Glossary Flashcards
acceptable interruption window
the maximum period of time that a system can be unavailable before compromising the achievement of the enterprise’s business objectives
acceptable use policy
a policy that establishes an agreement between users and the enterprise and defines for all parties’ the ranges of use that are approved before gaining access to a network or the Internet.
access control list (ACL)
an internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals. Also referred to as access control tables
access path
The logical route that an end user takes to access computerized information. Typically includes a route through the operating system, telecommunications software, selected application software and the access control system.
access rights
The permission or privileges granted to users, programs or workstations to create, change, delete or
view data and files within a system, as defined by rules established by data owners and the information
security policy.
accountability
the ability to map a given activity or event back to the responsibly party
advanced encryption standard (AES)
a public algorithm that supports keys from 128 bits to 256 bits in size.
advanced persistent threat (APT)
an adversary that possesses sophisticated levels of expertise and significant resources which allow it to create opportunities to achieve its objectives using multiple attack vectors.
The APT:
- Pursues its objectives repeatedly over an extended period of time
- Adapts to defenders’ efforts to resist it
- Is determined to maintain the level of interaction needed to execute its objectives
adware
a software package that automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used. This is usually done without any notification to the user or without the user’s consent. Some programs display ads as an alternative to shareware registration fees. These are advertising supported software, but not spyware.
Alert situation
The point in an emergency procedure when the elapsed time passes a threshold and the interruption is not resolved. The enterprise entering into an alert situation initiates a series of escalation steps.
Alternate facilities
Locations and infrastructures from which emergency or backup processes are executed, when the main premises are unavailable or destroyed; includes other buildings, offices or data processing centers.
Alternate process
Automatic or manual process designed and established to continue critical business processes
from point-of-failure to return-to- normal.
anti-malware
a technology widely used to prevent, detect and remove many categories of malware, including computer viruses, worms, Trojans, keyloggers, malicious browser plug-ins, adware, and spyware.
anti virus software
an application software deployed at multiple points in an IT architecture. It is designed to detect and potentially eliminate virus code before damage is done and repair or quarantine files that have already been infected
application layer
in the open system interconnection (OSI) communications model, the application layer provides services for an application program to ensure the effective communication with another application program in a network is possible. The application layer is not the application that is doing the communication; a service layer that provides these services.
Architecture
Description of the fundamental underlying design of the components of the business system, or of one element of the business system (technology) the relationships among them, and the manner in which they support enterprise objectives.
Asymmetric key ( public key)
A cipher technique in which different cryptographic keys are used to encrypt and decrypt a message.
Attack mechanism
A method used to deliver the payload. Unless the attacker is personally performing the attack, an attack mechanism may involve an exploit delivering a payload to the target.
Attack vector
A path or route used by the adversary to gain access to the target, asset. There are two types of attack vectors ingress and egress also known as data exfiltration.
Audit trail
A visible trail of evidence enabling one to trace information contained in statements or reports back to the original input source.
Authentication
The act of verifying the identity of a user and the users eligibility to access computerized information. Authentication is designed to protect against fraudulent logon activity. It can also refer to the verification of the correctness of a piece of data
Availability
Ensuring timely and reliable access to and use of information
Back door
A means of regaining access to a compromise system by installing software or Configuring existing software to enable remote access under attack or to find conditions.
Bastion
System heavily fortified against attacks
Biometrics
A security technique that verifies an individuals identity by analyzing a unique physical attributes such as a handprint.
Block cipher
A public algorithm that operates on plain text in blocks of bits.
Botnet
A term derived from robot network, is a large automated and distributed network of previously compromised computers that can be simultaneously controlled to launch large scale attacks such as a denial of service attack on selective victims.
Boundary
Logical and physical controls to find a perimeter between the organization and the outside world.
Bridges
Data link layer devices developed in the early 1980s to connect local area network’s or create two separate local area network’s or wide area network segments from a single segment to reduce collision domains. Bridges act as store and forward devices in moving frames toward their destination. This is achieved by analyzing the media access control header of a data packet which represents the hardware address of a NIC.
Brute force attack
Repeatedly trying all possible combinations of passwords or encryption keys until the correct one is found.
Buffer overflow
Occurs when a program or process tries to store more data in a buffer, temporary data storage error, then it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information- which has to go somewhere -can overflow into adjacent buffers, corrupting or overriding the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an
increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user’s files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices
supplied the vulnerability.
Business continuity plan BCP
A plan used by an enterprise to respond to disruption of critical business processes. Depends on the contingency plan for restoration of critical systems.
Business impact analysis/assessment BIA
Evaluating the criticality and sensitivity of information assets. An exercise that determines the impact of losing the support of any resources to an enterprise, establishes the escalation of that loss overtime, identifies the minimum resources needed to recover, and prioritizes the recovery of processes and the supporting system. This process also includes addressing income loss, unexpected expense, legal issues, interdependent processes, and loss of public reputation or public confidence.
Certificate authority CA
A trusted third-party that serves authentication infrastructure or enterprises and registers entities and issues them certificates
Certificate revocation list CRL
An instrument for checking the continued validity of the certificates for which the certification authority has responsibility. The CRL details digital certificates that are no longer valid. The time gap between two updates is very critical and is also a risk in digital certificates verification.
Checksum
A mathematical value that is assigned to a file and used to “test” the file at a later date to verify that the data contained in the file has not been maliciously changed. A cryptographic checksum is created by performing a complicated series of mathematical operations (known as a cryptographic algorithm) that translates the data in the file into a fixed string of digits called a hash value, which is then used as the checksum. Without knowing which cryptographic algorithm was used to create the hash value, it is highly unlikely that an unauthorized person would be able to change data without inadvertently changing the corresponding checksum. Cryptographic checksums are used in data transmission and data storage. Cryptographic checksums are also known as message authentication codes, integrity check-values, modification detection codes or message integrity codes.
Chief Information Security Officer (CISO)
person in charge of information security within the enterprise
chief security officer (CSO)
person usually responsible for all security matters both physical and digital in enterprise
cipher
an algorithm to perform encryption
ciphertext
information generated by an encryption algorithm to protect the plaintext and that is unintelligible to the unauthorized reader
clear text
data not encrypted also known as plain text
cloud computing
Convenient, on-demand network access to a shared pool of resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.
collision
The situation that occurs when two or more demands are made simultaneously on equipment that can
handle only one at any given instant
Common attack pattern enumeration and classification (CAPEC)
A catalogue of attack patterns as “an abstraction mechanism for helping describe how an attack against vulnerable systems or networks is executed”published by the MITRE Corporation.
Compartmentalization
A process for protecting very high value assets or in environments where trust is an issue. Access to an asset requires two or more processes, controls or individuals
Compliance
Adherence to, and the ability to demonstrate adherence to, mandated requirements defined by laws and regulations, as well as voluntary requirements resulting from contractual obligations and internal policies.
Compliance documents
Policies, standard and procedures that document the actions that are required or prohibited. Violations may be subject to disciplinary actions.
Computer emergency response team (CERT)
A group of people integrated at the enterprise with clear lines of reporting and responsibilities for standby support in case of an information systems emergency. This group will act as an efficient corrective control, and should also act as a single point of contact for all incidents and issues related to information systems.
Confidentiality
Preserving authorized restrictions on access and disclosure, including means for protecting privacy and proprietary information.
Configuration management
The control of changes to a set of configuration items over a system life cycle.
Consumerization
A new model in which emerging technologies are first embraced by the consumer market and later spread to the business.
Containment
Actions taken to limit exposure after an incident has been identified and confirmed.
Content filtering
Controlling access to a network by analyzing the contents of the incoming and outgoing packets and either letting them pass or denying them based on a list of rules. Differs from packet filtering in that it is the data in the packet that are analyzed instead of the attributes of the packet itself (e.g., source/target IP address, transmission control protocol [TCP] flags).
Control
The means of managing risk, including policies, procedures, guidelines, practices or organizational structures, which can be of an administrative, technical, management, or legal nature. Also used as a synonym for safeguard or countermeasure.
Critical infrastructure
Systems whose incapacity or destruction would have a debilitating effect on the economic security of an enterprise, community or nation.
Criticality
The importance of a particular asset or function to the enterprise, and the impact if that asset or function is not available.
Criticality analysis
An analysis to evaluate resources or business functions to identify their importance to the enterprise, and the impact if a function cannot be completed or a resource is not available.
Cross-site scripting (XSS)—
A type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. (OWASP)
Cryptosystem—
A pair of algorithms that take a key and convert plaintext to ciphertext and back.
Cyberespionage—
Activities conducted in the name of security, business, politics or technology to find information
that ought to remain secret. It is not inherently military.
Cybersecurity—
The protection of information assets by addressing threats to information processed, stored, and
transported by internetworked information systems.
Cybersecurity architecture—
Describes the structure, components and topology (connections and layout) of
security controls within an enterprise’s IT infrastructure. The security architecture shows how defense in depth is
implemented and how layers of control are linked and is essential to designing and implementing security controls in
any complex environment
Cyberwarfare
Activities supported by military organizations with the purpose to threat the survival and well-being
of society/foreign entity
Data classification—
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification. Levels of sensitivity of data are assigned according to predefined categories as data are created, amended, enhanced, stored or transmitted. The classification level is an indication of the value or importance of the data to the enterprise.
Data custodian—
The individual(s) and department(s) responsible for the storage and safeguarding of computerized data.
Data Encryption Standard (DES)—
An algorithm for encoding binary data. It is a secret key cryptosystem
published by the National Bureau of Standards (NBS), the predecessor of the US National Institute of Standards and
Technology (NIST). DES and its variants has been replaced by the Advanced Encryption Standard (AES).
Data leakage—
Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes.
Data retention—
Refers to the policies that govern data and records management for meeting internal, legal and
regulatory data archival requirements.
Decentralization—
The process of distributing computer processing to different locations within an enterprise.
Defense in depth—
The practice of layering defenses to provide added protection. Defense in depth increases security by raising the effort needed in an attack. This strategy places multiple barriers between an attacker and an enterprise’s computing and information resources.
Demilitarized zone (DMZ)—
A screened (firewalled) network segment that acts as a buffer zone between a trusted and untrusted network. A DMZ is typically used to house systems such as web servers that must be accessible from both internal networks and the Internet.
Denial-of-service (DoS) attack—
An assault on a service from a single source that floods it with so many requests
that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate.
Digital certificate—
A piece of information, a digitized form of signature, that provides sender authenticity, message integrity and nonrepudiation. A digital signature is generated using the sender’s private key or applying a one-way hash function.
Digital forensics—
The process of identifying, preserving, analyzing and presenting digital evidence in a manner that
is legally acceptable in any legal proceedings.
Digital signature—
A piece of information, a digitized form of signature, that provides sender authenticity, message integrity and nonrepudiation. A digital signature is generated using the sender’s private key or applying a one-way
hash function.
Disaster recovery plan (DRP)—
A set of human, physical, technical and procedural resources to recover, within a defined time and cost, an activity interrupted by an emergency or disaster.
Discretionary access control (DAC)—
A means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject.
Domain name system (DNS)—
A hierarchical database that is distributed across the Internet that allows names to be resolved into IP addresses (and vice versa) to locate services such as web and email servers.
Domain name system (DNS) exfiltration—
Tunneling over DNS to gain network access. Lower-level attack vector
for simple to complex data transmission, slow but difficult to detect.
Due care—
The level of care expected from a reasonable person of similar competency under similar conditions.
Due diligence—
The performance of those actions that are generally regarded as prudent, responsible and necessary to conduct a thorough and objective investigation, review and/or analysis.
Dynamic ports—
Dynamic and/or private ports–49152 through 65535: Not listed by IANA because of their dynamic
nature.
Egress—
Network communications going out.
Elliptical curve cryptography (ECC)—
An algorithm that combines plane geometry with algebra to achieve stronger
authentication with smaller keys compared to traditional methods, such as RSA, which primarily use algebraic
factoring. Smaller keys are more suitable to mobile devices.
Encapsulation security payload (ESP)—
Protocol, which is designed to provide a mix of security services in IPv4 and IPv6. ESP can be used to provide confidentiality, data origin authentication, connectionless integrity, an
anti-replay service (a form of partial sequence integrity), and (limited) traffic flow confidentiality (RFC 4303). The
ESP header is inserted after the IP header and before the next layer protocol header (transport mode) or before an
encapsulated IP header (tunnel mode).
Encryption—
The process of taking an unencrypted message (plaintext), applying a mathematical function to it
(encryption algorithm with a key) and producing an encrypted message (ciphertext).
Encryption algorithm—
A mathematically based function or calculation that encrypts/decrypts data
Encryption key—
A piece of information, in a digitized form, used by an encryption algorithm to convert the
plaintext to the ciphertext.
Eradication—
When containment measures have been deployed after an incident occurs, the root cause of the
incident must be identified and removed from the network. Eradication methods include: restoring backups to
achieve a clean state of the system, removing the root cause, improving defenses and performing vulnerability
analysis to find further potential damage from the same root cause.
Ethernet—
A popular network protocol and cabling scheme that uses a bus topology and carrier sense multiple
access/collision detection (CSMA/CD) to prevent network failures or collisions when two devices try to access the
network at the same time.
Evidence—
Information that proves or disproves a stated issue. Information that an auditor gathers in the course of
performing an IS audit; relevant if it pertains to the audit objectives and has a logical relationship to the findings and
conclusions it is used to support.
Exploit—
Full use of a vulnerability for the benefit of an attacker
File transfer protocol (FTP)—
A protocol used to transfer files over a Transmission Control Protocol/ Internet
Protocol (TCP/IP) network (Internet, UNIX, etc.).
Firewall—
A system or combination of systems that enforces a boundary between two or more networks, typically
forming a barrier between a secure and an open environment such as the Internet.
Forensic examination—
The process of collecting, assessing, classifying and documenting digital evidence to assist
in the identification of an offender and the method of compromise.
Gateway—
A device (router, firewall) on a network that serves as an entrance to another network.
Governance—
Ensures that stakeholder needs, conditions and options are evaluated to determine balanced, agreedon enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring
performance and compliance against agreed-on direction and objectives. Conditions can include the cost of capital,
foreign exchange rates, etc. Options can include shifting manufacturing to other locations, subcontracting portions of
the enterprise to third parties, selecting a product mix from many available choices, etc.
Governance, Risk Management and Compliance (GRC)—
A business term used to group the three close-related
disciplines responsible for the protection of assets and operations.
Guideline—
A description of a particular way of accomplishing something that is less prescriptive than a procedure
Hacker—
An individual who attempts to gain unauthorized access to a computer system.
Hash function—
An algorithm that maps or translates one set of bits into another (generally smaller) so that a
message yields the same result every time the algorithm is executed using the same message as input. It is
computationally infeasible for a message to be derived or reconstituted from the result produced by the algorithm or
to find two different messages that produce the same hash result using the same algorithm.
Hash total—
The total of any numeric data field in a document or computer file. This total is checked against a
control total of the same field to facilitate accuracy of processing.
Hashing—
Using a hash function (algorithm) to create hash valued or checksums that validate message integrity.
Hijacking—
An exploitation of a valid network session for unauthorized purposes.
Honeypot—
A specially configured server, also known as a decoy server, designed to attract and monitor intruders in
a manner such that their actions do not affect production systems. Also known as “decoy server.”
Horizontal defense in depth—
Controls are placed in various places in the path to access an asset.
Hubs—
A common connection point for devices in a network, hubs are used to connect segments of a local area
network (LAN). A hub contains multiple ports. When a packet arrives at one port, it is copied to the other ports so
that all segments of the LAN can see all packets.
Human firewall—
A person prepared to act as a network layer of defense through education and awareness.
Hypertext Transfer protocol (HTTP)—
A communication protocol used to connect to servers on the World Wide
Web. Its primary function is to establish a connection with a web server and transmit hypertext markup language
(HTML), extensible markup language (XML) or other pages to client browsers.
IEEE (Institute of Electrical and Electronics Engineers)—
Pronounced I-triple-E; an organization composed of
engineers, scientists and students. Best known for developing standards for the computer and electronics industry.
IEEE 802.11—
A family of specifications developed by the Institute of Electrical and Electronics Engineers (IEEE)
for wireless local area network (WLAN) technology. 802.11 specifies an over-the- air interface between a wireless
client and a base station or between two wireless clients.
Imaging—
A process that allows one to obtain a bit-for-bit copy of data to avoid damage of original data or
information when multiple analyses may be performed. The imaging process is made to obtain residual data, such
as deleted files, fragments of deleted files and other information present, from the disk for analysis. This is possible
because imaging duplicates the disk surface, sector by sector.
Impact—
Magnitude of loss resulting from a threat exploiting a vulnerability.
Impact analysis—
A study to prioritize the criticality of information resources for the enterprise based on costs (or
consequences) of adverse events. In an impact analysis, threats to assets are identified and potential business losses
determined for different time periods. This assessment is used to justify the extent of safeguards that are required and
recovery time frames. This analysis is the basis for establishing the recovery strategy.
Incident—
Any event that is not part of the standard operation of a service and that causes, or may cause, an
interruption to, or a reduction in, the quality of that service.
Incident response—
The response of an enterprise to a disaster or other significant event that may significantly affect
the enterprise, its people, or its ability to function productively. An incident response may include evacuation of a
facility, initiating a disaster recovery plan (DRP), performing damage assessment, and any other measures necessary
to bring an enterprise to a more stable status.
Incident response plan—
The operational component of incident management. The plan includes documented
procedures and guidelines for defining the criticality of incidents, reporting and escalation process, and recovery
procedures
Information security—
Ensures that within the enterprise, information is protected against disclosure to unauthorized
users (confidentiality), improper modification (integrity), and nonaccess when required (availability).
Information security program—
The overall combination of technical, operational and procedural measures and
management structures implemented to provide for the confidentiality, integrity and availability of information based
on business requirements and risk analysis.
Information systems (IS)—
The combination of strategic, managerial and operational activities involved in
gathering, processing, storing, distributing and using information and its related technologies.
Information systems are distinct from information technology (IT) in that an information system has an IT
component that interacts with the process components.
Infrastructure as a Service (IaaS)—
Offers the capability to provision processing, storage, networks and other
fundamental computing resources, enabling the customer to deploy and run arbitrary software, which can include
operating systems (OSs) and applications.
Ingestion—
A process to convert information extracted to a format that can be understood by investigators. See also
Normalization.
Ingress—
Network communications coming in.
Inherent risk—
The risk level or exposure without taking into account the actions that management has taken or might take (e.g., implementing controls).
Injection—
A general term for attack types which consist of injecting code that is then interpreted/ executed by the
application (OWASP).
Integrity—
The guarding against improper information modification or destruction, and includes ensuring
information nonrepudiation and authenticity.
International Standards organization (ISO)—
The world’s largest developer of voluntary International Standards.
Internet Assigned Numbers Authority (IANA)—
Responsible for the global coordination of the DNS root, IP
addressing, and other Internet protocol resources.
Internet Control Message Protocol (ICMP)—
A set of protocols that allow systems to communicate information about the state of services on other systems. For example, ICMP is used in determining whether systems are up, maximum packet sizes on links, whether a destination host/network/port is available. Hackers typically use (abuse) ICMP to determine information about the remote site.
Internet protocol (IP)—
Specifies the format of packets and the addressing scheme.
Internet protocol (IP) packet spoofing—
An attack using packets with the spoofed source Internet packet (IP)
addresses. This technique exploits applications that use authentication based on IP addresses. This technique also
may enable an unauthorized user to gain root access on the target system.
Internet service provider (ISP)—
A third party that provides individuals and enterprises with access to the Internet and a variety of other Internet-related services.
Internetwork packet Exchange/Sequenced packet Exchange (IPX/SPX)—
IPX is Layer 3 of the open systems
interconnect (OSI) model network protocol; SPX is Layer 4 transport protocol. The SPX layer sits on top of the IPX
layer and provides connection- oriented services between two nodes on the network.
Intrusion detection—
The process of monitoring the events occurring in a computer system or network to detect
signs of unauthorized access or attack.
Intrusion detection system (IDS)—
Inspects network and host security activity to identify suspicious patterns that may indicate a network or system attack.
Intrusion prevention—
A preemptive approach to network security used to identify potential threats and respond to them to stop, or at least limit, damage or disruption.
