Cisa Glossary 1

Front 1

trest

Back 1

test

Front 2

"Abend"

Back 2

"An abnormal end to a computer job; termination of a task prior to its completion because of an error condition that cannot be resolved by recovery facilities while the task is executing"

Front 3

"Access control"

Back 3

"The process that limits and controls access to resources of a computer system; a logical or physical control designed to protect against unauthorized entry or use. Access control can be defined by the system (mandatory access control# or MAC) or defined by the user who owns the object (discretionary access control# or DAC)."

Front 4

"Access control table"

Back 4

"An internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals"

Front 5

"Access method"

Back 5

"The technique used for selecting records in a file# one at a time# for processing# retrieval or storage. The access method is related to# but distinct from# the file organization that determines how the records are stored."

Front 6

"Access path"

Back 6

"The logical route an end user takes to access computerized information. Typically# it includes a route through the operating system# telecommunications software# selected application software and the access control system."

Front 7

"Access rights"

Back 7

"Also called permissions or privileges# these are the rights granted to users by the administrator or supervisor. Access rights determine the actions users can perform (e.g.# read# write# execute# create and delete) on files in shared volumes or file shares on the server."

Front 8

"Accountability"

Back 8

"The ability to map a given activity or event back to the responsible party"

Front 9

"ACK (acknowledgement)"

Back 9

"A flag set in a packet to indicate to the sender that the previous packet sent was accepted correctly by the receiver without errors# or that the receiver is now ready to accept a transmission"

Front 10

"Active recovery site (mirrored)"

Back 10

"Recovery strategy that involves two active sites# each capable of taking over the other’s workload in the event of a disaster. Each site will have enough idle processing power to restore data from the other site and to accommodate the excess workload in the event of a disaster."

Front 11

"Active response"

Back 11

"A response# in which the system (automatically or in concert with the user) blocks or otherwise affects the progress of a detected attack. The response takes one of three forms--amending the environment# collecting more information or striking back against the user."

Front 12

"Address"

Back 12

"The code used to designate the location of a specific piece of data within computer storage"

Front 13

"Address space"

Back 13

"The number of distinct locations that may be referred to with the machine address. For most binary machines# it is equal to 2n# where n is the number of bits in the machine address."

Front 14

"Addressing"

Back 14

"The method used to identify the location of a participant in a network. Ideally# addressing specifies where the participant is located rather than who they are (name) or how to get there (routing)."

Front 15

"adjusting period"

Back 15

"The calendar can contain “real” accounting periods and/or adjusting accounting periods. The “real” accounting periods must not overlap# and cannot have any gaps between “real” accounting periods. Adjusting accounting periods can overlap with other accounting periods. For example# a period called DEC-93 can be defined that includes 01-DEC-1993 through 31-DEC-1993. An adjusting period called DEC31-93 can also be defined that includes only one day: 31-DEC-1993 through 31-DEC-1993."

Front 16

"Administrative controls"

Back 16

"The actions/controls dealing with operational effectiveness# efficiency and adherence to regulations and management policies"

Front 17

"allocation entry"

Back 17

"A recurring journal entry used to allocate revenues or costs. For example# an allocation entry could be defined to allocate costs to each department based on headcount."

Front 18

"Alpha"

Back 18

"The use of alphabetic characters or an alphabetic character string"

Front 19

"Analog"

Back 19

"A transmission signal that varies continuously in amplitude and time and is generated in wave formation. Analog signals are used in telecommunications."

Front 20

"Anomaly"

Back 20

"Unusual or statistically rare"

Front 21

"Anomaly detection"

Back 21

"Detection on the basis of whether the system activity matched that defined as abnormal"

Front 22

"Anonymity"

Back 22

"The quality or state of not being named or identified"

Front 23

"Anonymous File Transfer Protocol (FTP)"

Back 23

"A method for downloading public files using the File Transfer Protocol (FTP). Anonymous FTP is called anonymous because users do not need to identify themselves before accessing files from a particular server. In general# users enter the word anonymous when the host prompts for a username; anything can be entered for the password# such as the user's e-mail address or simply the word guest. In many cases# an anonymous FTP site will not even prompt users for a name and password."

Front 24

"Antivirus software"

Back 24

"Applications that detect# prevent and possibly remove all known viruses from files located in a microcomputer hard drive"

Front 25

"Appearance"

Back 25

"The act of giving the idea or impression of being or doing something"

Front 26

"Appearance of independence"

Back 26

"Behavior adequate to meet the situations occurring during audit work (interviews# meetings# reporting# etc.). The IS auditor should be aware that appearance of independence depends upon the perceptions of others and can be influenced by improper actions or associations."

Front 27

"Applet"

Back 27

"A program written in a portable# platform independent computer language# such as Java. It is usually embedded in an HTML page and then executed by a browser. Applets can only perform a restricted set of operations# thus preventing# or at least minimizing# the possible security compromise of the host computers."

Front 28

"application"

Back 28

"A computer program or set of programs that perform the processing of records for a specific function"

Front 29

"Application acquisition review"

Back 29

"An evaluation of an application system being acquired or evaluated# which considers such matters as: appropriate controls are designed into the system; the application will process information in a complete# accurate and reliable manner; the application will function as intended; the application will function in compliance with any applicable statutory provisions; the system is acquired in compliance with the established system acquisition process."

Front 30

"Application controls"

Back 30

"Refer to the transactions and data relating to each computer-based application system and are therefore specific to each such application. The objectives of application controls# which may be manual# or programmed# are to ensure the completeness and accuracy of the records and the validity of the entries made therein resulting from both manual and programmed processing. Examples of application controls include data input validation# agreement of batch totals and encryption of data transmitted."

Front 31

"Application development review"

Back 31

"An evaluation of an application system under development which considers matters such as: appropriate controls are designed into the system; the application will process information in a complete# accurate and reliable manner; the application will function as intended; the application will function in compliance with any applicable statutory provisions; the system is developed in compliance with the established systems development life cycle process"

Front 32

"Application implementation review"

Back 32

"An evaluation of any part of an implementation project (e.g.# project management# test plans# user acceptance testing procedures)"

Front 33

"Application layer"

Back 33

"A layer within the International Organization for Standardization (ISO)/Open Systems Interconnection (OSI) model. It is used in information transfers between users through application programs and other devices. In this layer various protocols are needed. Some of them are specific to certain applications and others are more general for network services."

Front 34

"Application maintenance review"

Back 34

"An evaluation of any part of a project to perform maintenance on an application system (e.g.# project management# test plans# user acceptance testing procedures)"

Front 35

"Application program"

Back 35

"A program that processes actions upon business data# such as data entry# update or query. It contrasts with systems program# such as an operating system or network control program# and with utility programs# such as copy or sort."

Front 36

"Application programming"

Back 36

"The act or function of developing and maintaining applications programs in production"

Front 37

"Application programming interface (API)"

Back 37

"A set of routines# protocols and tools referred to as ""building blocks"" used in business application software development. A good API makes it easier to develop a program by providing all the building blocks related to functional characteristics of an operating system# which applications need to specify when# for example# interfacing with an operating system (e.g.# provided by MS-Windows# different versions of UNIX). A programmer would utilize these APIs in developing applications that can operate effectively and efficiently on the platform chosen."

Front 38

"Application proxy"

Back 38

"A proxy service that connects programs running on internal networks to services on exterior networks by creating two connections# one from the requesting client and another to the destination service"

Front 39

"application security"

Back 39

"Refers to the security aspects supported by the ERP# primarily with regard to the roles or responsibilities and audit trails within the applications"

Front 40

"Application software tracing and mapping"

Back 40

"Specialized tools that can be used to analyze the flow of data# through the processing logic of the application software# and document the logic# paths# control conditions and processing sequences. Both the command language or job control statements and programming language can be analyzed. This technique includes program/system: mapping# tracing# snapshots# parallel simulations and code comparisons."

Front 41

"Application system"

Back 41

"An integrated set of computer programs designed to serve a particular function that has specific input# processing and output activities (e.g.# general ledger# manufacturing resource planning# human resource management)"

Front 42

"Arithmetic-logic unit (ALU)"

Back 42

"The area of the central processing unit that performs mathematical and analytical operations"

Front 43

"Artificial intelligence"

Back 43

"Advanced computer systems that can simulate human capabilities# such as analysis# based on a predetermined set of rules"

Front 44

"ASCII"

Back 44

"(American Standard Code for Information Interchange) An eight-digit/seven-bit code representing 128 characters; used in most small computers"

Front 45

"ASP/MSP (application or managed service provider)"

Back 45

"A third party that delivers and manages applications and computer services# including security services to multiple users via the Internet or a private network"

Front 46

"Assembler"

Back 46

"A program that takes as input a program written in assembly language and translates it into machine code or relocatable code"

Front 47

"Assembly language"

Back 47

"A low-level computer programming language which uses symbolic code and produces machine instructions"

Front 48

"Asymmetric key (public key)"

Back 48

"A cipher technique whereby different cryptographic keys are used to encrypt and decrypt a message (see public key cryptosystems)"

Front 49

"Asynchronous Transfer Mode (ATM)"

Back 49

"ATM is a high-bandwidth low-delay switching and multiplexing technology. It is a data link layer protocol. This means that it is a protocol-independent transport mechanism. ATM allows integration of real-time voice and video as well as data. ATM allows very high speed data transfer rates at up to 155 Mbit/s."

Front 50

"Asynchronous transmission"

Back 50

"Character-at-a-time transmission"