C-GLOSSARY Flashcards
Capability Maturity Model Integration (CMMI)
Contains the essential elements of effective processes for one or more disciplines. It also describes an evolutionary improvement path from ad hoc, immature processes, to disciplined, mature processes, with improved quality and effectiveness.
Certificate (certification) authority (CA)
A trusted third party that serves authentication infrastructures or enterprises and registers entities and issues them certificates
Certificate revocation list (CRL)
An instrument for checking the continued validity of the certificates for which the certification authority (CA) has responsibility. The CRL details digital certificates that are no longer valid. The time gap between two
updates is very critical and is also a risk in digital certificates verification.
Certification practice statement
A detailed set of rules governing the certificate authority’s operations. It provides an understanding of the value and trustworthiness of certificates issued by a given certificate authority (CA).
Stated in terms of the controls that an organization observes, the method it uses to validate the authenticity of certificate applicants and the CA’s
expectations of how its certificates may be used.
Chain of custody
A legal principle regarding the validity and integrity of evidence. It requires accountability for anything that will be used as evidence in a legal proceeding to ensure that it can be accounted for from the time it was
collected until the time it is presented in a court of law. This includes documentation as to who had access to the evidence and when, as well as the ability to identify evidence as being the exact item that was recovered
or tested. Lack of control over evidence can lead to it being discredited.
Chain of custody depends on the ability to verify that evidence could not have been tampered with. This is accomplished by sealing off the evidence, so it cannot be changed, and providing a documentary record of
custody to prove that the evidence was, at all times, under strict control and not subject to tampering.
Chain of evidence
A process and record that shows who obtained the evidence, where and when the evidence was obtained, who secured the evidence, and who had control or possession of the evidence. The “sequencing” of the chain of evidence follows this order: collection and identification, analysis, storage, preservation, presentation in court, return to owner.
Challenge/response token
A method of user authentication that is carried out through use of the Challenge Handshake Authentication Protocol (CHAP). When a user tries
to log onto the server using CHAP, the server sends the user a “challenge,”which is a random value. The user enters a password, which is used as an encryption key to encrypt the “challenge” and return it to the server.
The server is aware of the password. It, therefore, encrypts the “challenge”value and compares it with the value received from the user. If the values
match, the user is authenticated. The challenge/response activity continues throughout the session and this protects the session from password
sniffing attacks. In addition, CHAP is not vulnerable to “man-in-the middle” attacks because the challenge value is a random value that changes on each access attempt.
Change management
A holistic and proactive approach to managing the transition from a current to a desired organizational state.
Checksum
A mathematical value that is assigned to a file and used to “test” the file at a later date to verify that the data contained in the file have not been maliciously changed.
A cryptographic checksum is created by performing a complicated series of mathematical operations (known as a cryptographic algorithm) that translates the data in the file into a fixed string of digits called a hash
value, which is then used as the checksum. Without knowing which cryptographic algorithm was used to create the hash value, it is highly unlikely that an unauthorized person would be able to change data without inadvertently changing the corresponding checksum.
Cryptographic checksums are used in data transmission and data storage. Cryptographic
checksums are also known as message authentication codes, integrity check values, modification detection codes or message integrity codes.
Chief information officer (CIO)
The most senior official of the enterprise who is accountable for IT advocacy, aligning IT and business strategies, and planning, resourcing and managing the delivery of IT services, information and the deployment
of associated human resources. In some cases, the CIO role has been expanded to become the chief knowledge officer (CKO) who deals in knowledge, not just information. Also see chief technology officer.
Chief information security officer (CISO)
Responsible for managing information risk, the information security program, and ensuring appropriate confidentiality, integrity and availability of information assets
Chief security officer (CSO)
Typically responsible for physical security in the organization although increasingly the CISO and CSO roles are merged.
Chief technology officer (CTO)
The individual who focuses on technical issues in an organization.
Cloud computing
An approach using external services for convenient on-demand IT operations using a shared pool of configurable computing capability.
Typical capabilities include :-
infrastructure as a service (IaaS),
platform asa service (PaaS)
software as a service (SaaS) (e.g., networks, servers,
storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
This cloud model is composed of five essential characteristics (on-demand self-service, ubiquitous network access, location independent resource
pooling, rapid elasticity, and measured service).
It allows users to access technology-based services from the network cloud without knowledge of, expertise with, or control over, the technology infrastructure that supports them and provides four models for enterprise access (private cloud,
community cloud, public cloud and hybrid cloud).
Common vulnerabilities and exposures (CVE)
A system that provides a reference method for publicly known information-security vulnerabilities and exposures.
MITRE Corporation maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland Security.
