC triad

The three security principles: availability, intregrity, and confidentiality.

electronic vaulting

The transfer of backup data to an offsite location. This process is primarily a batch process of transmitting data through communications lines to a server at an alternative location.

encryption

The transformation of plaintext into unreadable ciphertext.

permissions

The type of authorized interactions that a subject can have with an object. Examples include read, write, execute, add, modify, and delete.

Cloud computing

The use of share remote computing devices for the purpose of providing improved efficiencies, performance, reliability, scalability, and security.

Annualized Rate of Occurrence (ARO)

The value that represents the estimated possibility of a specific threat taking place within a one-year timeframe.

One-Time Pad

Theoretically unbreakable encryption using paired pads of random characters

Technical Controls

These controls, also called logical access control mechanisms, work in software to provide confidentiality, integrity, or availability protection. Some examples are passwords, identification and authentication methods, security devices, auditing, and he configuration of the network.

technical controls

These controls, also called logical access control mechanisms, work in software to provide confidentiality, integrity, or availability protection. Some examples are passwords, identification and authentication methods, security devices, auditing, and the configuration of the network.

Structured walkthrough

Thorough review of a DRP by individuals that are knowledgeable about the systems and services targeted for recovery, AKA tabletop exercise

TGS

Ticket Granting Service, a Kerberos service which grants access to services

TGT

Ticket Granting Ticket, Kerberos credentials encrypted with the TGS key

Computer Fraud and Abuse Act

Title 18 United States Code Section 1030

Authenticate

To verify the identity of a subject requesting the use of a system and/or access to network resources. The steps to giving a subject access to an object should be identification, authentication, and authorization.

Broadcast

Traffic that is sent to all stations on a LAN

TCP

Transmission Control Protocol, uses a 3-way handshake to create reliable connections across a network

Object encapsulation

Treats a process as a "black box"

TFTP

Trivial File Transfer Protocol, a simple way to transfer files with no authentication or directory structure

RAT / Remote Access Trojans

Trojan Horses which may be remotely controlled.

TCSEC

Trusted Computer System Evaluation Critera - aka the Orange Book, evluaiton model developed by the departmnet of defence

TCSEC

Trusted Computer System Evaluation Criteria, AKA the Orange Book, evaluation model developed by the US Dept of Defense

TNI

Trusted Network Interpretation - the red Book

TLS

Tunnel Layer Security - the sucessor to SSL

Screened subnet architecture

Two firewalls screening a DMZ.

Collusion

Two or more people working together to carry out a fraudulent activity. More than one person would need to work together to cause some type of destruction or fraud; this drastically reduces its probability.

Collision

Two or more plaintexts that generate the same hash

Full duplex

Two-way simultaneous transmission, like two people having a face-to-face conversation

Network model (databases)

Type of hierarchical database that allows branches to have two parents

Copyright

Type of intellectual property that protects the form of expression in artistic, musical, or literary works

BIOS/Basic Input Output System

Typically stored in Firmware

Global Information Grid

US Department of Defense (DoD) global network, one of the largest private networks in the world

piggyback

Unauthorized access to a system by using another user's legitimate credentials.

Black hat

Unethical hacker or researcher

Baseline

Uniform ways to implement a safeguard , administrative control

USA PATRIOT ACT

Uniting and Strengthening America by Promoting Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001

Passive RFID

Unpowered RFID tags

Outsourcing

Use of a third party to provide information technology support services which were previously performed in-house

SPI / Security Parameter Index

Used to identify simplex IPsec security associations.

REST / Representational State Transfer

Used to implement web services.

SNMP / Simple Network Management Protocol

Used to monitor network devices.

SRTP / Secure Real-time Transport Protocol

Used to provide secure VoIP.

Data Mining

Used to search for patterns, such as fraudulent activity, in a data warehouse

FTP / File Transfer Protocol

Used to transfer files to and from servers

UDP

User Datagram Protocol, a simpler and faster cousin of to TCP

FHSS / Frequency Hopping Spread Spectrume

Uses a mumber of small frequency channels throughout the wireless band and "hops" through them in pseudorandom order

Rule-based access control

Uses a series of defined rules, restrictions, and filters for accessing objects within a system.

Fiber Optic network cable

Uses light to carry information

Bayesian filtering

Uses mathematical formulas to assign probabilities to make decisions such as identifying spam

War dialing

Uses modem to dial a series of phone numbers, looking for an answering modm carrier tone

Voice of Internet Protocol

VOIP - carries voice via data networks

Virtual Private Network

VPN - a method to send private data over insecure network, such as the internet

Threat vectors

Vectors which allow exploits to connect to vulnerabilites

VDSL

Very High Rate Digital Subscriber Line - DSL, featuring much faster asymmetric speeds

Stealth Virus

Virus that hides itself from the OS and other protective software, such as anti-virus software

Boot sector virus

Virus that infects the boot sector of a PC, which ensures the virus loads upon system startup

Multipartite virus

Virus that spreads via multiple vectors. Also called multipart virus

RTP / Real Time Protocol

VoIP protocol designed to carry streaming audio and video.

Memory

Volatile or nonvolatile computer storage

Wi-Fi Protected Access

WPA - a partial implementation of 802.11i

Wi-Fi Protected Access 2

WPA2 - the full implementation of 802.11i

Work Recovery Time

WRT - the time required to configure a recovered system

WSDL

Web Services Description Language, provides details about how web services are to be invoked

total risk

When a safeguard is not implemented, an organization is faced with the total risk of that particular vulnerability.

Total Risk

When a safeguard is not implemented, an origination is faced with the total risk of that particular vulnerability.

Repudiation

When the sender of a message denies sending the message. The countermeasure to this is to implement digital signatures.

Biometrics

When used within computer security, identifies individuals by physiological characteristics, such as a fingerprint, hand geometry, or pattern in the iris.

FDE / Full Disk Encryption

Whole Disk Encryption

WAN

Wide area network, typically covering cities, states, or countries

WAP

Wireless Application Protocol, designed to provide secure web services to handheld wireless devices such as smart phones

WLAN

Wireless Local Area Network

802.11

Wireless networking standard

Exigent circumstances

With respect to evidence acquisition, justification for the seizure of evidence without a warrant due to the extreme likelihood that the evidence will be destroyed

WORM

Write Once Read Many, memory wich can be written to once, and read many times

Shredding / Wiping

Writes new data over each bit or block of file data.

Wiping

Writes new data over each bit or block of file data. Also called shredding

Hot Site

a backup site with all necessary hardware and critical applications data mirrored in real time

reciprocol agreement

a bi-directional agreeement between two organizations in which one organization promises another organization it can move in and share space if it experiences a disaster. also known as a mutual aid agreement.

Socket

a combination of an IP address and a TCP or UDP port on one node

T1

a dedicated 1.544 megabit circuit that carries 24 64 bit DSO channels

Internet

a global collection of peered networks running tcp/ip

Table

a group of related data in a relational database

Spring-bolt lock

a locking mechanism that springs in and out of the door jamb

realm

a logical kerberos network

Teardrop Attack

a malformed packet DoS attack that targets issues with systems' fragmentation reassembly

System Owner

a manager responsible for the actual computers that house data, including hardware and software config, updates, patching, etc

TCP/IP Model

a network model with 4 layers: network access, Internet, transport and application

Honeynet

a network of honeypots

Smart Card

a physical access control device containing an integrated circuit, AKA Integrated Circuit Card (ICC)

Trivial Transfer Protocol (TFTP)

a simple way to transfer files withouht the use of authentication or directory structure

problem domain

a specific challenge that needs to be addressed

Honeypot

a system designed to attract attackers

photoelectric motion sensor

active motin detector that sends a beam of light across a monitored space to a photoelectric sensor

Rainbow Table

acts as a databae that contains the hashed output for most or all possible passwords (as mentioned on McGuiver TV show)

regulatory law

administrative law

Zombie

aka Bot - a computer system running malware that is controlled by a botnet

purple

allied name for the stepping-switch encryption device used by Japanese Axis powers durring WWII

System call

allow processes to communicate with the kernel and provide a window between CPU rings

Hypervisor Mode

allows guests or operating in ring 0, controlled by a hypervisor in ring "-1"

polyinstantiation

allows two different objects to have the same name. the name is based on the Latin roots for multiple (poly) and instances (instantiation)

Time of Check/Time of Use (TOCTOU)

alrering a condition after it has been checked by the operating system, but before it Is used

Subject

an active entity on an Information System which accesses or changes data

Incremental Backup

an archive of all files that have changed since the last backup of any kind was performed

redundant site

an exact production dupliate of a system that has the capability to seamlessly operate all necessary IT operations withougt loss of services to the end user

process

an executable program and its associated data loaded and running in memory

pseudo guard

an unarmed security guard (sounds like a security monitor)

plaintext

an uncreypted message

Hardcopy Data

any data that is accessed through reading or writing on paper rather than processing through a computer system

Identification

association of an individual

Smurf attack

attack using an ICMP flood and directed broadcast addresses

IPv6 Autoconfiguration

autoconfiguration of a unique IPv6 address, omitting the need for static addressing for DHCP

Hand Geometry

biometric control that uses measurements from within specific points on the subjects hand

Hebern Machines

class of cryptographic devices known as rotor machines, includes enigma and SIGABA

Interpreted Code

code that is compiled on the fly each time the program is run

Hybrid Risk Analysis

combines quantitative and qualitative risk analysis

System unit

computer case, containing all of the internal electronic components including motherboard, internal disk drives, power supply etc

Source Code

computer programming language instructions that are written in text that must be translated into machine code before execution by the CPU

Sniffing

confidentiality attack on network traffic

Southbridge

connects I/O devices such as disk, keyboard, mouse, CD drive, USB ports etc

recovery controls

controls that restore a damege system or process

Decryption

converts a cipher text into plaintext

Substitution

cryptographic method that replaces one character with another

punitive damages

damages designed to punish an individual or organization

Statutory Damages

damages prescribed by law

Socket pair

describes a unique connection between two nodes: source port, source IP, destination port and destination IP

poison reverse

distance vector routihng protocol safeguard that sets bad route to infinity

Hold-Down Timers, Routing Information protocol

distance vector routing protocol safeguard that avoids flapping

XML

eXtensible Markup Language, a markup language designed as a standard way to encode documents and data

XP

eXtreme Programming, an agile development method that users paits of programmers who work off detailed specification

white hat

ethical hacker or researcher

real evidence

evidence consisting of tangilbe or physical objects

proxy firewall

firewalls that terminate connections and act as intermediary servers

Tailgating

following an authorized person into a building without providing credentials, AKA piggybacking

white box software testing

gives the tester accesss to program source code, data structures, variables, etc

principle of least privilege

granting subjects the minimum amount of authorization required (never give a person, program or process more permission than is required)

High-data-rate Digital Subscriber Line (HDSL)

high-data-rate DSL, matches SDSL speeds using two pairs of copper

policy

high-level management directives, administrative control

Hypertext Markup Language (HTML)

hypertext markup language, used to display web content

Hypertext Transport Protocol (HTTP)

hypertext transfer protocol, a protocol to transmit web data via a network

Hypertext Transport Protocol Secure (HTTPS)

hypertext transport protocol secure, HTTP using SSL, or TLS

physical controls

implemented with physical devices, such as locks, fencees, gates, etc.

recovery phase

incident response phase that restores a previously compromised system to operational status

Intellectual property

intangible property that resulted from a creative act

Internet Protocol Security (IPSEC)

internet protocol security, a suite of protocols that provide a cryptographic layer to both IPv4 and IPv6

Internet Relay Chat (IRC)

internet relay chat, a global network of chat servers and clients

principal

kerberos client (user) or service

query language

language that searches and updates a database

presentation layer

layer 6 of the OSI model, presents data to the application in a comprehensible way

physical layer

leyer 1 of the OSI modek, descrives units of data like bits rpresented by enerby, and he medium use to carry them

process isolation

logical control that attempts to prevent on process from interfering with another

Worm

malware that self-propogates

Virus

malware the requires a carrier to propagate

Harrison-Ruzzo-Ullman Model

maps subjects, objects, and accessrights to an access matrix. It is considered a variation to the graham-dennis model

Spoofing

masquerading as another endpoint

reference monitor

mediates all access between subjects and objects

High Availability (HA) Cluster

multiple systems that can be seamlessly leveraged to maintain the availability of the service or application being provided. Also called a failover cluster

Inheritance

objects inherit capabilities from their parent class

private key

one half of asymmetric key pair, must be kept secure (cousin of symmetric key pair)

public key

one half of asymmetric key pari, may be publicly poste

Hash Function

one-way encryption using an algorigthm and no key

prudent man rule

organization should engage in business practices that a prudent, right thinking, person would consider to be appropriate (ever watch what would you do?)

Iris Scan

passive biometric scan of the iris (colored portion of the eye)

Hybrid Attack

password attack that appends, prepends, or changes characters in words from a dictionary

PVC

permanent virtual circuit, a circuite that is always connected

PIN

personal identification number, a number-based password

PII

personally identifiable information, data associate with a specific person, such as credit card data

Star

physical network topology that connects each node to a central device such as a hub or a switch

Strike Plate

plate in the door jamb with a slot for a deadbolt or spring-bolt lock

PPP

point-to-point protocol, a layer 2 protocol that has largely replaces SLIP, adding confidentiality, integrity and authenticaion (CIA triad)

SOCKS

popular circuit-level proxy

POP

post office protocol, an email client protocol

POST

power on self test, performs basic computer hardware testes, including verifying the integrity of the BIOS, testing the memory, identifying system devices, among other tasks. Machines can fail this, it may come with beeps.

preventive controls

prevents actions from occuring

PRI

primary rate interface, provides 23 64K digital ISDN channels (as in conjuction with BRI)

PLD

programable logic device, field-programmable hardware

PROM

programmable read only memory, memory that can be written to once, typically at the factory

procedural languages

programming languages that use subroutines, procedures and functions

privacy

protection of the confidentiality of personal information

privacy act of 1974

protects US citizens' data that is being used by the federal government

Telnet

protocol that provides terminal emulation over a network using TCP port 23

PKI

public key infrastructure leverages symmetric, asymmetric and hash-based cyrptography to manage digital certificates

QoS

quality of service, gives specific traffic precedence over other traffic on packet-switched networks

RAM

random access memory, memory that allows any address to be directly accessed

RAD

rapid application development, rapidly develops software via the use of prototypes, "dummy" GUIs, back-end databases, and more

RAID

redundant array of inexpensive disks, a method of using multiple disk drives to achieve greater data reliabilty, greater speed, or both (striping, mirroring, or parity)

RAT

remote access trojans, trojan hourse which may be remotely controlled

RADIUS

remote authentication dial in user service, a UDP-based third-party authenction system (like pvault)

referential integrity

requires that every foreign key in a secondary table matches a primary key in the parent table

SYN flood

resource exhaustion DoS attack that fills a system's half-open connection table

RC4

rivest cipher 4, used to provide confidentiality by WPA

RC5

rivest cipher 5, symmetric block cipher by RSA laboratories

RC6

rivest cipher 6, symmetric block cipher by RSA laboratories, AES finalist

RBAC

role-based access controls, subjects are grouped into roles and each defined role has access permission base dupon the role, not the individual (there is also MAC & DAC)

product owner

scrum rold that serves as the voice of the business unit

Hearsay

second-hand evidence

SSH

secure shell, a secure replacement for telnet, ftp and the unix "R" commands

Integrity

seeks to prevent unauthorized modification of information

ping

sends and ICMP Echos Request to a node and listens for an ICMP Echo Reply

Half Duplex

sends or receives at one tome only (not simultanesouly), like a walkie-talkie

SSID

service set identifier, acts as a wireless network name

plan maintenance

seventh steps of the NIST SP 800-34 contingency planning process

SNMP

simple network management protocol, unsed to monitor network devices

plan testing, training and exercises

sixth step of the NISt SP 800-34 contingency planning process

registers

small storage locations used by the CPU to store instructions and data

Hypervisor

software or operating system that controls access between virtual guests and host hardware

Software escrow

source code held by a neutral third party

procedure

step-by-step guide for accomplishing a task, administrative control

polyalphabetice cipher

substitution cipher using multiple alphabets

penetration

successful attempt at circumventing security controls and gaining access to a system.

Diameter RADIUS

successor, designed to provide an improved Authentication, Authorization , and accounting (AAA) framework

Spear Phishing

targeted phishing attack against a small number of high level victims

Internet Layer (TCP/IP)

tcp/ip model layer that aligns with the layer 3 of the OSI model, describes IP Addresses and routing

Integration testing

testing multiple software components as they are combined into a working system

regression testing

testing software after updates, modifications or patches

Installation testing

testing software as it is installed and first operated

Interface Testing

tests all the ways users can interact with the application, and is concerned with appropriate functionality being exposed. From a security-oriented vantage point, the goal is to ensure that security is uniformly applied across the various interfaces

Static Testing

tests code passively, the code is not running

promiscuous access

the ability to sniff all traffic on a network (sounds like promiscuous mode)

reduction analysis

the process of analyzing and lowering risk

data warehousing

the process of combining data from multiple databases or data sources into a large data store for the purpose of providing more extensive information retrieval and data analysis.

Tailoring

the process of customizing a standard for an organization

due diligence

the process of systematically evaluating information to identify vulnerabilities, threats, and issues relating to an organization's overall risk.

cryptography

the science of secret writing that enables storage and transmission of data in a form that is available only to the intended individuals.

provide diligent and competent service to principals

third canon of the (ISC)2 Code of Ethics

Identify preventative controls

third step of the NIST SP 800-34 contigency planning process

Database shadowing

two or more identical databases that are updated simultaneously

primary key

unique attribute in a relational database table, used to join tables (as in SQL or MS Access)

Thin client applications

use a web browser as a universal client, providing access to robust applications that are downloaded from the thin client server and run in the client's browser

Synchronous Dynamic Token

use time or counters to synchronize a displayed token code with the code expected by the authentication server

SOAP

used to implement web services, used to stand for Simple Object Access Protocol, now simply "SOAP"

Social Engineering

uses the human mind to bypass security controls

Swapping

uses virtual memory to copy contents in primary memory (RAM) to or from secondary memory

polymorphic virus

virus that changes its sinature upon infection of a new systme, attempting to evade signature-based antivirus software

WEP

wired equivalent privacy, a very weak 802.11 security protocol