ITPROTV Security Glossary Flashcards
6to4
Transition mechanism for migrating from IPv4 to IPv6 . It allows systems to use IPv6 to communicate if their traffic has to transverse an IPv4 network .
Absolute addresses
Hardware addresses used by the CPU .
Abstraction
The capability to suppress unnecessary details so the important, inherent properties can be examined and reviewed .
Accepted ways for handling risk
Avoid, accept, transfer (share), mitigate, recast .
Access
The flow of information between a subject and an object .
Access control
security features that control how users and systems communicate and interact with other systems and resources .
Access control list (ACL)
Mechanism implementing discretionary and/or mandatory access control between subjects and objects .
Access Control Matrix
A table of subjects and objects indicating what actions individual subjects can take upon individual objects .
Access control mechanism
Security safeguard designed to detect and deny unauthorized access and permit authorized access in an information system.
Access Control Model
A framework that dictates how subjects access objects .
Access level
Hierarchical portion of the security level used to identify the sensitivity of information system data and the clearance or authorization of users . Access level, in conjunction with the nonhierarchical categories, forms the sensitivity label of an object .
Access list
(IS) Compilation of users, programs, or processes and the access levels and types to which each is authorized . (COMSEC) Roster of individuals authorized admittance to a controlled area .
Access profile
Associates each user with a list of protected objects the user may access .
Access type
– Privilege to perform action on an object . Read, write, execute, append, modify, delete, and create are examples of access types .
Accountability
(IS) Process of tracing information system activities to a responsible source . (COMSEC) Principle that an individual is entrusted to safeguard and control equipment, keying material, and information and is answerable to proper authority for the loss or misuse of that equipment or information .
Accreditation
Formal acceptance of the adequacy of a system’s overall security by management .
Accrediting authority
Synonymous with Designated Accrediting Authority (DAA) .
ActiveX
– A Microsoft technology composed of a set of OOP technologies and tools based on COM and DCOM . It is a framework for defining reusable software components in a programming language-independent manner
Address bus
Physical connections between processing components and memory segments used to communicate the physical memory addresses being used during processing procedures .
Address Resolution Protocol (ARP) –
A networking protocol used for resolution of network layer IP addresses into link layer MAC addresses .
Address space layout randomization (ASLR)
Memory protection mechanism used by some operating systems . The addresses used by components of a process are randomized so that it is harder for an attacker to exploit specific memory vulnerabilities .
Adequate security
Security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information . This includes assuring that information systems operate effectively and provide appropriate confidentiality, integrity, and availability, through the use of cost-effective management, personnel, operational, and technical controls . (OMB Circular A-130)
Advanced Encryption Standard (AES)
FIPS approved cryptographic algorithm that is a symmetric block cipher using cryptographic key sizes of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits
Advisory
– Notification of significant new trends or developments regarding the threat to the information system of an organization . This notification may include analytical insights into trends, intentions, technologies, or tactics of an adversary targeting information systems .
Alert
Notification that a specific attack has been directed at the information system of an organization .
Algebraic attack –
Cryptanalysis attack that exploits vulnerabilities within the intrinsic algebraic structure of mathematical functions .
Algorithm
Set of mathematical and logic rules used in cryptographic functions .
Analog signals
Continuously varying electromagnetic wave that represents and transmits data .
Analytic attack
Cryptanalysis attack that exploits vulnerabilities within the algorithm structure .
Annualized loss expectancy (ALE) –
Annual expected loss if a specific vulnerability is exploited and how it affects a single asset . SLE x ARO = ALE .
Application
Software program that performs a specific function directly for a user and can be executed without access to system control, monitoring, or administrative privileges .
Application programming interface (API)
Software interface that enables process-to-process interaction . Common way to provide access to standard routines to a set of software programs .
Arithmetic logic unit (ALU) –
Component of the CPU that carries out logic and mathematical functions as they are laid out in the programming code being processed by the CPU .
Assemblers
Tools that convert assembly code into the necessary machine-compatible binary language for processing activities to take place .
Assembly language
A low-level programming language that is the mnemonic representation of machine-level instructions .
Assurance
Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy .
Assurance evaluation criteria
Check-list and process of examining the security-relevant parts of a system (TCB, reference monitor, security kernel) and assigning the system an assurance rating .
Asymmetric algorithm
– Encryption method that uses two different key types, public and private . Also called public key cryptography
Asymmetric mode multiprocessing
When a computer has two or more CPUs and one CPU is dedicated to a specific program while the other CPUs carry out general processing procedures .
Asynchronous communication
Transmission sequencing technology that uses start and stop bits or similar encoding mechanism . Used in environments that transmit a variable amount of data in a periodic fashion .
Asynchronous token-generating method
Employs a challenge/response scheme to authenticate the user .
Attack
Attempt to gain unauthorized access to an information system’s services, resources, or information, or the attempt to compromise an information system’s integrity, availability, or confidentiality .
Attack surface
Components available to be used by an attacker against the product itself .
Attenuation
Gradual loss in intensity of any kind of flux through a medium . As an electrical signal travels down a cable, the signal can degrade and distort or corrupt the data it is carrying .
Attribute
A column in a two-dimensional database .
Audit
Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures, and to recommend necessary changes in controls, policies, or procedures .
Audit trail
Chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event .
Authenticate –
To verify the identity of a user, user device, or other entity, or the integrity of data stored, transmitted, or otherwise exposed to unauthorized modification in an information system, or to establish the validity of a transmission .
Authentication
Security measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual’s authorization to receive specific categories of information .
Authentication header (AH) protocol
– Protocol within the IPSec suite used for integrity and authentication .
Authentication system
Cryptosystem or process used for authentication .
Authenticator
Means used to confirm the identity of a station, originator, or individual .
Authenticode
A type of code signing, which is the process of digitally signing software components and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was digitally signed . Authenticode is Microsoft’s implementation of code signing .
Authorization
Access privileges granted to a user, program, or process .
Availability
– Reliable and timely access to data and resources is provided to authorized individuals .
Avalanche effect –
Algorithm design requirement so that slight changes to the input result in drastic changes to the output .
Back door
Hidden software or hardware mechanism used to circumvent security controls . Synonymous with trap door .
Backup
Copy of files and programs made to facilitate recovery, if necessary .
Banner
Display on an information system that sets parameters for system or data use .
Base registers
Beginning of address space assigned to a process . Used to ensure a process does not make a request outside its assigned memory boundaries
Baseband transmission –
– Uses the full bandwidth for only one communication channel and has a low data transfer rate compared to broadband .
Bastion host
A highly exposed device that will most likely be targeted for attacks, and thus should be properly locked down .
Behavior blocking
Allowing the suspicious code to execute within the operating system and watches its interactions with the operating system, looking for suspicious activities .
Bell-LaPadula
A formal state transition model of computer security policy that describes a set of access control rules that uses security labels on objects and clearances for subjects . It was developed by David E . Bell and Leonard J . LaPadula . Bell-LaPadula security model is for meeting the confidentiality security objective only .
Biba
A formal state transition access control security model that focuses on data integrity in an information system . In general, Biba integrity model has three goals – Prevent data modification by unauthorized subject, prevent unauthorized data modification by authorized subject, and maintain internal and external consistency . It is defined by Kenneth J . Biba .
Binding
Process of associating a specific communications terminal with a specific cryptographic key or associating two related elements of information
Biometrics
Automated methods of authenticating or verifying an individual based upon a physical or behavioral characteristic .
Birthday attack –
A type of cryptographic attack that exploits the mathematics behind the birthday problem in probability theory . This attack can be used to abuse communication between two or more parties . The attack depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations) .
Bit error rate
Ratio between the number of bits incorrectly received and the total number of bits transmitted in a telecommunications system .
Block cipher
Symmetric algorithm type that encrypts chunks (blocks) of data at a time .
Blowfish –
– Block symmetric cipher that uses 64-bit block sizes and variable-length keys .
Border Gateway Protocol (BGP)
The protocol that carries out core routing decisions on the
Internet . It maintains a table of IP networks, or “prefixes,” which designate network reachability among autonomous systems .
Bots
– Software applications that run automated tasks over the Internet, which perform tasks that are both simple and structurally repetitive . Malicious use of bots is the coordination and operation of an automated attack by a botnet (centrally controlled collection of bots) .
Boundary
Software, hardware, or physical barrier that limits access to a system or part of a system .
Broadband transmission
Divides the bandwidth of a communication channel into many channels, enabling different types of data to be transmitted at one time .
Browsing
– Act of searching through information system storage to locate or acquire information, without necessarily knowing the existence or format of information being sought .
Buffer overflow
– Too much data is put into the buffers that make up a stack . Common attack vector used by hackers to run malicious code on a target system .
Bulk encryption
Simultaneous encryption of all channels of a multichannel telecommunications link .
Bus topology
Systems are connected to a single transmission channel (i .e ., network cable), forming a linear construct .
Business continuity management (BCM)
the overarching approach to managing all aspects of BCP and DRP .
Business Continuity Plan (BCP)
Contains strategy documents that provide detailed procedures that ensure critical business functions are maintained and that help minimize losses of life, operations, and systems . A BCP provides procedures for emergency responses, extended backup operations, and post-disaster recovery .
Business Impact Analysis (BIA)
A systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency .
Cable modem
A device that provides bidirectional data communication via radio frequency channels on cable TV infrastructures . Cable modems are primarily used to deliver broadband Internet access to homes .
Cache memory
Fast memory type that is used by a CPU to increase read and write operations .
Caesar Cipher
Simple substitution algorithm created by Julius Caesar that shifts alphabetic values three positions during its encryption and decryption processes
Call back –
Procedure for identifying and authenticating a remote information system terminal, whereby the host system disconnects the terminal and reestablishes contact . Synonymous with dial back .
Capability Maturity Model Integration (CMMI) model
A process improvement approach that provides organizations with the essential elements of effective processes, which will improve their performance .
Capability Table
A capability table specifies the access rights a certain subject possesses pertaining to specific objects . A capability table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL .
Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)
Used with Wireless Networks . Carrier sense (CS): The initial idea is that participants may only send data over the network if the transmission medium is free . The carrier status detection checks the channel any time, and data is not sent until it’s available .
Multiple access (MA): Several stations share a transmission medium . It is crucial for functioning communication that all of them adhere to a binding protocol .
Collision avoidance (CA): A complex schedule tries to ensure that two or more participants do not start a transmission at the same time to avoid collisions . If overlapping does occur, this will be detected and the transmission will be tried again .
Carrier Sense Multiple Access with Collision Setection (CSMA/CD)
Used in Wired Ethernet networks .
Carrier sense (CS): The carrier state detection makes sure that all network participants check whether the medium is currently free – only then does the protocol initiate data transmission Multiple access (MA): Several participants (computers connected to the network) share a transmission medium
Collision detection (CD): The collision detection is an extension of the original protocol and regulates how to proceed in case data packets happen to collide .
CBC-MAC
Cipher block chaining message authentication code uses encryption for data integrity and data origin authentication .
Cell
An intersection of a row and a column .
Cell suppression
A technique used to hide specific cells that contain sensitive information .
Central office
The physical building used to house inside plant equipment including telephone switches, which make telephone calls “work” in the sense of making connections and relaying the speech information .
Central processing unit (CPU)
A silicon component made up of integrated chips with millions of transistors that carry out the execution of instructions within a computer .
Certificate
Digital identity used within a PKI . Generated and maintained by a certificate authority and used for authentication .
Certificate management
– Process whereby certificates are generated, stored, protected, transferred, loaded, used, and destroyed .
Certificate Revocation List (CRL) –
List that is maintained by the certificate authority of a PKI that contains information on all of the digital certificates that have been revoked .
Certification
Technical evaluation of the security components and their compliance to a predefined security policy for the purpose of accreditation .
Certification authority (CA) –
– (C&A) Official responsible for performing the comprehensive evaluation of the security features of an information system and determining the degree to which it meets its security requirements . (PKI) Trusted entity authorized to create, sign, and issue public key certificates . By digitally signing each certificate issued, the user’s identity is certified, and the association of the certified identity with a public key is validated .
Certification package
– Product of the certification effort documenting the detailed results of the certification activities .
Certifier
Individual responsible for making a technical judgment of the system’s compliance with stated requirements, identifying and assessing the risks associated with operating the system, coordinating the certification activities, and consolidating the final certification and accreditation packages .
Challenge and reply authentication
Prearranged procedure in which a subject requests authentication of another and the latter establishes validity with a correct reply .
Change control
– The process of controlling the changes that take place during the life cycle of a system and documenting the necessary change control activities .
Channel Service Unit (CSU)
A line bridging device for use with T-carriers, and that is required by PSTN providers at digital interfaces that terminate in a Data Service Unit (DSU) on the customer side . The DSU is a piece of telecommunications circuit terminating equipment that transforms digital data between telephone company lines and local equipment .
Check word
Cipher text generated by cryptographic logic to detect failures in cryptography .
Checklist test
Determines if sufficient supplies are stored at the backup site, telephone number listings are current, quantities of forms are adequate, and a copy of the recovery plan and necessary operational manuals are available . Under this testing technique, the recovery team reviews the plan and identifies key components that should be current and available . The checklist test ensures that the organization complies with the requirements of the disaster recovery plan .
Checksum
Value computed on data to detect error or manipulation during transmission .
Chosen-ciphertext attack
– Cryptanalysis attack where the attacker chooses a ciphertext and obtains its decryption under an unknown key .
Chosen-plaintext attack
Cryptanalysis attack where the attacker can choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts .
Cipher
Another name for algorithm .
Cipher text
Enciphered information .
Ciphertext-only attack
Cryptanalysis attack where the attacker is assumed to have access only to a set of ciphertexts .
Clark-Wilson –
A formal security model to preserve information integrity in an information system . The model focuses on “well-formed” transaction using a set of enforcement and certification rules . It is developed by David D . Clark and David R . Wilson .
Classless Interdomain Routing (CIDR)
Variable-length subnet masking, which allows a network to be divided into different-sized subnets . The goal is to increase the efficiency of the use of IP addresses since classful addressing schemes commonly end up in unused addresses .
Clearance
Formal security determination by an authorized adjudicative office that an individual is authorized access, on a need to know basis, to a specific level of collateral classified information (TOP SECRET, SECRET, CONFIDENTIAL) .
Client-side validation
Input validation is done at the client before it is even sent back to the server to process .
Clipping Level
A threshold .
Closed security environment
– Environment providing sufficient assurance that applications and equipment are protected against the introduction of malicious logic during an information system life cycle . Closed security is based upon a system’s developers, operators, and maintenance personnel having sufficient clearances, authorization, and configuration control
Closed system
– Designs are built upon proprietary procedures, which inhibit interoperability capabilities .
Cloud computing
The delivery of computer processing capabilities as a service rather than as a product, whereby shared resources, software, and information are provided to end users as a utility . Offerings are usually bundled as an infrastructure, platform, or software .
CMAC
Cipher message authentication code that is based upon and provides more security compared to CBC-MAC .
CobiT
Set of control objectives used as a framework for IT governance developed by Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI) .
Cognitive passwords
Fact or opinion based information used to verify an individual’s identity .
Cold site
Is just a building with power, raised floors, and utilities . No devices are available . This is the cheapest of the three options, but can take weeks to get up and operational .
Cold start
– Procedure for initially keying crypto-equipment .
Collaborative computing
Applications and technology (e .g . , whiteboarding, group conferencing) that allow two or more individuals to share information real time in an inter- or intra-enterprise environment .
Collision
When two different messages are computed by the same hashing algorithm and the same message digest value results .
Collusion –
Two or more people working together to carry out fraudulent activities .
Common Criteria
– Common Criteria (ISO 15408) - International standard used to assess the effectiveness of the security controls built into a system from functional and assurance perspectives .
Communications security (COMSEC) –
Measures and controls taken to deny unauthorized individuals information derived from telecommunications and to ensure the authenticity of such telecommunications . Communications security includes cryptosecurity, transmission security, emission security, and physical security of COMSEC material .
Community risk
– Probability that a particular vulnerability will be exploited within an interacting population and adversely impact some members of that population .
Compartmentalization –
A nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone .
Compartmented mode –
Mode of operation wherein each user with direct or indirect access to a system, its peripherals, remote terminals, or remote hosts has all of the following – (a) valid security clearance for the most restricted information processed in the system; (b) formal access approval and signed nondisclosure agreements for that information which a user is to have access; and (c) valid need-to-know for information which a user is to have access .
Compilers
Tools that convert high-level language statements into the necessary machine-level format ( .exe, .dll, etc .) for specific processors to understand .
Compression viruses
– Another type of virus that appends itself to executables on the system and compresses them by using the user’s permissions .
Compromise
Type of incident where information is disclosed to unauthorized individuals or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred .
Computer abuse
– Intentional or reckless misuse, alteration, disruption, or destruction of information processing resources .
Computer cryptography
Use of a crypto-algorithm program by a computer to authenticate or encrypt/decrypt information .
Computer security
Measures and controls that ensure confidentiality, integrity, and availability of information system assets including hardware, software, firmware, and information being processed, stored, and communicated .
Computer security incident
See incident .
Computer security subsystem
Hardware/software designed to provide computer security features in a larger system environment . Computing environment Workstation or server (host) and its operating system, peripherals, and applications .
Concealment Cipher
– Encryption method that hides a secret message within an open message .
Concept of operations (CONOP)
– Document detailing the method, act, process, or effect of using an information system
Confidentiality
– Necessary level of secrecy is enforced and unauthorized disclosure is prevented .
Configuration control
Process of controlling modifications to hardware, firmware, software, and documentation to ensure the information system is protected against improper modifications prior to, during, and after system implementation .
