ISC Vocabulary for Brainscape j Flashcards
Just-in-Time Manufacturing
Just in time (JIT) is a manufacturing philosophy intended to promote the simplest, least costly means of production. Under ideal conditions, the company would receive raw materials just in time to go into production, manufacture parts just in time to be assembled into products, and complete products just in time to be shipped to customers. JIT shifts the production philosophy from a “push” approach to a “pull” approach. It eliminates the storage of inventories at all stages of the production process.
Key
A long stream of seemingly random bits used with cryptographic algorithms. The keys must be known or guessed to forge a digital signature or decrypt an encrypted message.1. An input that controls the transformation of data by an encryption algorithm. It is a sequence of symbols that controls the operations of encryption and decryption.
Least Privilege
The principle that requires that each subject be granted the most restrictive set of privileges needed for the performance of authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized use.
Local Area Network (LAN)
A local area network (LAN) is a series of microcomputers linked together by cable and sometimes using a common storage device. This linkage allows the sharing of information and common processing. Two of the more common LAN configurations (structures) are ring and star. A star LAN structure has remote computers with direct access to a central computer. It looks like spokes connected to the hub. A ring LAN structure does not have a common hub, but it still can have a server. The LAN looks like a ring with each computer (node) connected to only two other computers.
Log
A log is a record of the operations of data processing equipment that lists each job run, the time it required, operator actions, and other pertinent data.
Logic Bomb
A logic bomb is a Trojan horse set to trigger at a particular condition, event, or command.
Logical Access
Logical access describes how security software works to restrict access to a computer’s data. This type of restricted access is called “logical access” because the computer’s software interprets information, such as user ID and password, to determine who can have access to the computer’s records.
Machine Learning
Machine learning (ML) is one application of artificial intelligence (AI), based around the idea that we should be able to give machines access to data and let them learn for themselves. For example, ML applications can read text and work out whether the person who wrote it is making a complaint or offering congratulations.
Malicious Code
Malicious code refers to programs that are written intentionally to carry out annoying or harmful actions. They often masquerade as useful programs or are embedded into useful programs so that users are induced into activating them. Types of malicious code include Trojan horses, computer viruses, and worms.1. A virus, worm, Trojan horse, or other code-based entity that infects a host.
Malware
Malware is a type of software designed to gain unauthorized access or to cause damage to a computer.
Management Information System (MIS)
A management information system (MIS) provides managers with the information they need for planning, organizing, decision making, and controlling the activities of the entity. The system may include the formal financial accounting records and can include many other information items needed by management.
Man-in-the-Middle Attack (MitM)
An attack on the authentication protocol run in which the attacker positions himself in between the claimant and verifier so that he can intercept and alter data traveling between them.
Mantrap
A mantrap is a physical security access control system comprised of a small space with two sets of interlocking doors.
Masquerading
An attempt to gain access to a computer system by posing as an authorized user. Synonymous with impersonation and mimicking.
Master File
A master file is used in electronic data processing and contains relatively permanent information used for reference and updated periodically.
Materiality
Information is material if omitting it or misstating it could influence decisions that users make on the basis of the financial information of a specific reporting entity. In other words, materiality is an entity-specific aspect of relevance based on the nature or magnitude or both of the items to which the information relates in the context of an individual entity’s financial report. Consequently, the FASB cannot specify a uniform quantitative threshold for materiality or predetermine what could be material in a particular situation.SFAC 8.3, QC11Materiality judgments are concerned with thresholds.Example:You would ask the following questions:Is an item of information, an omission, misstatement, or errorlargeenough, considering its nature and the attendant circumstances, that it is probable that the judgment of a reasonable person relying on the information would have been changed or influenced?Is the item important enough to matter?The relative, rather than absolute, size of the item determines whether or not it is material in a given situation. The auditor’s consideration of materiality is affected by the interaction of quantitative and qualitative factors.The concept of materiality is pervasive. It is related to the relevance and faithful representation of information and is critical to audit judgments regarding audit risk and disclosure.
Materially Misstated
A material misstatement is an untrue statement that misrepresents the facts and which, by its magnitude or nature, influences the decision making of the user. A misstatement or misrepresentation is “material” if it relates to a matter upon which a party could be expected to rely in determining to engage in the conduct in question. The party who relies could be the plaintiff in a lawsuit of an investor or other user of financial data.
Message Digest
The fixed size result of hashing a message.A cryptographic checksum, typically generated for a file that can be used to detect changes to the file; Secure Hash Algorithm-1 (SHA-1) is an example of a message digest algorithm.
Metadata
Metadata repositories store data about data and databases. The metadata describes the data source, how it was captured, and what it represents.
Middleware
Middleware is software that lies between an operating system and the applications running on it. It enables communication and data management for distributed applications, like cloud-based applications (e.g., web servers, application servers, and content management systems).
Mission-Critical System
A mission-critical system is a system supporting a core business activity or process.
Misstatement
A misstatement is a difference between the measurement or evaluation of the underlying subject matter and the appropriate measurement or evaluation of the underlying subject matter in accordance with (or based on) the criteria—for instance, a difference in amount, classification, presentation, or disclosure of a reported financial statement item and the amount, classification, presentation, or disclosure that is required for the item to be presented fairly in accordance with an applicable financial reporting framework. Misstatements can arise from fraud or error. Misstatements can be intentional or unintentional, qualitative or quantitative, and include omissions. (AU-C 200).In certain engagements, a misstatement may be referred to as adeviation, exception,orinstance of noncompliance.(AT-C 105.10)
Modem
A modem is an electronic device that allows a computer terminal to send its electronic signals via an audio signal over a telephone line. Using a modem, one computer can communicate with another by phone.The word “modem” is derived from the contraction of “modulator” and “demodulator.” In the modem, the modulator converts digital pulses, characteristic of a computer’s output, to audio tones capable of being transmitted over a common telephone line. A demodulator in the modem reverses the process at the receiving end.
Monitoring Activities
Monitoring is one of the key components of the COSOInternal Control – Integrated Framework.Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, is present and functioning. Ongoing evaluations, built into business processes at different levels of the entity, provide timely information. Separate evaluations, conducted periodically, will vary in scope and frequency depending on assessment of risks, effectiveness of ongoing evaluations, and other management considerations. Findings are evaluated against criteria established by regulators, standard-setting bodies, or management and the board of directors, and deficiencies are communicated to management and the board of directors as appropriate.
Network
A network is a collection of computers and other hardware components interconnected by communication channels that allow sharing of resources and information.
Nonrepudiation
With high assurance, an authentication asserted to be genuine that cannot subsequently be refuted. It is the security service by which the entities involved in the communication cannot deny having participated. This service provides proof of the integrity and origin of data that can be verified by a third party. Nonrepudiation of origin is protection against a sender of a message later denying transmission.1. Assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender’s identity, so neither can later deny having processed the information. A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.
Object Code
Object code is a form of computer output from a translation process that changes the code from one language to another. For example, source code languages, such as COBOL, must be translated into object code languages, such as machine language, before they can be executed. The process of translation into object code is an internal computer function.
Online Transaction
An online transaction is processed with other computers or networks immediately through the internet. The transaction is processed without delay as it is initiated and executed. Input or initiation equipment (e.g., a cash register) is in direct and open communication with the CPU (central processing unit) of the processing computer system.
Operating System
An operating system is a software program that controls the overall operation of a computer system. Its functions include controlling the execution of computer programs, scheduling, debugging, assigning storage areas, managing data, and controlling input and output.
Operational Effectiveness
Operational effectiveness can refer to both a “macro” and a “micro” definition:Macro:Operational effectiveness on a macro level refers to whether or not an organization is performing its key processes and activities better than its competitors.Micro:From a process and internal control standpoint, operational effectiveness refers to whether or not a process or control is being performed correctly.
Outsourcing
Outsourcing is the use of sources outside the company to provide certain services or products that could be produced within the company. It is perhaps most commonly associated with the decision to use outside suppliers to provide the traditional output of certain service centers (e.g., management information systems) but has also been used for manufacturing.
Passive Attack
An attack against an authentication protocol where the attacker intercepts data traveling along the network between the claimant and verifier but does not alter the data (i.e., eavesdropping).
Passphrase
A sequence of characters, longer than the acceptable length of a password, that is transformed by a password system into a virtual password of acceptable length.
Passwords
A password is a string of characters (alpha, numeric, or special) that allows an individual to access a computer or a multiuser computer system. These systems usually contain sensitive or restricted material. The password is traditionally user-definable to allow the user to create an individual secret code.
Patch
A patch (sometimes called a “fix”) is a “repair job” for a piece of programming. A patch is the immediate solution that is provided to users; it can sometimes be downloaded from the software maker’s website. The patch is not necessarily the best solution for the problem, and the product developers often find a better solution to provide when they package the product for its next release. A patch is usually developed and distributed as a replacement for or an insertion in compiled code (that is, in a binary file or object module). In larger operating systems, a special program is provided to manage and track the installation of patches.
Penetration Testing
The portion of security testing in which the evaluators attempt to circumvent the security features of a computer system. The evaluators may be assumed to use all system design and implementation documentation, which may include listings of system source code, manuals, and circuit diagrams. The evaluators work under the same constraints applied to ordinary users.
Performance Measurement
The process of developing measurable indicators that can be systematically tracked to assess progress made in achieving predetermined goals and using such indicators to assess progress in achieving these goals.
Perimeter-Based Security
The techniques of securing a network by controlling accesses to all entry and exit points of the network.
Personal Identification Number (PIN)
A 4- to 12-character alphanumeric code or password used to authenticate an identity, commonly used in banking applications.
Phishing
Phishing is the practice of sending fraudulent emails that resemble emails from reputable sources. The aim is to steal sensitive data like credit card numbers and login information.
Physical Security
Physical security is the application of physical barriers and control procedures as preventive measures or countermeasures against threats to resources and sensitive information.
Piggybacking
Piggybacking occurs when a perpetrator latches on to a legitimate user who is logging in to a system. The legitimate user unknowingly carries the perpetrator with him/her as he/she is allowed into the system.
Plaintext
Plain, unencrypted (unciphered) text or data.
Planning
Planning is a basic management function involving formulation of one or more detailed plans to achieve optimum balance of needs or demands with the available resources.The planning process:identifies the goals or objectives to be achieved,formulates strategies to achieve them,arranges or creates the means required, andimplements, directs, and monitors all steps in their proper sequence.
Platform as a Service (PaaS)
Platform as a service (PaaS) is a computing platform (operating system and other services) delivered as a service over the internet by a provider. An example is an application development environment that can be subscribed to and used immediately.
Predictive Analytics
Predictive analytics technology uses data, statistical algorithms, and machine-learning techniques to identify the likelihood of future outcomes based on historical data (e.g., fraud detection).
Pretty Good Privacy (PGP)
Pretty good privacy (PGP) is a cryptographic software application for the protection of computer files and electronic mail. It combines the convenience of the Rivest-Shamir-Adelman (RSA) public key algorithm with the speed of the secret-key IDEA algorithm, digital signature, and key management.
Preventive Controls
Preventive controls are internal controls designed to prevent or minimize the chance of errors and fraud.
Privacy
Privacy is the right of an individual to self-determine the degree to which the individual is willing to share with others information about themselves that may be compromised by unauthorized exchange of such information among other individuals or organizations. It is the right of individuals and organizations to control the collection, storage, and dissemination of their information or information about themselves.
Privacy (Trust Services Criteria)
Theprivacycriterion of Trust Services assesses whether the personal information that the service organization collects, uses, retains, discloses, and disposes of is in conformity with the commitments in the entity’s privacy notice and with the privacy principles put forth by the AICPA.
Private Key
The undisclosed key in a matched key pair—private key and public key—used in public key cryptographic systems.A cryptographic key used with a public key cryptographic algorithm, uniquely associated with an entity, and not made public. In an asymmetric (public) key cryptosystem, the key of an entity’s key pair that is known only by that entity.A private key may be used to:compute the corresponding public key,make a digital signature that may be verified by the corresponding public signature,decrypt data encrypted by the corresponding public key, orcompute a piece of common shared secret information together with other information. The private key is used to generate a digital signature.
Probability
Probability theory is a branch of mathematics that studies the likelihood of occurrence of random events in order to predict behavior. Probability is the measure of how likely an event is. Probabilities can be measured using the following formula:P(E) = The number of ways that an event can occur ÷ The total number of possible outcomesProbability is the likelihood of the occurrence of any event in the realm of chances, of the ratio of favorable outcomes to the total number of possible outcomes, both favorable and unfavorable. It is the degree of confidence that we may reasonably have in the occurrence of a particular event.Ana prioridefinition allows us to compute the probability of an outcome without experimentation in a “fair game.” For example, with a 6-sided die, we know that the probability of rolling any particular number is 1/6 since there are six possible outcomes when a die is thrown. Thus, if an experiment has n equally likely outcomes and r of the outcomes are in event E, then the probability of E, i.e., P(E) is r ÷ n.A relative frequency definition defines probability of an event E as the proportion of n trials that result in E. If the number of trials n is large, then the proportion of trials resulting in E is a good estimate of the probability that E will occur.
Processing
Processing is carrying out a specific task. It describes a stream of activity, the execution of a computer program, or the application of a specific, systematic, prescribed series of steps to achieve a desired effect. Processing describes the performance of specific operations to data. It applies to both manual and computerized accounting.Processing is frequently used to refer to the following:“Accounting processing,” which is the analysis and recording of financial data and preparation of reports and one of the five functions that should be segregated (also called “execution”)“Computer processing,” which is the performance of specific commands to data (e.g., retrieve, sort, calculate, summarize, compare) and is the step between input and storage and/or outputIn a flowchart, a process is shown in a box.Processing controls (a subset of application controls) are designed to provide reasonable assurance that the processing operations have been performed as intended or expected. Such controls include control totals (run-to-run, hash, financial totals, and record counts), file and operator logs, and limit and reasonableness tests.
Processing Integrity (Trust Services Criteria)
Theprocessing integritycriterion of Trust Services assesses whether the service organization’s system achieves its purpose (i.e., delivers the right data at the right price at the right time). Accordingly, data processing must be complete, valid, accurate, timely, and authorized.
Program
A program is a plan for solving a problem, or a computer routine or set of instructions arranged in proper sequence to cause a computer to perform a particular process.To program is to devise a plan for solving a problem, or to write a computer routine.
Public (Asymmetric) Key Encryption
Public key encryption uses “key pairs,” a public key and a mathematically related private key. Given the public key, it is infeasible to find the private key. The private key is kept secret while the public key may be shared with others. A message encrypted with the public key can only be decrypted with the private key. A message can be digitally signed with the private key, and anyone can verify the signature with the public key.
Public Key
The key in a matched key pair—private key and public key—that is made public, for example, posted in a public directory, for public key cryptography.A cryptographic key used with a public key cryptographic algorithm, uniquely associated with an entity, and that may be made public. In an asymmetric (public) key cryptosystem, that key of an entity’s key pair that may be publicly known. A public key may be used to:verify a digital signature that is signed by the corresponding private key,encrypt data that may be decrypted by the corresponding private key, andcompute a piece of shared information by other parties. The public key is used to verify a digital signature. This key is mathematically linked with a corresponding private key.The public part of an asymmetric key pair that is typically used to verify signatures or encrypt data.
Public Key Certificate
An identifying digital certificate that typically includes the public key, information about the identity of the party holding the corresponding private key, and the operational period for the certificate, authenticated by the digital signature of the certification authority (CA) that issued the certificate. In addition, the certificate may contain other information about the signing party or information about the recommended uses for the public key. A subscriber is an individual or business entity that has contracted with a CA to receive a digital certificate verifying an identity for digitally signing electronic messages.1. A digital document issued and digitally signed by the private key of a certification authority that binds the name of a subscriber to a public key. The certificate indicates that the subscriber identified in the certificate has sole control and access to the private key.
Public Key Infrastructure
Public key infrastructure is a series of processes and technologies for the association of cryptographic keys with the entity to whom those keys were issued
Qualified Opinion
A qualified opinion states that except for the effects of the matter to which the qualification relates, the financial statements present fairly, in all material respects, the financial position, results of operations, and cash flow in accordance with accounting standards generally accepted in the United States or an applicable financial reporting framework.A qualified opinion is warranted when the matter is material enough to prevent an unmodified opinion but not sufficiently material to require an adverse opinion or disclaimer of opinion. Such a qualified opinion is expressed when there is one of the following:Lack of sufficient appropriate evidence that does not warrant a disclaimer of opinionRestriction of scope that does not warrant a disclaimer of opinionDeparture from GAAP that does not warrant an adverse opinionA qualified opinion requires disclosure of all substantive reasons for the qualification in one or more separate emphasis-of-matter or other-matter paragraph(s) preceding the opinion paragraph.The words “except for” and a reference to the emphasis-of-matter or other-matter paragraph(s) should appear in the opinion paragraph.
QualityAssurance QA
Quality assurance (QA) is any systematic process designed to prevent mistakes and defects in manufactured products, thus avoiding problems when delivering products or services to customers. QA establishes and maintains a set requirements for developing or manufacturing reliable products. A quality assurance system is meant to increase customer confidence and a company’s credibility, while also improving work processes and efficiency, and it enables a company to better compete with others.
Ransomware
Ransomware is a type of malicious software designed to extort money by blocking access to files or the computer system until the ransom is paid.
Real-Time Processing
Real-time processing is an e-business term that describes the situation where a user sends in transactions and awaits a response from a distant computer before continuing.
Reasonableness Check
A reasonableness check is an edit check of logical correctness of the relationships among the values in an input data set, or the value of an input item with the values of a related data item in a master file. For example, a journal entry that debits selling expense and credits sales revenue is not logical, while a journal entry that debits accounts receivable and credits sales revenue is logical. A salary increase of $1 per month is not logical for any employee while a salary increase of $1,000 per month would only be logical for employees whose salaries were over a certain level.
Reciprocal Agreement
A reciprocal agreement is an agreement that allows two organizations to back up each other.
Reconciliation
Reconciliation is an action to bring two related balances into agreement, to identify differences between two related balances (as, for example, the cash balance per the accounting records and the balance per the bank statement), and to detect errors or items that were included in the preparation of one balance omitted from the other. Reconciliation is also applied to any two balances that should agree (i.e., accounts payable or receivable per the accounting records and per the creditor/debtor, investment balances per the records and per the trustee, etc.).
