A Flashcards
Acceptable interruption window
The maximum period of time that a system can be unavailable before compromising the achievement of the enterprise’s business objectives.
Acceptable use policy
A policy that establishes an agreement between users and the enterprise that defines, for all parties, the ranges of use that are approved before gaining access to a network or the Internet
Access control
The processes, rules and deployment mechanisms that control access to information systems, resources and physical access to premises
Access path
The logical route that an end user takes to access computerized information.
Access rights
The permission or privileges granted to users, programs or workstations to create, change, delete or view data and files within a system, as defined by rules established by data owners and the information security policy
Accountability
The ability to map a given activity or event back to the responsible party
Administrative control
The rules, procedures and practices dealing with operational effectiveness, efficiency and adherence to regulations and management policies.
Advanced Encryption Standard (AES)
A public algorithm that supports keys from 128 bits to 256 bits in size
Advanced persistent threat (APT)
An adversary that possesses sophisticated levels of expertise and significant resources, which allow them to create opportunities to achieve their objectives by using multiple attack vectors, e.g., cyber, physical, and
deception. These objectives typically include establishing and extending footholds within the information technology infrastructure of the targeted organizations for purposes of exfiltrating information; undermining or
impeding critical aspects of a mission themselves to carry out these objectives in the future.
Alert situation
The point in an emergency procedure when the elapsed time passes a threshold and the interruption is not resolved. The enterprise entering into an alert situation initiates a series of escalation steps.
Algorithm
A finite set of well-defined, unambiguous rules for the solution of a problem in a finite number of steps, it is a sequence of operational actions that lead to a desired goal and is the basic building block of a program
Alternate facilities
Locations and infrastructures from which emergency or backup processes are executed, when the main premises are unavailable or destroyed
Alternate process
Automatic or manual process designed and established to continue critical business processes from point-of failure to return-to-normal
Annual loss expectancy (ALE)
The total expected loss divided by the number of years in the forecast period yielding the average annual loss
Anomaly detection
Detection on the basis of whether the system activity matches that defined as abnormal
Antimalware
A widely used technology to prevent, detect and remove many categories of malware, including computer viruses, worms, Trojans, keyloggers, malicious browser plug-ins, adware and spyware
Antiphishing
Software that identifies phishing content and attempts to block the content or warn the user about the suspicious nature of the content
Antivirus software
An application software deployed at multiple points in an IT architecture. It is designed to detect and potentially eliminate virus code before damage is done and repair or quarantine files that have already been
infected.
Application controls
The policies, procedures and activities designed to provide reasonable assurance that objectives relevant to a given automated solution (application) are achieved.
Application programming interface (API)
A set of routines, protocols and tools referred to as building blocks used in business application software
development
Application service provider (ASP)
Also known as managed service provider (MSP), it deploys, hosts and manages access to a packaged application to multiple parties from a centrally managed facility.
Architecture
Description of the fundamental underlying design of the components of the business system, or of one element of the business system (e.g., technology), the relationships among them, and the manner in which they support enterprise objectives
Asset inventory
A register that is used to record all relevant assets 24 Asset value The value of an asset to both the business and to competitors
Asset
Something of either tangible or intangible value that is worth protecting, including people, information, infrastructure, finances and reputation
Asymmetric key (public key)
A cipher technique in which different cryptographic keys are used to encrypt and decrypt a message
Attack vector
A path or route used by the adversary to gain access to the target (asset)
Audit trail
Data in the form of a logical path linking a sequence of events, used to trace the transactions that have affected the contents of a record
Authentication
The act of verifying the identity of a user, the user’s eligibility to access computerized information
Authorization
The process of determining if the end user is permitted to have access to an information asset or the information system containing the asset.
Availability
Ensuring timely and reliable access to and use of information
Authentication
The act of verifying identity, i.e., user, system
