ISA 3100 Final Part 2

thermal detector

An alarm sensor designed to detect a defined rate of change in the ambient temperature within a defined space.

contact and weight sensor

An alarm sensor designed to detect increased pressure or contact at a specific location, such as a floor pad or a window.

vibration sensor

An alarm sensor designed to detect movement of the sensor rather than movement in the environment.

motion detector

An alarm sensor designed to detect movement within a defined space.

configuration and change management

An approach to implementing system change that uses policies, procedures, techniques, and tools to manage and evaluate proposed changes, track changes through completion, and maintain systems inventory and supporting documentation.

modem vulnerability assessment

An assessment approach designed to find and document any vulnerability on dial-up modems connected to the organization's networks.

intranet vulnerability assessment

An assessment approach designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network.

platform security validation (PSV)

An assessment approach designed to find and document vulnerabilities that may be present because misconfigured systems are used within the organization.

Internet vulnerability assessment

An assessment approach designed to find and document vulnerabilities that may be present in the organization's public network.

wireless vulnerability assessment

An assessment approach designed to find and document vulnerabilities that may be present in the organization's wireless local area networks.

full-safe lock

An electromechanical device that automatically releases the lock protecting a control point if a power outage occurs. This type of lock is used for fire safety locations.

fall-secure lock

An electromechanical device that stays locked and maintains the security of the control point if a power outage occurs.

proximity reader

An electronic signal receiver used with an electromechanical lock that allows users to place their cards within the reader's range and release the locking mechanism.

name badge

An identification card typically worn in a visible location to quickly verify an authorized member.

Standby UPS

An offline battery backup that detects the interruption of power to equipment and activates a transfer switch that provides power from batteries through a DC to C converter until normal power is restored or the computer is shut down.

delta conversion online UPS

An uninterruptible power supply (UPS) that is similar to a double conversion online UPS except that it incorporates a delta transformer, which assists in powering the inverter while outside power is available.

evidentiary material (EM)

Any item or information that applies to an organization's legal or policy-based case; also known as an item of potential evidentiary value.

resources

Components required for the completion of a project, which could include skills, personnel, time, money, and material.

fire suppression systems

Devices that are installed and maintained to detect and respond to a fire, potential fire, or combustion danger.

certification

In information security, the comprehensive evaluation of an IT system's technical and nontechnical security controls that establishes the extent to which a particular design and implementation meets a set of predefined security requirements, usually in support of an accreditation process.

affidavit

Sworn testimony that certain facts are in the possession of an investigating officer; an affidavit can be used to request a search warrant.

successors

Tasks or action steps that come after the specific task at hand.

predecessors

Tasks or action steps that come before the specific task at hand.

digital forensics

The application of forensics techniques and methodologies to the preservation, identification, extraction, documentation, and interpretation of digital media for evidentiary and/or root-cause analysis.

forensics

The coherent application of methodical investigatory techniques to present evidence of crimes in a court or similar setting.

vulnerability assessment and remediation domain

The component of the maintenance model focused on identifying specific, documented vulnerabilities and remediating them in a timely fashion.

external monitoring domain

The component of the maintenance model that focuses on evaluating external threats to the organization's information assets

planning and risk assessment domain

The component of the maintenance model that focuses on identifying and planning ongoing information security activities and identifying and managing risks introduced through IT information security projects.

internal monitoring domain

The component of the maintenance model that focuses on identifying, assessing, and managing the configuration and status of information assets in an organization.

phased implementation

The conversion strategy that involves a measured rollout of the planned system; only part of the system is brought out and disseminated across an organization before the next piece is implemented.

pilot implementation

The conversion strategy that involves implementing the entire system into a single office, department, or division, and dealing with issues that arise before expanding to the rest of the organization.

parallel operations

The conversion strategy that involves running the new system concurrently with the old system.

direct changeover

The conversion strategy that involves stopping the old system and starting the new one without any overlap.

revision date

The date associated with a particular version or build.

chain of evidence

The detailed documentation of the collection, storage, transfer, and ownership of evidence from the crime scene through its presentation in court.

project plan

The documented instructions for participants and stakeholders of a project that provide details on goals, objectives, tasks, scheduling, and resource management.

noise

The presence of additional and disruptive signals in network communications or electrical power delivery.

separation of duties

The principle that the completion of a significant task involving sensitive information requires at least two people.

gap analysis

The process of comparing measured results against expected results, then using the resulting "gap" as a measure of project success and as feedback for project management.

least privilege

The process of ensuring that no unnecessary access to data exists; employees are able to perform only the minimum operations necessary on a set of data.

tailgating

The process of gaining unauthorized entry into a facility by closely following another person through an entrance and using the credentials of the authorized person to bypass a control point.

vulnerability assessment (VA)

The process of identifying and documenting specific and provable flaws in the organization's information asset environment.

accreditation

The process that authorizes an IT system to process, store, or transmit information.

remediation

The processes of removing or repairing flaws in information assets that cause a vulnerability or removing the risk associated with the vulnerability.

version

The recorded state of a particular revision of a software or hardware configuration item. The version number is often noted in a specific format, such as "M.N.b." In this notation, "M" is the major release number and "N.b" can represent various minor releases or builds within uild list A list of the versions of components that make up a build. the major release.

need to know

The requirement that an employee only has access to information necessary for performing his or her own work.

job rotation

The requirement that every employee be able to perform the work of another employee. Also known as task rotation.

two person control

The requirement that two employees review and approve each other's work before the task is categorized as finished.

auditing

The review of a system's use to determine if misuse or malfeasance has occurred.

war dialing

The use of scripted dialing attacks against a pool of phone numbers in an effort to identify modem connection.

electromagnetic radiation (EMR)

the transmission of radiant energy through space, commonly referred to as radio waves.

TEMPEST

A U.S. government program designed to protect computers from electronic remote eavesdropping by reducing EMR emissions.

line-interactive UPS

A UPS in which a pair of inverters and converters draw power from the outside source both to charge the battery and provide power to the internal protected device.

Standby ferroresonant UPS

A UPS in which the outside power source directly feeds the internal protected device. The UPS serves as a battery backup, incorporating a ferroresonant transformer instead of a converter switch, providing line filtering and reducing the effect of some power problems, and reducing noise that may be present in the power as it is delivered.

Double conversion online UPS

A UPS in which the protected device draws power from an output inverter. The inverter is powered by the UPS battery, which is constantly recharged from the outside power.

configuration

A collection of components that make up a configuration item.

software library

A collection of configuration items that is usually controlled and that developers use to construct revisions and issue new configuration items.

deliverable

A completed document or program module that can either serve as the beginning point for a later task or become an element in the finished project.

digital malfeasance

A crime against or using digital media, computer technology, or related components.

project scope

A description of a project's features, capabilities, functions, and quality level, used at the basis of a project plan.

search warrant

A document issued by an authorized authority that allows law enforcement agents to search for EM at a specified location and seize specific items for official examination.

request for proposal (RFP)

A document specifying the requirements of a project, provided to solicit bids from internal or external contractors.

identification (ID) card

A document used to verify the identity of a member of an organization, group, or domain.

fixed temperature sensor

A fire detection sensor that works by detecting the point at which the ambient temperature in an area reaches a predetermined level

air-aspirating detector

A fire detection sensor used in high-sensitivity areas that works by taking in air, filtering it, and passing it through a chamber that contains a laser beam. The alarm triggers if the beam is broken.

clean agent

A fire suppression agent that does not leave any residue after use or interfere with the operation of electrical or electronic equipment.

dry pipe system

A fire suppression sprinkler system that has pressurized air in all pipes. The air is released in the event of a fire, allowing water to flow from a central area.

deluge system

A fire suppression sprinkler system that keeps all individual sprinkler heads open and applies water to all areas when activated.

virtual organization

A group of people brought together for a specific task, usually from different organizations, divisions, or departments.

configuration Item

A hardware or software item that will be modified and revised throughout its life cycle.

work breakdown structure (WBS)

A list of the tasks to be accomplished in the project, the skill sets or individual employees needed to perform the tasks, the start and end dates for tasks, the estimated resources required, and the dependencies among tasks.

build list

A list of the versions of components that make up a build.

electromechanical lock

A lock that can accept a variety of inputs as keys, including magnetic strips on ID cards, radio signals from name badges, personal identification numbers (PINs) typed into a keypad, or some combination of these to activate an electrically powered locking mechanism.

biometric lock

A lock that reads a unique biological attribute such as a fingerprint, iris, retina, or palm and then uses that input as a key.

exit interview

A meeting of a departing employee who is leaving the organization to remind the employee of contractual obligations, such as nondisclosure agreements, and to obtain feedback about the employee's tenure.

bull's eye model

A method for prioritizing a program of complex change; it requires that issues be addressed from the general to the specific and focuses on systematic solutions instead of individual problems.

change control

A method of regulating the modification of systems within the organization by requiring formal review and approval for each change.

minor release

A minor revision of a version from its previous state.

mechanical lock

A physical lock that may rely on either a key or numerical combination to rotate tumblers and release the hasp. Also known as a manual lock.

difference analysis

A procedure that compares the current state of a network segment against a known previous state of the same network segment (the baseline of systems and services).

project wrap-up

A process of bringing a project to a conclusion, addressing any pending issues and the overall project effort, and identifying ways to improve the process in the future.

technology governance

A process organizations use to manage the effects and costs of technology implementation, innovation, and obsolescence.

penetration testing

A set of security tests and evaluations that simulate attacks by a hacker or other malicious external source.

major release

A significant revision of a version from its previous state.

projectitis

A situation in project planning in which the project manager spends more time documenting project tasks, collecting performance measurements, recording project task information, and updating project completion forecasts in the project management software than accomplishing meaningful project work.

man-trap

A small room or enclosure with separate entry and exit points, designed to restrain a person who fails an access authorization attempt.

build

A snapshot of a particular version of software assembled or linked from its component modules.

plenum

A space between the ceiling in one level of a commercial building and the floor of the level above. The plenum is used for air return.

Ground Fault Circuit Interruption

A special circuit device designed to immediately disconnect a power supply when a sudden discharge (ground fault) is detected.

milestone

A specific point in the project plan when a task that has a noticeable impact on the plan's progress is complete.

war game

A type of rehearsal that seeks to realistically simulate the circumstances needed to thoroughly test a plan.

telecommuting

A work arrangement in which employees work from an off-site location and connect to an organization's equipment electronically. Also known as telework.