Glossary Flashcards
1
Q
Acceptable risk
A
A suitable level of risk commensurate with the potential benefits of the organization’s operations as determined by senior management.
2
Q
Access control system
A
Means to ensure that access to assets is authorized and restricted based on business and security requirements related to logical and physical systems.
3
Q
Access control tokens
A
The system decides if access is to be granted or denied based upon the validity of the token for the point where it is read based on time, date, day, holiday, or other condition used for controlling validation.
4
Q
Accountability
A
Accountability ensures that account management has assurance that only authorized users are accessing the system and using it properly.
5
Q
ActiveX Data Objects (ADO)
A
A Microsoft high-level interface for all kinds of data.
6
Q
Address Resolution Protocol (ARP)
A
Is used at the Media Access Control (MAC) Layer to provide for direct communication between two devices within the same LAN segment.
7
Q
Algorithm
A
A mathematical function that is used in the encryption and decryption processes.
8
Q
Asset
A
An item perceived as having value.
9
Q
Asset lifecycle
A
The phases that an asset goes through from creation (collection) to destruction.
10
Q
Asymmetric
A
Not identical on both sides. In cryptography, key pairs are used, one to encrypt, the other to decrypt.
11
Q
Attack surface
A
Different security testing methods find different vulnerability types.
12
Q
Attribute-based access control (ABAC)
A
This is an access control paradigm whereby access rights are granted to users with policies that combine attributes together.
13
Q
Audit/auditing
A
The tools, processes, and activities used to perform compliance reviews.
14
Q
Authorization
A
The process of defining the specific resources a user needs and determining the type of access to those resources the user may have.
15
Q
Availability
A
Ensuring timely and reliable access to and use of information by authorized users.
16
Q
Baselines
A
A minimum level of security.
17
Q
Bit
A
Most essential representation of data (zero or one) at Layer 1 of the Open Systems Interconnection (OSI) model.
18
Q
Black-box testing
A
Testing where no internal details of the system implementation are used.
19
Q
Bluetooth (Wireless Personal Area Network IEEE 802.15)
A
Bluetooth wireless technology is an open standard for short-range radio frequency communication used primarily to establish wireless personal area networks (WPANs), and it has been integrated into many types of business and consumer devices.
20
Q
Bridges
A
Layer 2 devices that filter traffic between segments based on Media Access Control (MAC) addresses.
21
Q
Business continuity (BC)
A
Actions, processes, and tools for ensuring an organization can continue critical operations during a contingency.
22
Q
Business continuity and disaster recovery (BCDR)
A
A term used to jointly describe business continuity and disaster recovery efforts.
23
Q
Business impact analysis (BIA)
A
A list of the organization’s assets, annotated to reflect the criticality of each asset to the organization.
24
Q
Capability Maturity Model for Software or Software Capability Maturity Model (CMM or SW-CMM)
A
Maturity model focused on quality management processes and has five maturity levels that contain several key practices within each maturity level.
25
Cellular Network
A radio network distributed over land areas called cells, each served by at least one fixed-location transceiver, known as a cell site or base station.
26
Certificate authority (CA)
An entity trusted by one or more users as an authority that issues, revokes, and manages digital certificates to bind individuals and entities to their public keys.
27
Change management
A formal, methodical, comprehensive process for requesting, reviewing, and approving changes to the baseline of the IT environment.
28
CIA/AIC Triad
Security model with the three security concepts of confidentiality, integrity, and availability make up the CIA Triad. It is also sometimes referred to as the AIC Triad.
29
Ciphertext
The altered form of a plaintext message, so as to be unreadable for anyone except the intended recipients. Something that has been turned into a secret.
30
Classification
Arrangement of assets into categories.
31
Clearing
The removal of sensitive data from storage devices in such a way that there is assurance that the data may not be reconstructed using normal system functions or software recovery utilities.
32
Code-division multiple access (CDMA)
Every call’s data is encoded with a unique key, then the calls are all transmitted at once.
33
Common Object Request Broker Architecture (CORBA)
A set of standards that addresses the need for interoperability between hardware and software products.
34
Compliance
Adherence to a mandate; both the actions demonstrating adherence and the tools, processes, and documentation that are used in adherence.
35
Computer virus
A program written with functions and intent to copy and disperse itself without the knowledge and cooperation of the owner or user of the computer.
36
Concentrators
Multiplex connected devices into one signal to be transmitted on a network.
37
Condition coverage
This criterion requires sufficient test cases for each condition in a program decision to take on all possible outcomes at least once. It differs from branch coverage only when multiple conditions must be evaluated to reach a decision.
38
Confidentiality
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
39
Configuration management (CM)
A formal, methodical, comprehensive process for establishing a baseline of the IT environment (and each of the assets within that environment).
40
Confusion
Provided by mixing (changing) the key values used during the repeated rounds of encryption. When the key is modified for each round, it provides added complexity that the attacker would encounter.
41
Content Distribution Network (CDN)
Is a large distributed system of servers deployed in multiple data centers across the internet.
42
Covert channel
An information flow that is not controlled by a security control and has the opportunity of disclosing confidential information.
43
Covert security testing
Performed to simulate the threats that are associated with external adversaries. While the security staff has no knowledge of the covert test, the organization management is fully aware and consents to the test.
44
Crossover Error Rate (CER)
This is achieved when the type I and type II are equal.
45
Cryptanalysis
The study of techniques for attempting to defeat cryptographic techniques and, more generally, information security services provided through cryptography.
46
Cryptography
Secret writing. Today provides the ability to achieve confidentiality, integrity, authenticity, non-repudiation, and access control.
47
Cryptology
The science that deals with hidden, disguised, or encrypted information and communications.
48
Curie Temperature
The critical point where a material’s intrinsic magnetic alignment changes direction.
49
Custodian
Responsible for protecting an asset that has value, while in the custodian’s possession.
50
Data classification
Entails analyzing the data that the organization retains, determining its importance and value, and then assigning it to a category.
51
Data custodian
The person/role within the organization who usually manages the data on a day-to-day basis on behalf of the data owner/controller.
52
Data flow coverage
This criteria requires sufficient test cases for each feasible data flow to be executed at least once.
53
Data mining
A decision-making technique that is based on a series of analytical techniques taken from the fields of mathematics, statistics, cybernetics, and genetics.
54
Data owner/ controller
An entity that collects or creates PII.
55
Data subject
The individual human related to a set of personal data.
56
Database Management System (DBMS)
A suite of application programs that typically manages large, structured sets of persistent data.
57
Database model
Describes the relationship between the data elements and provides a framework for organizing the data.
58
Decision (branch) coverage
Considered to be a minimum level of coverage for most software products, but decision coverage alone is insufficient for high-integrity applications.
59
Decryption
The reverse process from encryption. It is the process of converting a ciphertext message back into plaintext through the use of the cryptographic algorithm and the appropriate key that was used to do the original encryption.
60
Defensible destruction
Eliminating data using a controlled, legally defensible, and regulatory compliant way.
61
DevOps
An approach based on lean and agile principles in which business owners and the development, operations, and quality assurance departments collaborate.
62
Diffusion
Provided by mixing up the location of the plaintext throughout the ciphertext. The strongest algorithms exhibit a high degree of confusion and diffusion.
63
Digital certificate
An electronic document that contains the name of an organization or individual, the business address, the digital signature of the certificate authority issuing the certificate, the certificate holder’s public key, a serial number, and the expiration date. Used to bind individuals and entities to their public keys. Issued by a trusted third party referred to as a Certificate Authority (CA).
64
Digital rights management (DRM)
A broad range of technologies that grant control and protection to content providers over their own digital media. May use cryptography techniques.
65
Digital signatures
Provide authentication of a sender and integrity of a sender’s message and non-repudiation services.
66
Disaster recovery (DR)
Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations.
67
Digital rights management (DRM)
A broad range of technologies that grant control and protection to content providers over their own digital media. May use cryptography techniques.
68
Digital signatures
Provide authentication of a sender and integrity of a sender’s message and non-repudiation services.
69
Disaster recovery (DR)
Those tasks and activities required to bring an organization back from contingency operations and reinstate regular operations.
70
Discretionary access control (DAC)
The system owner decides who gets access.
71
Due care
A legal concept pertaining to the duty owed by a provider to a customer.
72
Due diligence
Actions taken by a vendor to demonstrate/ provide due care.
73
Dynamic or Private Ports
Ports 49152–65535. Whenever a service is requested that is associated with Well-Known or Registered Ports those services will respond with a dynamic port.
74
Dynamic testing
When the system under test is executed and its behavior is observed.
75
Encoding
The action of changing a message into another format through the use of a code.
76
Encryption
The process of converting the message from its plaintext to ciphertext.
77
False Acceptance Rate (Type II)
This is erroneous recognition either by confusing one user with another, or by accepting an imposter as a legitimate user.
78
False Rejection Rate (Type I)
This is failure to recognize a legitimate user.
79
Fibre Channel over Ethernet (FCoE)
A lightweight encapsulation protocol, and it lacks the reliable data transport of the TCP layer.
80
Firewalls
Devices that enforce administrative security policies by filtering incoming traffic based on a set of rules.
81
Frame
Data represented at Layer 2 of the Open Systems Interconnection (OSI) model.
82
Global System for Mobiles (GSM)
Each call is transformed into digital data that is given a channel and a time slot.
83
Governance
The process of how an organization is managed; usually includes all aspects of how decisions are made for that organization, such as policies, roles, and procedures the organization uses to make those decisions.
84
Governance committee
A formal body of personnel who determine how decisions will be made within the organization and the entity that can approve changes and exceptions to current relevant governance.
85
Guidelines
Suggested practices and expectations of activity to best accomplish tasks and attain goals.
86
Hash function
Accepts an input message of any length and generates, through a one-way operation, a fixed-length output called a message digest or hash.
87
Honeypots/honeynets
Machines that exist on the network, but do not contain sensitive or valuable data, and are meant to distract and occupy malicious or unauthorized intruders, as a means of delaying their attempts to access production data/assets. A number of machines of this kind, linked together as a network or subnet, are referred to as a “honeynet.”
88
Identity as a service (IDaaS)
Cloud-based services that broker identity and access management (IAM) functions to target systems on customers’ premises and/or in the cloud.
89
Identity proofing
The process of collecting and verifying information about a person for the purpose of proving that a person who has requested an account, a credential, or other special privilege is indeed who he or she claims to be and establishing a reliable relationship that can be trusted electronically between the individual and said credential for purposes of electronic authentication.
90
Initialization vector (IV)
A non-secret binary vector used as the initializing input algorithm, or a random starting point, for the encryption of a plaintext block sequence to increase security by introducing additional cryptographic variance and to synchronize cryptographic equipment.
91
Integrated Process and Product Development (IPPD)
A management technique that simultaneously integrates all essential acquisition activities through the use of multidisciplinary teams to optimize the design, manufacturing, and supportability processes.
92
Integrity
Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity.
93
Intellectual property
Intangible assets (notably includes software and data).
94
Internet Control Message Protocol (ICMP)
Provides a means to send error messages and a way to probe the network to determine network availability.
95
Internet Protocol (IPv4)
Is the dominant protocol that operates at the Open Systems Interconnection (OSI) Network Layer 3. IP is responsible for addressing packets so that they can be transmitted from the source to the destination hosts.
96
Internet Protocol (IPv6)
Is a modernization of IPv4 that includes a much larger address field: IPv6 addresses are 128 bits that support 2128 hosts.
97
Intrusion detection system (IDS)
A solution that monitors the environment and automatically recognizes malicious attempts to gain unauthorized access.
98
Intrusion prevention system (IPS)
A solution that monitors the environment and automatically takes action when it recognizes malicious attempts to gain unauthorized access.
99
Inventory
Complete list of items.
100
Job rotation
The practice of having personnel become familiar with multiple positions within the organization as a means to reduce single points of failure and to better detect insider threats.
101
Key Clustering
When different encryption keys generate the same ciphertext from the same plaintext message.
102
Key Length
The size of a key, usually measured in bits, that a cryptographic algorithm uses in ciphering or deciphering protected information.
103
Key or Cryptovariable
The input that controls the operation of the cryptographic algorithm. It determines the behavior of the algorithm and permits the reliable encryption and decryption of the message.
104
Knowledge Discovery in Databases (KDD)
A mathematical, statistical, and visualization method of identifying valid and useful patterns in data.
105
Least privilege
The practice of only granting a user the minimal permissions necessary to perform their explicit job function.
106
Lifecycle
Phases that an asset goes through from creation to destruction.
107
Log
A record of actions and events that have taken place on a computer system.
108
Logical access control system
Non-physical system that allows access based upon pre-determined policies.
109
Loop coverage
This criterion requires sufficient test cases for all program loops to be executed for zero, one, two, and many iterations covering initialization, typical running, and termination (boundary) conditions.
110
Mandatory access controls (MAC)
Access control that requires the system itself to manage access controls in accordance with the organization’s security policies.
111
Maximum allowable downtime (MAD)
The measure of how long an organization can survive an interruption of critical functions.[also known as maximum tolerable downtime (MTD)]
112
Media
Any object that contains data.
113
Message authentication code (MAC)
A small block of data that is generated using a secret key and then appended to the message, used to address integrity.
114
Message digest
A small representation of a larger message. Message digests are used to ensure the authentication and integrity of information, not the confidentiality.
115
Metadata
Information about the data.
116
Misuse case
A use case from the point of view of an actor hostile to the system under design.
117
Multi-condition coverage
These criteria require sufficient test cases to exercise all possible combinations of conditions in a program decision.
118
Multi-factor authentication
Ensures that a user is who he or she claims to be. The more factors used to determine a person’s identity, the greater the trust of authenticity.
119
Multiprotocol Label Switching (MPLS)
Is a wide area networking protocol that operates at both Layer2 and 3 and does label switching.
120
Need-to-know
Primarily associated with organizations that assign clearance levels to all users and classification levels to all assets; restricts users with the same clearance level from sharing information unless they are working on the same effort. Entails compartmentalization.
121
Negative testing
This ensures the application can gracefully handle invalid input or unexpected user behavior.
122
Network Function Virtualization (NFV)
The objective of NFV is to decouple functions such as firewall management, intrusion detection, network address translation, or name service resolution away from specific hardware implementation into software solutions.
123
Non-repudiation
Inability to deny. In cryptography, a service that ensures the sender cannot deny a message was sent and the integrity of the message is intact, and the receiver cannot claim receiving a different message.
124
Null cipher
Hiding plaintext within other plaintext. A form of steganography.
125
Open Authorization (OAuth)
The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.
126
Open Shortest Path First (OSPF)
An interior gateway routing protocol developed for IP networks based on the shortest path first or link-state algorithm.
127
OSI Layer 1
Physical layer.
128
OSI Layer 2
Data-link layer.
129
OSI Layer 3
Network layer.
130
OSI Layer 4
Transport layer.
131
OSI Layer 5
Session layer.
132
OSI Layer 6
Presentation layer.
133
OSI Layer 7
Application layer.
134
Overt security testing
Overt testing can be used with both internal and external testing. When used from an internal perspective, the bad actor simulated is an employee of the organization. The organization’s IT staff is made aware of the testing and can assist the assessor in limiting the impact of the test by providing specific guidelines for the test scope and parameters.
135
Ownership
Possessing something, usually of value.
136
Packet
Representation of data at Layer 3 of the Open Systems Interconnection (OSI) model.
137
Packet Loss
A technique called Packet Loss Concealment (PLC) is used in VoIP communications to mask the effect of dropped packets.
138
Parity bits
RAID technique; logical mechanism used to mark striped data; allows recovery of missing drive(s) by pulling data from adjacent drives.
139
Patch
An update/fix for an IT asset.
140
Path coverage
This criteria require sufficient test cases for each feasible path, basis path, etc., from start to exit of a defined program segment, to be executed at least once.
141
Personally identifiable information (PII)
Any data about a human being that could be used to identify that person.
142
Physical access control system
An automated system that manages the passage of people or assets through an opening(s) in a secure perimeter(s) based on a set of authorization rules.
143
Ping of Death
Exceeds maximum packet size and causes receiving system to fail.
144
Ping Scanning
Network mapping technique to detect if host replies to a ping, then the attacker knows that a host exists at that address.
145
Plaintext
The message in its natural format has not been turned into a secret.
146
Point-to-Point Protocol (PPP)
Provides a standard method for transporting multiprotocol datagrams over point-to-point links.
147
Policy
Documents published and promulgated by senior management dictating and describing the organization’s strategic goals.
148
Port Address Translation (PAT)
An extension to NAT to translate all addresses to one routable IP address and translate the source port number in the packet to a unique value.
149
Positive testing
This determines that your application works as expected.
150
Privacy
The right of a human individual to control the distribution of information about him- or herself.
151
Procedures
Explicit, repeatable activities to accomplish a specific task. Procedures can address one-time or infrequent actions or common, regular occurrences.
152
Purging
The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique.
153
Qualitative
Measuring something without using numbers, using adjectives, scales, and grades, etc.
154
Quantitative
Using numbers to measure something, usually monetary values.
155
Real user monitoring (RUM)
An approach to web monitoring that aims to capture and analyze every transaction of every user of a website or application.
156
Recovery point objective (RPO)
A measure of how much data the organization can lose before the organization is no longer viable.
157
Recovery time objective (RTO)
The target time set for recovering from any interruption.
158
Registered Ports
Ports 1024–49151. These ports typically accompany non-system applications associated with vendors and developers.
159
Registration authority (RA)
This performs certificate registration services on behalf of a Certificate Authority (CA).
160
Remanence
Residual magnetism left behind.
161
Residual risk
The risk remaining after security controls have been put in place as a means of risk mitigation.
162
Resources
Assets of an organization that can be used effectively.
163
Responsibility
Obligation for doing something. Can be delegated.
164
Risk
The possibility of damage or harm and the likelihood that damage or harm will be realized.
165
Risk acceptance
Determining that the potential benefits of a business function outweigh the possible risk impact/likelihood and performing that business function with no other action.
166
Risk avoidance
Determining that the impact and/or likelihood of a specific risk is too great to be offset by the potential benefits and not performing a certain business function because of that determination.
167
Risk mitigation
Putting security controls in place to attenuate the possible impact and/or likelihood of a specific risk.
168
Risk transference
Paying an external party to accept the financial impact of a given risk.
169
Role-based access control (RBAC)
An access control model that bases the access control authorizations on the roles (or functions) that the user is assigned within an organization.
170
Rule-based access control (RBAC)
An access control model that is based on a list of predefined rules that determine what accesses should be granted.
171
Sandbox
An isolated test environment that simulates the production environment but will not affect production components/data.
172
Security Assertion Markup Language 2.0 (SAML 2.0)
A version of the SAML standard for exchanging authentication and authorization data between security domains.
173
Security control framework
A notional construct outlining the organization’s approach to security, including a list of specific security processes, procedures, and solutions used by the organization.
174
Security governance
The entirety of the policies, roles, and processes the organization uses to make security decisions in an organization.
175
Segment
Data representation at Layer 4 of the Open Systems Interconnection (OSI) model.
176
Separation of duties
The practice of ensuring that no organizational process can be completed by a single person; forces collusion as a means to reduce insider threats.
177
Session Initiation Protocol (SIP)
Is designed to manage multimedia connections.
178
Single factor authentication
Involves the use of simply one of the three available factors solely to carry out the authentication process being requested.
179
Smurf
ICMP Echo Request sent to the network broadcast address of a spoofed victim causing all nodes to respond to the victim with an Echo Reply.
180
Software assurance
The level of confidence that software is free from vulnerabilities either intentionally designed into the software or accidentally inserted at any time during its lifecycle and that it functions in the intended manner.
181
Software-defined networks (SDNs)
Separates network systems into three components: raw data, how the data is sent, and what purpose the data serves. This involves a focus on data, control, and application (management) functions or “planes”.
182
Software Defined Wide Area Network (SD-WAN)
Is an extension of the SDN practices to connect to entities spread across the internet to support WAN architecture especially related to cloud migration.
183
Standards
Specific mandates explicitly stating expectations of performance or conformance.
184
Statement coverage
This criterion requires sufficient test cases for each program statement to be executed at least once; however, its achievement is insufficient to provide confidence in a software product’s behavior.
185
Static source code analysis (SAST)
Analysis of the application source code for finding vulnerabilities without executing the application.
186
Steganography
Hiding something within something else, or data hidden within other data.
187
Stream cipher
When a cryptosystem performs its encryption on a bit-by-bit basis.
188
Striping
RAID technique; writing a data set across multiple drives.
189
Substitution
The process of exchanging one letter or bit for another.
190
Switches
Operate at Layer 2. A switch establishes a collision domain per port.
191
Symmetric algorithm
Operate with a single cryptographic key that is used for both encryption and decryption of the message.
192
Synthetic performance monitoring
Involves having external agents run scripted transactions against a web application.
193
Teardrop Attack
Exploits the reassembly of fragmented IP packets in the fragment offset field that indicates the starting position, or offset, of the data contained in a fragmented packet relative to the data of the original unfragmented packet.
194
Threat modeling
A process by which developers can understand security threats to a system, determine risks from those threats, and establish appropriate mitigations.
195
Time multiplexing
Allows the operating system to provide well-defined and structured access to processes that need to use resources according to a controlled and tightly managed schedule.
196
Time of check time of use (TOCTOU) Attacks
Takes advantage of the dependency on the timing of events that takes place in a multitasking operating system.
197
Transmission Control Protocol (TCP)
Provides connection-oriented data management and reliable data transfer.
198
Transport Control Protocol/Internet Protocol (TCP/ IP) Model
Layering model structured into four layers (network interface layer, internet layer, transport layer, host-to-host transport layer, application layer).
199
Transposition
The process of reordering the plaintext to hide the message by using the same letters or bits.
200
Trusted computing base (TCB)
The collection of all of the hardware, software, and firmware within a computer system that contains all elements of the system responsible for supporting the security policy and the isolation of objects.
201
Trusted Platform Module (TPM)
A secure crypto processor and storage module.
202
Uninterruptible power supplies (UPS)
Batteries that provide temporary, immediate power during times when utility service is interrupted.
203
Use cases
Abstract episodes of interaction between a system and its environment.
204
User Datagram Protocol (UDP)
The User Datagram Protocol provides connectionless data transfer without error detection and correction.
205
Virtual Local Area Networks (VLANs)
Allow network administrators to use switches to create software-based LAN segments that can be defined based on factors other than physical location.
206
Voice over Internet Protocol (VoIP)
Is a technology that allows you to make voice calls using a broadband internet connection instead of a regular (or analog) phone line.
207
Waterfall Development Methodology
A development model in which each phase contains a list of activities that must be performed and documented before the next phase begins.
208
Well-Known Ports
Ports 0–1023 ports are related to the common protocols that are utilized in the underlying management of Transport Control Protocol/Internet Protocol (TCP/IP) system, Domain Name Service (DNS), Simple Mail Transfer Protocol (SMTP), etc.
209
White-box testing
A design that allows one to peek inside the “box” and focuses specifically on using internal knowledge of the software to guide the selection of test data.
210
Whitelisting/ blacklisting
A whitelist is a list of email addresses and/or internet addresses that someone knows as “good” senders. A blacklist is a corresponding list of known “bad” senders.
211
Wi-Fi (Wireless LAN IEEE 802.11x)
Primarily associated with computer networking, Wi-Fi uses the IEEE 802.11x specification to create a wireless local-area network either public or private.
212
WiMAX (Broadband Wireless Access IEEE 802.16)
One well-known example of wireless broadband is WiMAX. WiMAX can potentially deliver data rates of more than 30 megabits per second.
213
Work factor
This represents the time and effort required to break a cryptography system.
