A Flashcards
Access
A subject’s ability to view, modify, or communicate with an object. Access enables the flow of information between the subject and the object.
Access Control
Mechanisms, controls, and methods of limiting access to resources to authorized subjects only.
Access Control List (ACL)
A list of subjects that are authorized to access a particular object. Typically, the types of access are read, write, execute, append, modify, delete, and create.
Access Control Mechanism
Administrative, physical, or technical control that is designed to detect and prevent unauthorized access to a resource or environment.
Accountability
A security principle indicating that individuals must be held responsible for their actions.
Accredited
A computer system or network that has received official authorization and approval to process sensitive data in a specific operational environment. There must be a security evaluation of the system’s hardware, software, configurations, and controls by technical personnel.
Add-on security
Security protection mechanisms that are hardware or software retrofitted to a system to increase that system’s protection level.
Administrative controls
Security mechanisms that are management’s responsibility and referred to as “soft” controls. These controls include the development and publication of policies, standards, procedures, and guidelines; the screening of personnel; security-awareness training; the monitoring of system activity; and change control procedures.
Aggregation
The act of combining information from separate sources of a lower classification level that results in the creation of information of a higher classification level, which the subject does not have the necessary rights to access.
AIC/ CIA triad
The three security principles: availability, integrity, and confidentiality.
Annualized loss expectancy (ALE)
A dollar amount that estimates the loss potential from a risk in a span of a year. ~~~~~ Single Loss Expectancy (SLE) x Annualized rate of occurrence (ARO) = ALE
Antimalware
Software whose principal functions include the identification and mitigation of malware; also known as antivirus, although this term could be specific to only one type of malware.
Annualized rate of occurrence (ARO)
The value that represents the estimated possibility of a specific threat taking place within a one-year timeframe.
Assurance
A measurement of confidence in the level of protection that a specific security control delivers and the degree to which it enforces the security policy.
Attack
An attempt to bypass security controls in a system with the mission of using that system or compromising it. An attack is usually accomplished by exploiting a current vulnerability.
