Security+ 2011 Glossary Of Terms

Front 1

802.1X

Back 1

The IEEE standard that defines port-based security for wireless network access control. It offers a means of authentication and defines the Extensible Authentication Protocol (EAP) over IEEE 802, and it is often known as EAP over LAN (EAPOL).

Front 2

AAA

Back 2

Acronym for three key areas of security: Authentication, Authorization, and Accounting.

Front 3

Acceptable use policy (AUP)

Back 3

Agreed-upon principles set forth by a company to govern how the employees of that company may use resources such as computers and Internet access.

Front 4

Access attack

Back 4

An attack aimed at gaining access to resources.

Front 5

Access control

Back 5

The means of giving or restricting user access to network resources. Access control is usually accomplished through the use of an access control list (ACL).

Front 6

Access control list (ACL)

Back 6

A table or data file that specifies whether a user or group has access to a specific resource on a computer or network.

Front 7

Access point (AP)

Back 7

The point at which access to a network is accomplished. This term is often used in relation to a wireless access point (WAP).

Front 8

Accountability

Back 8

Being responsible for an item. The administrator is often accountable for the network and the resources on it.

Front 9

Accounting

Back 9

The act of keeping track of activity. Most often, this term is used to refer to tracking users' interactions with network resources via log files that are routinely scanned and checked.

Front 10

Acknowledgment (ACK)

Back 10

A message confirming that a data packet was received. Acknowledgment is a TCP function and occurs at the Transport layer of the Open Systems Interconnection (OSI) and TCP/IP models.

Front 11

Active response

Back 11

A response generated in real time.

Front 12

Active sniffing

Back 12

Involves an attacker gaining access to a host in the network through a switch and logically disconnecting it from the network.

Front 13

Activity

Back 13

Any action a user undertakes.

Front 14

AD-IDS

Back 14

Anomaly-detection intrusion detection system. An AD-IDS works by looking for deviations from a pattern of normal network traffic.

Front 15

Address Resolution Protocol (ARP)

Back 15

Protocol used to map known IP addresses to unknown physical addresses.

Front 16

Administrative policies

Back 16

A set of rules that govern administrative usage of a system.

Front 17

Administrator

Back 17

The user who is accountable and responsible for the network.

Front 18

Advanced Encryption Standard (AES)

Back 18

A FIPS publication that specifies a cryptographic algorithm for use by the U.S. government. See also Federal Information Processing Standard (FIPS).

Front 19

Adware

Back 19

Software that gathers information to pass on to marketers or that intercepts personal data such as credit card numbers and makes them available to third parties.

Front 20

AES256

Back 20

An implementation of Advanced Encryption Standard (AES) that uses 256-bit encryption.

Front 21

Alert

Back 21

A notification that an unusual condition exists and should be investigated.

Front 22

Algorithm

Back 22

The series of steps/formulas/processes that is followed to arrive at a result.

Front 23

Analyzer

Back 23

The component or process that analyzes the data collected by the sensor.

Front 24

Annualized loss expectancy (ALE)

Back 24

A calculation that is used to identify risks and calculate the expected loss each year.

Front 25

Annualized rate of occurrence (ARO)

Back 25

A calculation of how often a threat will occur. For example, a threat that occurs once every five years has an annualized rate of occurrence of 1/5, or 0.2.

Front 26

Anomaly detection

Back 26

The act of looking for variations from normal operations (anomalies) and reacting to them.

Front 27

Anonymous authentication

Back 27

Authentication that doesn't require a user to provide a username, password, or any other identification before accessing resources.

Front 28

Antivirus

Back 28

A category of software that uses various methods to prevent and eliminate viruses in a computer. It typically also protects against future infection. See also virus.

Front 29

Antivirus engine

Back 29

The core program that runs the virus-scanning process.

Front 30

Antivirus software

Back 30

Software that identifies the presence of a virus and is capable of removing or quarantining the virus.

Front 31

AP

Back 31

See access point (AP).

Front 32

Appliance

Back 32

A freestanding device that operates in a largely self-contained manner.

Front 33

Application layer

Back 33

The seventh layer of the Open Systems Interconnection (OSI) model. This layer deals with how applications access the network and describes application functionality, such as file transfer, messaging, and so on.

Front 34

Application programming interface (API)

Back 34

An abstract interface to the services and protocols provided by an operating system.

Front 35

Armored virus

Back 35

A virus that is protected in a way that makes disassembling it difficult. The difficulty makes it “armored” against antivirus programs that have trouble getting to, and understanding, its code.

Front 36

ARO

Back 36

See annualized rate of occurrence (ARO).

Front 37

ARP

Back 37

See Address Resolution Protocol (ARP).

Front 38

ARP table

Back 38

The table that the Address Resolution Protocol uses. Contains a list of known IP addresses and their associated physical addresses. The table is cached in memory so that ARP lookups don't have to be performed for frequently accessed addresses. See also Media Access Control (MAC).

Front 39

Asset

Back 39

Any resource of value that you want to secure and protect.

Front 40

Asymmetric algorithm

Back 40

An algorithm that utilizes two keys.

Front 41

Asymmetric encryption

Back 41

Encryption in which two keys must be used. One key is used to encrypt data, and the other is needed to decrypt the data. Asymmetric encryption is the opposite of symmetric encryption, where a single key serves both purposes.

Front 42

Attack

Back 42

Any unauthorized intrusion into the normal operations of a computer or computer network. The attack can be carried out to gain access to the system or any of its resources.

Front 43

Audit files

Back 43

Files that hold information about a resource's access by users.

Front 44

Auditing

Back 44

The act of tracking resource usage by users.

Front 45

Auditors

Back 45

Individuals involved in auditing log and security files.

Front 46

AUP

Back 46

See acceptable use policy (AUP).

Front 47

Authenticating the evidence

Back 47

Verifying that the logs and other resources collected are legitimate. This technique can be useful in verifying that an attack has occurred.

Front 48

Authentication

Back 48

The means of verifying that someone is who they say they are.

Front 49

Authentication Header (AH)

Back 49

A header used to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays.

Front 50

Availability

Back 50

The ability of a resource to be accessed, often expressed as a time period. Many networks limit users' ability to access network resources to working hours, as a security precaution.

Front 51

Back door (backdoor)

Back 51

An opening left in a program application (usually by the developer) that allows additional access to data. Typically, these are created for debugging purposes and aren't documented. Before the product ships, the back doors are closed; when they aren't closed, security loopholes exist.

Front 52

Backup

Back 52

A usable copy of data made to media. Ideally, the backup is made to removable media and stored for recovery should anything happen to the original data.

Front 53

Backup plan

Back 53

A documented plan governing backup situations.

Front 54

Backup policy

Back 54

A written policy detailing the frequency of backups and the location of storage media.

Front 55

BCP

Back 55

See business continuity planning (BCP).

Front 56

Bell-LaPadula model

Back 56

A model designed for the military to address the storage and protection of classified information. This model is specifically designed to prevent unauthorized access to classified information. The model prevents the user from accessing information that has a higher security rating than they are authorized to access. It also prevents information from being written to a lower level of security.

Front 57

Best practices

Back 57

A set of rules governing basic operations.

Front 58

BGP

Back 58

See Border Gateway Protocol (BGP).

Front 59

BIA

Back 59

See Business Impact Analysis (BIA).

Front 60

Biba model

Back 60

A model similar in concept to the Bell-LaPadula model but more concerned with information integrity (an area the Bell-LaPadula model doesn't address). In this model, there is no write up or read down. If you're assigned access to top-secret information, you can't read secret information or write to any level higher than the level to which you're authorized. This model keeps higher-level information pure by preventing less-reliable information from being intermixed with it.

Front 61

Biometric device

Back 61

A device that can authenticate an individual based on a physical characteristic.

Front 62

Biometrics

Back 62

The science of identifying a person by using one or more of their features. The feature can be a thumbprint, a retinal scan, or any other biological trait.

Front 63

BIOS

Back 63

The basic input/output system for an IBM-based PC. It is the firmware that allows the computer to boot.

Front 64

Birthday attack

Back 64

A probability method of finding collision in hash functions.

Front 65

Blowfish

Back 65

A type of symmetric block cipher created by Bruce Schneier.

Front 66

Boot sector

Back 66

Also known as the Master Boot Record (MBR). The first sector of the hard disk, where the program that boots the operating system resides. It's a popular target for viruses.

Front 67

Border Gateway Protocol (BGP)

Back 67

An ISP protocol that allows routers to share information about routes with each other.

Front 68

Border router

Back 68

A router used to translate from LAN framing to WAN framing.

Front 69

Bot

Back 69

An automated software program (network robot) that collects information on the Web. In the malicious form, a bot is a compromised computer being controlled remotely.

Front 70

Brute force attack

Back 70

A type of attack that relies purely on trial and error and tries all possible combinations.

Front 71

Buffer overflow attack

Back 71

A type of denial of service (DoS) attack that occurs when more data is put into a buffer than it can hold, thereby overflowing it (as the name implies).

Front 72

Business continuity planning (BCP)

Back 72

A contingency plan that allows a business to keep running in the event of a disruption to vital resources.

Front 73

Business impact analysis (BIA)

Back 73

A study of the possible impact if a disruption to a business's vital resources were to occur.

Front 74

CA

Back 74

See certificate authority (CA).

Front 75

CAC

Back 75

See common access card (CAC).

Front 76

Carlisle Adams Stafford Tavares (CAST)

Back 76

A type of symmetric block cipher defined by RFC 2144.

Front 77

CC

Back 77

See Common Criteria (CC).

Front 78

CCRA

Back 78

See Common Criteria Recognition Agreement (CCRA).

Front 79

CCTV

Back 79

See closed-circuit television (CCTV).

Front 80

Central office

Back 80

The primary office from which most resources extend.

Front 81

CERT

Back 81

See Computer Emergency Response Team (CERT).

Front 82

Certificate

Back 82

A digital entity that establishes who you are and is often used with e-commerce. It contains your name and other identifying data.

Front 83

Certificate authority (CA)

Back 83

An issuer of digital certificates (which are then used for digital signatures or key pairs). A certificate authority is occasionally referred to as a certification authority.

Front 84

Certificate policies

Back 84

Policies governing the use of certificates.

Front 85

Certificate Practice Statement (CPS)

Back 85

The principles and procedures employed in the issuing and managing of certificates.

Front 86

Certificate revocation

Back 86

The act of making a certificate invalid.

Front 87

Certificate Revocation List (CRL)

Back 87

A list of digital certificate revocations that must be regularly downloaded to stay current.

Front 88

Chain of custody

Back 88

The log of the history of evidence that has been collected.

Front 89

Challenge Handshake Authentication Protocol (CHAP)

Back 89

A protocol that challenges a system to verify identity. CHAP is an improvement over Password Authentication Protocol (PAP) in which one-way hashing is incorporated into a three-way handshake. RFC 1334 applies to both PAP and CHAP.

Front 90

Change documentation

Back 90

Documentation required to make a change in the scope of any particular item. In the realm of project management, a change document is a formal document requiring many signatures before key elements of the project can be modified.

Front 91

Checkpoint

Back 91

A certain action or moment in time that is used to perform a check. It allows a restart to begin at the last point the data was saved as opposed to from the beginning.

Front 92

Checksum

Back 92

A hexadecimal value computed from transmitted data that is used in error-checking routines.

Front 93

Cipher

Back 93

See cryptographic algorithm.

Front 94

Circuit switching

Back 94

A switching method where a dedicated connection between the sender and receiver is maintained throughout the conversation.

Front 95

CIRT

Back 95

See Computer Incident Response Team (CIRT).

Front 96

Clark-Wilson model

Back 96

An integrity model for creating a secure architecture.

Front 97

Clear text

Back 97

Unencrypted text that can be read with any editor.

Front 98

Client

Back 98

The part of a client/server network where the computing is usually done. In a typical setting, a client uses the server for remote storage, backups, or security (such as a firewall).

Front 99

Client/server network

Back 99

A server-centric network in which all resources are stored on a file server and processing power is distributed among workstations and the file server.

Front 100

Closed-circuit television (CCTV)

Back 100

A surveillance camera used for physical-access monitoring.

Front 101

Clustering

Back 101

A method of balancing loads and providing fault tolerance.

Front 102

Code escrow

Back 102

The storage and conditions for release of source code provided by a vendor, partner, or other party.

Front 103

Cold site

Back 103

A physical site that has all the resources necessary to enable an organization to use it if the main site is inaccessible (destroyed). Commonly, plans call for turning to a cold site within a certain number of hours after the loss of the main site.

Front 104

Collection of evidence

Back 104

The means and orderly fashion by which evidence is collected, identified, and marked.

Front 105

Collusion

Back 105

An agreement between individuals to commit fraud or deceit.

Front 106

Common Access Card (CAC)

Back 106

A standard identification card used by the Department of Defense (DoD) and other employers. It is used for authentication as well as identification.

Front 107

Common Criteria (CC)

Back 107

A document of specifications detailing security evaluation methods for IT products and systems.

Front 108

Common Criteria Recognition Agreement (CCRA)

Back 108

A set of standards, formerly known as the Mutual Recognition Agreement (MRA), that defines Evaluation Assurance Levels (EALs).

Front 109

Common Gateway Interface (CGI)

Back 109

An older form of scripting that was used extensively in early web systems.

Front 110

Companion virus

Back 110

A virus that creates a new program that runs in place of an expected program of the same name.

Front 111

Computer Emergency Response Team (CERT)

Back 111

A team of experts who respond to computer security incidents.

Front 112

Computer Incident Response Team (CIRT)

Back 112

A team of experts who respond to a security incident. The CIRT acronym is growing in popularity and quickly replacing CERT.

Front 113

Confidentiality

Back 113

Assurance that data remains private and no one sees it except for those expected to see it.

Front 114

Configuration management

Back 114

The administration of setup and changes to configurations.

Front 115

Connection-oriented

Back 115

Type of communications between two hosts that have a previous session established for synchronizing sent data. The receiving PC acknowledges the data. This method allows for guaranteed delivery of data between PCs. Within the TCP/IP suite, TCP is used for connection-oriented communications.

Front 116

Connectionless

Back 116

Type of communications between two hosts that have no previous session established for synchronizing sent data. The data isn't acknowledged at the receiving end. This method can allow data loss. Within the TCP/IP suite, the User Datagram Protocol (UDP) is used for connectionless communication.

Front 117

Cookie

Back 117

A plain-text file stored on your machine that contains information about you (and your preferences) and is used by a server.

Front 118

CPS

Back 118

See Certificate Practice Statement (CPS).

Front 119

Cracker

Back 119

See hacker.

Front 120

Critical business functions

Back 120

Functions on which the livelihood of the company depends.

Front 121

CRL

Back 121

See Certificate Revocation List (CRL).

Front 122

Cross-site request forgery (XSRF)

Back 122

A form of web-based attack in which unauthorized commands are sent from a user that a website trusts.

Front 123

Cryptanalysis

Back 123

The study and practice of finding weaknesses in ciphers.

Front 124

Cryptanalyst

Back 124

A person who does cryptanalysis.

Front 125

Cryptographer

Back 125

A person who participates in the study of cryptographic algorithms.

Front 126

Cryptographic algorithm

Back 126

A symmetric algorithm, also known as a cipher, used to encrypt and decrypt data.

Front 127

Cryptography

Back 127

The field of mathematics focused on encrypting and decrypting data.

Front 128

DAC

Back 128

See discretionary access control (DAC).

Front 129

Data integrity

Back 129

A quality that provides a level of confidence that data won't be jeopardized and will be kept secret.

Front 130

Data Link layer

Back 130

The second layer of the Open Systems Interconnection (OSI) model. It describes the physical topology of a network.

Front 131

Data packet

Back 131

A unit of data sent over a network. A packet includes a header, addressing information, and the data itself.

Front 132

Data repository

Back 132

A centralized storage location for data, such as a database.

Front 133

Data source

Back 133

Where data originates.

Front 134

Datagram

Back 134

An OSI Layer 3, User Datagram Protocol (UDP) packet descriptor.

Front 135

DDoS attack

Back 135

See Distributed Denial of Service (DDoS) attack.

Front 136

Decryption

Back 136

The process of converting encrypted data back into its original form.

Front 137

Default gateway

Back 137

The router to which all packets are sent when the workstation doesn't know where the destination station is or when it can't find the destination station on the local segment.

Front 138

Demilitarized zone (DMZ)

Back 138

An area for placing web and other servers outside the firewall, therefore, isolating them from internal network access.

Front 139

Denial of Service (DoS) attack

Back 139

A type of attack that prevents any users—even legitimate ones—from using a system.

Front 140

Destination port number

Back 140

A portion of a complete address of a PC to which data is being sent from a sending PC. The port portion allows for the demultiplexing of data to be sent to a specific application.

Front 141

Detection

Back 141

The act of noticing an irregularity as it occurs.

Front 142

DHCP

Back 142

See Dynamic Host Configuration Protocol (DHCP).

Front 143

Dictionary attack

Back 143

The act of attempting to crack passwords by testing them against a list of dictionary words. With today's powerful computers, an attacker can combine one of many available automated password-cracking utilities with several large dictionaries or “wordlists” and crack huge numbers of passwords in a matter of minutes. Any password based on any dictionary word is vulnerable to such an attack.

Front 144

Differential backup

Back 144

A type of backup that includes only new files or files that have changed since the last full backup. Differential backups differ from incremental backups in that they don't clear the archive bit upon their completion.

Front 145

Diffie-Hellman

Back 145

An asymmetric standard for exchanging keys. This cryptographic algorithm is used primarily to send secret keys across public networks. The process isn't used to encrypt or decrypt messages; it's used merely for the transmission of keys in a secure manner.

Front 146

Digital signature

Back 146

An asymmetrically encrypted signature whose sole purpose is to authenticate the sender.

Front 147

Direct-sequence (DS)

Back 147

A method of communication between wireless receivers.

Front 148

Direct-sequence spread spectrum (DSSS)

Back 148

A communications technology that is used to communicate in the 802.11 standard.

Front 149

Disaster recovery

Back 149

The act of recovering data following a disaster that has destroyed it.

Front 150

Disaster recovery plan (DRP)

Back 150

A plan outlining the procedure by which data is recovered after a disaster.

Front 151

Disk mirroring

Back 151

Technology that keeps identical copies of data on two disks to prevent the loss of data if one disk faults.

Front 152

Disk striping

Back 152

Technology that enables writing data to multiple disks simultaneously in small portions called stripes. These stripes maximize use by having all the read/write heads working constantly. Different data is stored on each disk and isn't automatically duplicated (this means disk striping in and of itself doesn't provide fault tolerance).

Front 153

Disk striping with parity

Back 153

A fault-tolerance solution of writing data across a number of disks and recording the parity on another. In the event any one disk fails, the data on it can be re-created by looking at the remaining data and computing parity to figure out the missing data.

Front 154

Distributed Denial of Service (DDoS) attack

Back 154

A derivative of a DoS attack in which multiple hosts in multiple locations all focus on one target to reduce its availability to the public. See Denial of Service (DoS) attack.

Front 155

DLP

Back 155

See Data Loss Prevention (DLP).

Front 156

DMZ

Back 156

See demilitarized zone (DMZ).

Front 157

DNS server

Back 157

Any server that performs address resolution from a DNS fully qualified domain name (FQDN) to an IP address. See also Domain Name Service (DNS), Internet Protocol (IP).

Front 158

DNS zone

Back 158

An area in the DNS hierarchy that is managed as a single unit. See also Domain Name Service (DNS).

Front 159

DoD Networking Model

Back 159

A four-layer conceptual model describing how communications should take place between computer systems. The four layers are Process/Application, Host-to-Host, Internet, and Network Access.

Front 160

DoS attack

Back 160

See Denial of Service (DoS) attack.

Front 161

DRP

Back 161

See disaster recovery plan (DRP).

Front 162

DS

Back 162

See direct-sequence (DS).

Front 163

Dual-homed host

Back 163

A host that resides on more than one network and possesses more than one physical network card.

Front 164

Dumb terminal

Back 164

A keyboard and monitor that send keystrokes to a central processing computer (typically a mainframe or minicomputer) that returns screen displays to the monitor. The unit has no processing power of its own, hence the moniker “dumb.”

Front 165

Dumpster diving

Back 165

Looking through trash for clues—often in the form of paper scraps—to find users' passwords and other pertinent information.

Front 166

Duplexed hard drives

Back 166

Two hard drives to which identical information is written simultaneously. A dedicated controller card controls each drive. Used for fault tolerance, and is known as RAID 1.

Front 167

Duplicate servers

Back 167

Two servers that are identical, for use in clustering.

Front 168

Dynamic Host Configuration Protocol (DHCP)

Back 168

A protocol used on a TCP/IP network to send client configuration data, including IP address, default gateway, subnet mask, and DNS configuration, to clients. DHCP uses a four-step process: Discover, Offer, Request, and Acknowledgement. See also default gateway, Domain Name Service (DNS), Transmission Control Protocol/Internet Protocol (TCP/IP).

Front 169

Dynamic packet filtering

Back 169

A type of firewall used to accept or reject packets based on their contents.

Front 170

Dynamic routing

Back 170

The use of route-discovery protocols to talk to other routers and find out what networks they are attached to. Routers that use dynamic routing send out special packets to request updates from the other routers on the network as well as to send their own updates.

Front 171

Dynamically allocated port

Back 171

A TCP/IP port that is not constantly used but accessed by an application when needed.

Front 172

EAL

Back 172

See Evaluation Assurance Level (EAL).

Front 173

EAP

Back 173

See Extensible Authentication Protocol (EAP).

Front 174

Eavesdropping

Back 174

Any type of passive attack that intercepts data in an unauthorized manner—usually in order to find passwords. Cable sniffing, wiretapping, and man-in-the-middle attacks are eavesdropping attacks.

Front 175

ECC

Back 175

See elliptic curve cryptography (ECC).

Front 176

EF

Back 176

See exposure factor (EF).

Front 177

Electromagnetic interference (EMI)

Back 177

The interference that can occur during transmissions over copper cable because of electromagnetic energy outside the cable. The result is degradation of the signal.

Front 178

Elliptic curve cryptography (ECC)

Back 178

A type of public key cryptosystem that requires a shorter key length than many other cryptography systems (including the de facto industry standard, RSA).

Front 179

EMI

Back 179

See electromagnetic interference (EMI).

Front 180

Encapsulating Security Payload (ESP)

Back 180

A header used to provide a mix of security services in IPv4 and IPv6. ESP can be used alone or in combination with the IP Authentication Header (AH).

Front 181

Encoding

Back 181

The process of translating data into signals that can be transmitted on a transmission medium.

Front 182

Encrypting File System (EFS)

Back 182

A feature in NTFS on Windows-based operating systems that allows for filesystem-level encryption to be applied.

Front 183

Encryption

Back 183

The process of converting data into a form that makes it less likely to be usable to anyone intercepting it if they can't decrypt it.

Front 184

Encryption key

Back 184

A string of alphanumeric characters used to decrypt encrypted data.

Front 185

Enticement

Back 185

The process of luring someone.

Front 186

Entrapment

Back 186

The process of encouraging an attacker to perform an act, even if they don't want to do it.

Front 187

Enumeration

Back 187

An attempt to gain information about a network by specifically targeting network resources, users and groups, and applications running on the system.

Front 188

Escalation

Back 188

The act of moving something up in priority. Often, when an incident is escalated, it's brought to the attention of the next-highest supervisor. See also privilege escalation.

Front 189

Evaluation Assurance Level (EAL)

Back 189

A level of assurance, expressed as a numeric value, based on standards set by the Common Criteria Recognition Agreement (CCRA).

Front 190

Event

Back 190

Any noticeable action or occurrence.

Front 191

Exposure factor (EF)

Back 191

A calculation of how much data (or other assets) could be lost from a single occurrence. If all the data on the network could be jeopardized by a single attack, the exposure factor is 100 percent.

Front 192

Extensible Authentication Protocol (EAP)

Back 192

An authentication protocol used in wireless networks and point-to-point connections.

Front 193

External threat

Back 193

A threat that originates from outside the company.

Front 194

Extranet

Back 194

Web (or similar) services set up in a private network to be accessed internally and by select external entities, such as vendors and suppliers.

Front 195

Extrusion

Back 195

Examining data leaving a network for signs of malicious traffic.

Front 196

Fail-over device

Back 196

A device that comes online when another fails.

Front 197

Fail-over server

Back 197

A hot-site backup system in which the fail-over server is connected to the primary server. A heartbeat is sent from the primary server to the backup server. If the heartbeat stops, the fail-over system starts and takes over. Thus, the system doesn't go down even if the primary server isn't running.

Front 198

Fail-over/failover

Back 198

The process of reconstructing a system or switching over to other systems when a failure is detected.

Front 199

False positive

Back 199

A flagged event that isn't really an event and has been falsely triggered.

Front 200

Faraday cage

Back 200

An electrically conductive wire mesh or other conductor woven into a “cage” that surrounds a room and prevents electromagnetic signals from entering or leaving the room through the walls.

Front 201

Fault tolerance

Back 201

The ability to withstand a fault (failure) without losing data.

Front 202

Fault-resistant network

Back 202

A network that is up and running at least 99 percent of the time or that is down less than 8 hours a year.

Front 203

Fault-tolerant network

Back 203

A network that can recover from minor errors.

Front 204

Federal Information Processing Standard (FIPS)

Back 204

An agreed-upon standard published under the Information Technology Management Reform Act. The secretary of commerce approves the standards after they're developed by the National Institute of Standards and Technology (NIST) for federal computer systems.

Front 205

File Transfer Protocol (FTP)

Back 205

TCP/IP and software that permit transferring files between computer systems and utilize clear-text passwords. Because FTP has been implemented on numerous types of computer systems, files can be transferred between disparate computer systems (for example, a personal computer and a minicomputer). See also Transmission Control Protocol/Internet Protocol (TCP/IP).

Front 206

Fire suppression

Back 206

The act of stopping a fire and preventing it from spreading.

Front 207

Firewall

Back 207

A combination of hardware and software that protects a network from attack by hackers who could gain access through public networks, including the Internet.

Front 208

Footprinting

Back 208

The process of systematically identifying the network and its security posture. This is typically a passive process.

Front 209

Forensics

Back 209

In terms of security, the act of looking at all the data at your disposal to try to figure out who gained unauthorized access and the extent of that access.

Front 210

Frequency-hopping spread spectrum (FHSS)

Back 210

A communications technology used to communicate in the 802.11 standard. FHSS accomplishes communication by hopping the transmission over a range of predefined frequencies.

Front 211

FTP

Back 211

See File Transfer Protocol (FTP).

Front 212

FTP proxy

Back 212

A server that uploads and downloads files from another server on behalf of a workstation.

Front 213

Full backup

Back 213

A backup that copies all data to the archive medium.

Front 214

Full distribution

Back 214

An information classification stating that the data so classified is available to anyone.

Front 215

Gramm-Leach-Bliley Act

Back 215

A government act containing rules on privacy of consumer finance information.

Front 216

Grandfather, Father, Son

Back 216

One of the most popular methods of backup tape rotation. Three sets of tapes are rotated in this method. The most recent backup after the full backup is the Son. As newer backups are made, the Son becomes the Father, and the Father, in turn, becomes the Grandfather. At the end of each month, a full backup is performed on all systems. This backup is stored in an off-site facility for a period of one year. Each monthly backup replaces the monthly backup from the previous year. Weekly or daily incremental backups are performed and stored until the next full backup occurs. This full backup is then stored off site, and the weekly or daily backup tapes are reused.

Front 217

Hardening

Back 217

The process of making an entity, usually an operating system, more secure by closing known holes and addressing known security issues.

Front 218

Hash value

Back 218

A single number used to represent an original piece of data.

Front 219

Hash/hashing

Back 219

The process of transforming characters into other characters that represent (but are not) the originals. Traditionally, the results are smaller and more secure than the original.

Front 220

Health Insurance Portability and Accountability Act (HIPAA)

Back 220

An act that addresses security and privacy of health-related data.

Front 221

High availability

Back 221

A clustering solution to provide resource reliability and availability.

Front 222

Hijacking (TCP/IP hijacking)

Back 222

See man-in-the-middle attack.

Front 223

HIPAA

Back 223

See Health Insurance Portability and Accountability Act (HIPAA).

Front 224

Hoax

Back 224

Typically an email message warning of something that isn't true, such as the outbreak of a new virus. The hoax can send users into a panic and cause more harm than the virus.

Front 225

Honeypot (also known as Honey pot)

Back 225

A bogus system set up to attract and slow down a hacker. A honeypot can also be used to learn of the hacking techniques and methods that hackers employ.

Front 226

Host

Back 226

Any network device with a TCP/IP network address.

Front 227

Host-based IDS (HIDS)

Back 227

An intrusion detection system that is host based. The alternative is network based.

Front 228

Host-based IPS (HIPS)

Back 228

An intrusion prevention system that is host based. To prevent the intrusion, it must first detect it (thus making it a superset of HIDS) and then act accordingly.

Front 229

Host-to-host

Back 229

Describes communication that occurs between hosts.

Front 230

Hostile code

Back 230

Any code that behaves in a way other than in the best interest of the user and the security of data.

Front 231

Hot fix/hotfix

Back 231

Another word for a patch. When Microsoft rolls a bunch of hotfixes together, they become known as a service pack.

Front 232

Hot site

Back 232

A location that can provide operations within hours of a failure.

Front 233

HTTP

Back 233

See Hypertext Transfer Protocol (HTTP).

Front 234

HTTPS

Back 234

See Hypertext Transfer Protocol over SSL.

Front 235

HVAC

Back 235

A common acronym for Heating, Ventilation, and Air Conditioning.

Front 236

Hypertext Markup Language (HTML)

Back 236

A set of codes used to format text and graphics that will be displayed in a browser. The codes define how data will be displayed.

Front 237

Hypertext Transfer Protocol (HTTP)

Back 237

The protocol used for communication between a web server and a web browser.

Front 238

Hypertext Transfer Protocol over SSL

Back 238

Also known as HTTPS and HTTP Secure. A combination of HTTP with Secure Sockets Layer (SSL) to make for a secure connection. It uses port 443 by default.

Front 239

IAB

Back 239

See Internet Architecture Board (IAB).

Front 240

IANA

Back 240

See Internet Assigned Numbers Authority (IANA).

Front 241

ICMP

Back 241

See Internet Control Message Protocol (ICMP).

Front 242

ICMP attack

Back 242

An attack that occurs by triggering a response from the Internet Control Message Protocol (ICMP) when it responds to a seemingly legitimate maintenance request. See also Internet Control Message Protocol (ICMP).

Front 243

Identification and authentication (I&A)

Back 243

A two-step process of identifying a person (usually when they log on) and authenticating them by challenging their claim to access a resource.

Front 244

IDS

Back 244

See intrusion detection system (IDS).

Front 245

IEEE

Back 245

See Institute of Electrical and Electronics Engineers, Inc. (IEEE).

Front 246

IEEE 802.10 LAN/MAN Security

Back 246

A series of guidelines dealing with various aspects of network security.

Front 247

IEEE 802.11

Back 247

A family of protocols that provides for wireless communications using radio-frequency transmissions.

Front 248

IEEE 802.11 Wireless LAN

Back 248

Defines the standards for implementing wireless technologies such as infrared and spread-spectrum radio.

Front 249

IETF

Back 249

See Internet Engineering Task Force (IETF).

Front 250

IGMP

Back 250

See Internet Group Management Protocol (IGMP).

Front 251

Illicit server

Back 251

An application/program that shouldn't be there but is operating on the network, and one that is commonly used to gain unauthorized control by allowing someone to bypass normal authentication. NetBus is one of the best-known examples of an illicit server.

Front 252

IM

Back 252

See instant messaging (IM).

Front 253

IMAP

Back 253

See Internet Message Access Protocol (IMAP).

Front 254

Incident

Back 254

An attempt to violate a security policy, a successful penetration, a compromise of a system, or unauthorized access to information.

Front 255

Incident response

Back 255

How an organization responds to an incident.

Front 256

Incident response plan (IRP)

Back 256

A policy that defines how an organization will respond to an incident.

Front 257

Incident response team (IRT)

Back 257

Also known as a Computer Security Incident Response Team (CSIRT). The group of individuals responsible for responding when a security breach has occurred.

Front 258

Incremental backup

Back 258

A type of backup in which only new files or files that have changed since the last full backup or the last incremental backup are included. Incremental backups clear the archive bit on files upon their completion.

Front 259

Information classification

Back 259

The process of determining what information is accessible to what parties and for what purposes.

Front 260

Information classification policies

Back 260

Written policies detailing dissemination of information.

Front 261

Information destruction policies

Back 261

Policies that define how information is destroyed when it has reached the end of its useful life.

Front 262

Information Flow model

Back 262

A model concerned with all the properties of information flow, not just the direction of the flow.

Front 263

Information policies

Back 263

Policies governing the various aspects of information security. Information policies include access, classifications, marking and storage, and the transmission and destruction of sensitive information. The development of information policies is critical to security.

Front 264

Information retention

Back 264

A designation of how long data is retained and any other significant considerations about information.

Front 265

Information security

Back 265

Security practices applied to information.

Front 266

Infrastructure

Back 266

The hardware and software necessary to run your network.

Front 267

Infrastructure security

Back 267

Security on the hardware and software necessary to run your network.

Front 268

Instant messaging (IM)

Back 268

Immediate communication that can be sent back and forth between users who are currently logged on. From a security standpoint, there are risks associated with giving out information via IM that can be used in social engineering attacks; in addition, attachments sent can contain viruses.

Front 269

Institute of Electrical and Electronics Engineers, Inc. (IEEE)

Back 269

An international organization that sets standards for various electrical and electronics issues.

Front 270

Integrated Services Digital Network (ISDN)

Back 270

A telecommunications standard that is used to digitally send voice, data, and video signals over the same lines.

Front 271

Integrity

Back 271

See data integrity.

Front 272

Interception

Back 272

The process of covertly obtaining information not meant for you. Interception can be an active or passive process.

Front 273

Internal information

Back 273

Information intended to remain within an organization.

Front 274

Internal threat

Back 274

A threat that arises from within an organization.

Front 275

International Data Encryption Algorithm (IDEA)

Back 275

An algorithm that uses a 128-bit key. This product is similar in speed and capability to Digital Encryption Standard (DES), but it's more secure. IDEA is used in Pretty Good Privacy (PGP).

Front 276

International Organization for Standardization (ISO)

Back 276

The standards organization that developed the Open Systems Interconnection (OSI) model. This model provides a guideline for how communications occur between computers.

Front 277

International Telecommunications Union (ITU)

Back 277

Organization responsible for communications standards, spectrum management, and the development of communications infrastructures in underdeveloped nations.

Front 278

Internet

Back 278

A global network made up of a large number of individual networks that are interconnected and use TCP/IP. See also Transmission Control Protocol/Internet Protocol (TCP/IP).

Front 279

Internet Architecture Board (IAB)

Back 279

The committee that oversees management of the Internet. It's made up of two subcommittees: the Internet Engineering Task Force (IETF) and the Internet Research Task Force (IRTF). See also Internet Engineering Task Force (IETF) and Internet Research Task Force (IRTF).

Front 280

Internet Assigned Numbers Authority (IANA)

Back 280

The organization responsible for governing IP addresses. http://www.iana.org.

Front 281

Internet Control Message Protocol (ICMP)

Back 281

A message and management protocol for TCP/IP. The Ping utility uses ICMP. See also Ping, Transmission Control Protocol/Internet Protocol (TCP/IP).

Front 282

Internet Engineering Task Force (IETF)

Back 282

An international organization that works under the Internet Architecture Board to establish standards and protocols relating to the Internet. See also Internet Architecture Board (IAB).

Front 283

Internet Group Management Protocol (IGMP)

Back 283

A protocol used for multicasting operations across the Internet.

Front 284

Internet layer

Back 284

The network layer responsible for routing, IP addressing, and packaging.

Front 285

Internet Message Access Protocol (IMAP)

Back 285

A protocol with a store-and-forward capability. It can also allow messages to be stored on an email server instead of downloaded to the client.

Front 286

Internet Protocol (IP)

Back 286

The protocol in the TCP/IP suite responsible for network addressing. See also Transmission Control Protocol/Internet Protocol (TCP/IP).

Front 287

Internet Research Task Force (IRTF)

Back 287

An international organization that works under the Internet Architecture Board to research new Internet technologies. See also Internet Architecture Board (IAB).

Front 288

Internet service provider (ISP)

Back 288

A company that provides direct access to the Internet for home and business computer users.

Front 289

Internet Society (ISOC)

Back 289

A professional membership group composed primarily of Internet experts. It oversees a number of committees and groups, including the Internet Engineering Task Force (IETF).

Front 290

Intranet

Back 290

Web (or similar) services set up in a private network to be accessed internally only.

Front 291

Intrusion

Back 291

The act of entering a system without authorization to do so.

Front 292

Intrusion detection system (IDS)

Back 292

Tools that identify and respond to attacks using defined rules or logic. An IDS can be network based or host based.

Front 293

Intrusion detector

Back 293

The item/application performing intrusion detection. See also intrusion detection system (IDS).

Front 294

IP proxy

Back 294

A server that acts as a go-between for clients accessing the Internet. All communications look as if they originated from a proxy server because the IP address of the user making a request is hidden. Also known as Network Address Translation (NAT).

Front 295

IP Security (IPSec)

Back 295

A set of protocols that enable encryption, authentication, and integrity over IP. IPSec is commonly used with virtual private networks (VPNs) and operates at Layer 3.

Front 296

IP spoofing

Back 296

An attack during which a hacker tries to gain access to a network by pretending their interface has the same network address as the internal network.

Front 297

ISP

Back 297

See Internet service provider (ISP).

Front 298

JavaScript

Back 298

A programming language that allows access to system resources of the system running the script. These scripts can interface with all aspects of an operating system just like programming languages, such as the C language.

Front 299

Journaling

Back 299

The ability of a filesystem to use a log file of all changes and transactions that have occurred within a set period of time (for example, the last few hours). If a crash occurs, the operating system can look at the log files to see what transactions have been committed and which ones have not.

Front 300

Kerberos

Back 300

An authentication scheme that uses tickets (unique keys) embedded within messages. Named after the three-headed guard dog that stood at the gates of Hades in Greek mythology.

Front 301

Key distribution center (KDC)

Back 301

An organization/facility that generates keys for users.

Front 302

Key escrow agency

Back 302

An agency that stores keys for the purpose of law-enforcement access.

Front 303

Key Exchange Algorithm (KEA)

Back 303

A method of offering mutual authentication and establishing data encryption keys.

Front 304

Key generation

Back 304

The act of creating keys for use by users.

Front 305

Key suspension

Back 305

The temporary deferment of a key for a period of time (such as for a leave of absence).

Front 306

Key/certificate life cycle

Back 306

The time during which the processes of a key or certificate take place.

Front 307

Keyed-Hash Message Authentication Code (HMAC)

Back 307

“A mechanism for message authentication using cryptographic hash functions” per the draft of the Federal Information Processing Standard (FIPS) publication. Addressed in RFC 2104.

Front 308

Latency

Back 308

The wait time between the call for an action or activity and the actual execution of that action.

Front 309

Lattice

Back 309

The concept that access differs at different levels. Often used in discussion with the Biba and Bell-LaPadula models as well as with cryptography to differentiate between security levels based on user/group labels.

Front 310

Layer 2 Forwarding (L2F)

Back 310

A tunneling protocol often used with virtual private networks (VPNs). L2F was developed by Cisco.

Front 311

Layer 2 Tunneling Protocol (L2TP)

Back 311

A tunneling protocol that adds functionality to the Point-to-Point Protocol (PPP). This protocol was created by Microsoft and Cisco and is often used with virtual private networks (VPNs).

Front 312

Lightweight Directory Access Protocol (LDAP)

Back 312

A set of protocols that was derived from X.500 and operates at port 389.

Front 313

Limited distribution

Back 313

Describes information that isn't intended for release to the public. This category of information isn't secret, but it's private.

Front 314

Link Control Protocol (LCP)

Back 314

The protocol used to establish, configure, and test the link between a client and PPP host. See also Point-to-Point Protocol (PPP).

Front 315

Local area network (LAN)

Back 315

A network that is restricted to a single building, group of buildings, or even a single room. A LAN can have one or more servers.

Front 316

Local registration authority (LRA)

Back 316

An authority used to identify or establish the identity of an individual for certificate issuance.

Front 317

Logic bomb

Back 317

Any code that is hidden within an application and causes something unexpected to happen based on some criteria being met. For example, a programmer could create a program that always makes sure his name appears on the payroll roster; if it doesn't, then key files begin to be erased.

Front 318

Logs and inventories

Back 318

Tools used to help an organization know what is happening to its systems and assets. System logs tell what is happening with the systems in the network. Inventories refer to both the physical assets and the software assets a company owns.

Front 319

M of N Control method

Back 319

A rule stating that in order to access the key server if n number of administrators have the ability to perform a process, m number of those administrators must authenticate for access to occur. M of N Control may involve physical presence.

Front 320

MAC

Back 320

See Media Access Control (MAC), Mandatory Access Control (MAC), and message authentication code (MAC).

Front 321

MAC address

Back 321

The address that is either assigned to a network card or burned into the network interface card (NIC). PCs use MAC addresses to keep track of one another and keep each other separate.

Front 322

Macro virus

Back 322

A software exploitation virus that works by using the macro feature included in many applications.

Front 323

Malicious code

Back 323

Any code that is meant to do harm.

Front 324

Man-in-the-middle attack

Back 324

An attack that occurs when someone/something that is trusted intercepts packets and retransmits them to another party. Man-in-the-middle attacks have also been called TCP/IP hijacking in the past.

Front 325

Mandatory Access Control (MAC)

Back 325

A security policy wherein labels are used to identify the sensitivity of objects. When a user attempts to access an object, the label is checked to see if access should be allowed (that is, whether the user is operating at the same sensitivity level). This policy is “mandatory,” because labels are automatically applied to all data (and can be changed only by administrative action), as opposed to “discretionary” policies that leave it up to the user to decide whether to apply a label.

Front 326

Mantrap

Back 326

A device, such as a small room, that limits access to one or a few individuals. Mantraps typically use electronic locks and other methods to control access.

Front 327

Mathematical attack

Back 327

An attack focused on the encryption algorithm itself, the key mechanism, or any potential area of weakness in the algorithm.

Front 328

Mean time between failure (MTBF)

Back 328

The measure of the anticipated incidence of failure of a system or component.

Front 329

Mean time to repair (MTTR)

Back 329

The measurement of how long it takes to repair a system or component once a failure occurs.

Front 330

Media Access Control (MAC)

Back 330

A sublayer of the Data Link layer of the Open Systems Interconnection (OSI) model that controls the way multiple devices use the same media channel. It controls which devices can transmit and when they can transmit.

Front 331

MAC address

Back 331

The address that is either assigned to a network card or burned into the network interface card (NIC). PCs use MAC addresses to keep track of one another and keep each other separate.

Front 332

Macro virus

Back 332

A software exploitation virus that works by using the macro feature included in many applications.

Front 333

Malicious code

Back 333

Any code that is meant to do harm.

Front 334

Man-in-the-middle attack

Back 334

An attack that occurs when someone/something that is trusted intercepts packets and retransmits them to another party. Man-in-the-middle attacks have also been called TCP/IP hijacking in the past.

Front 335

Mandatory Access Control (MAC)

Back 335

A security policy wherein labels are used to identify the sensitivity of objects. When a user attempts to access an object, the label is checked to see if access should be allowed (that is, whether the user is operating at the same sensitivity level). This policy is “mandatory,” because labels are automatically applied to all data (and can be changed only by administrative action), as opposed to “discretionary” policies that leave it up to the user to decide whether to apply a label.

Front 336

Mantrap

Back 336

A device, such as a small room, that limits access to one or a few individuals. Mantraps typically use electronic locks and other methods to control access.

Front 337

Mathematical attack

Back 337

An attack focused on the encryption algorithm itself, the key mechanism, or any potential area of weakness in the algorithm.

Front 338

Mean time between failure (MTBF)

Back 338

The measure of the anticipated incidence of failure of a system or component.

Front 339

Mean time to repair (MTTR)

Back 339

The measurement of how long it takes to repair a system or component once a failure occurs.

Front 340

Media Access Control (MAC)

Back 340

A sublayer of the Data Link layer of the Open Systems Interconnection (OSI) model that controls the way multiple devices use the same media channel. It controls which devices can transmit and when they can transmit.

Front 341

Message authentication code (MAC)

Back 341

A common method of verifying integrity. The MAC is derived from the message and a secret key.

Front 342

Message digest

Back 342

The signature area within a message.

Front 343

Message Digest Algorithm (MDA)

Back 343

An algorithm that creates a hash value. The hash value is also used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.

Front 344

Microsoft Challenge Handshake Authentication Protocol (MSCHAP)

Back 344

An implementation of the Challenge Handshake Authentication Protocol (CHAP) common in Microsoft's Windows-based operating systems. The latest version, and the only one supported in Windows Vista, is MSCHAPv2.

Front 345

Misuse-detection IDS (MD-IDS)

Back 345

A method of evaluating attacks based on attack signatures and audit trails.

Front 346

Modification attack

Back 346

An attack that modifies information on your system.

Front 347

Multi-factor

Back 347

The term employed anytime more than one factor must be considered.

Front 348

Multicasting

Back 348

Sending data to more than one address.

Front 349

Multipartite virus

Back 349

A virus that attacks a system in more than one way.

Front 350

NAT

Back 350

Network Address Translation. See IP proxy.

Front 351

National Computing Security Center (NCSC)

Back 351

The agency that developed the Trusted Computer System Evaluation Criteria (TCSEC) and the Trusted Network Interpretation Environmental Guideline (TNIEG).

Front 352

National Institute of Standards and Technology (NIST)

Back 352

An agency (formerly known as the National Bureau of Standards [NBS]) that has been involved in developing and supporting standards for the U.S. government for over 100 years. NIST has become involved in cryptography standards, systems, and technology in a variety of areas. It's primarily concerned with governmental systems, where it exercises a great deal of influence.

Front 353

National Security Agency (NSA)

Back 353

The U.S. government agency responsible for protecting U.S. communications and producing foreign intelligence information. It was established by presidential directive in 1952 as a separately organized agency within the Department of Defense (DoD).

Front 354

Need-to-know

Back 354

A method of information dissemination based on passing information only to those who need to know it.

Front 355

Network

Back 355

A group of devices connected by some means for the purpose of sharing information or resources.

Front 356

Network Access Control (NAC)

Back 356

The set of standards defined by the network for clients attempting to access it. Usually, NAC requires that clients be virus free and adhere to specified policies before allowing them on the network.

Front 357

Network Address Translation (NAT)

Back 357

See IP proxy.

Front 358

Network attached storage

Back 358

Storage, such as hard drives, attached to a network for the purpose of storing data for clients on the network. Network attached storage is commonly used for backing up data.

Front 359

Network Control Protocol (NCP)

Back 359

The protocol Point-to-Point Protocol (PPP) employs for encapsulating network traffic.

Front 360

Network File System (NFS)

Back 360

A protocol that enables users to access files on remote computers as if the files were local.

Front 361

Network interface card (NIC)

Back 361

A physical device that connects computers and other network equipment to the transmission medium.

Front 362

Network Interface layer

Back 362

The lowest level of the TCP/IP suite; it is responsible for placing and removing packets on the physical network.

Front 363

Network layer

Back 363

The third layer of the OSI model, it is responsible for logical addressing and translating logical names into physical addresses. This layer also controls the routing of data from source to destination as well as the building and dismantling of packets. See also Open Systems Interconnection (OSI) model.

Front 364

Network operating system (NOS)

Back 364

The software enabling networking; NOS can be on a LAN or WAN.

Front 365

Network Operations Center (NOC)

Back 365

A single, centralized area for network monitoring and administrative control of systems.

Front 366

Network sniffer

Back 366

A device that has access to the signaling on the network cable.

Front 367

Network-based IDS (N-IDS)

Back 367

An approach to an intrusion detection system (IDS), it attaches the system to a point in the network where it can monitor and report on all network traffic.

Front 368

Network-based IPS (N-IPS )

Back 368

See host-based IPS (H-IPS).

Front 369

Network-based IPS (N-IPS)

Back 369

An intrusion prevention system that is network based. To prevent the intrusion, it must first detect it (thus making it a superset of IDS), and then act accordingly.

Front 370

Non-repudiation

Back 370

Verifying (by whatever means) that data was seen by an intended party. It makes sure they received the data and can't repudiate (dispute) that it arrived.

Front 371

Nonessential service

Back 371

A service that isn't necessary to keep the server operating at the expected level in its expected role.

Front 372

Noninterference model

Back 372

A model intended to ensure that higher-level security functions don't interfere with lower-level functions.

Front 373

Notification

Back 373

The act of being alerted to an event.

Front 374

Notification policies

Back 374

A set of rules about what triggers notification.

Front 375

NSA

Back 375

See National Security Agency (NSA).

Front 376

Off-site storage

Back 376

Storing data off the premise, usually in a secure location.

Front 377

On-site storage

Back 377

Storing backup data at the same site as the servers on which the original data resides.

Front 378

One-tier model

Back 378

A model in which the database and applications exist on the same system.

Front 379

One-time pad

Back 379

Words added to values during authentication. The message to be encrypted is added to this random text before hashing.

Front 380

Open Shortest Path First (OSPF)

Back 380

A link-state routing protocol used in IP networks.

Front 381

Open Systems Interconnection (OSI) model

Back 381

A model defined by the ISO to categorize the process of communication between computers in terms of seven layers. The seven layers are Application, Presentation, Session, Transport, Network, Data Link, and Physical. See also International Organization for Standardization (ISO).

Front 382

Operational security

Back 382

Security as it relates to how an organization does things (operates).

Front 383

Operator

Back 383

The person primarily responsible for the intrusion detection system (IDS).

Front 384

OS hardening

Back 384

The process of applying all security patches and fixes to an operating system to make it as secure as possible.

Front 385

Out-of-band method

Back 385

A way to transmit the encryption key by using a method other than the one used to transmit the data. The key value is sent by letter, by courier, or by some other separate means.

Front 386

OVAL

Back 386

An acronym for Open Vulnerability and Assessment Language, it is a community standard for system analysis that focuses on testing, analyzing, and reporting.

Front 387

Owner

Back 387

The person responsible for the current existence of a resource.

Front 388

Packet filtering

Back 388

A firewall technology that accepts or rejects packets based on their content.

Front 389

Packet switching

Back 389

The process of breaking messages into packets at the sending router for easier transmission over a WAN.

Front 390

Pad

Back 390

A number of characters often added to data before an operation such as hashing takes place. Most often unique values, known as one-time pads, are added to make the resulting hash unique.

Front 391

Partitioning

Back 391

The process of breaking a network into smaller components that can be individually protected.

Front 392

Passive detection

Back 392

A type of intruder detection that logs all network events to a file for an administrator to view later.

Front 393

Passive response

Back 393

A nonactive response, such as logging. Passive response is the most common type of response to many intrusions. In general, passive responses are the easiest to develop and implement.

Front 394

Password Authentication Protocol (PAP)

Back 394

One of the simplest forms of authentication. Authentication is accomplished by sending the username and password to the server and having them verified. Passwords are sent as clear text and, therefore, can be easily seen if intercepted.

Front 395

Password guessing

Back 395

Attempting to enter a password by guessing its value.

Front 396

Password history

Back 396

A list of passwords that have already been used.

Front 397

PAT

Back 397

See Port Address Translation (PAT).

Front 398

Patch

Back 398

A fix for a known software problem.

Front 399

Penetration

Back 399

The act of gaining access.

Front 400

Perimeter security

Back 400

Security set up on the outside of the network or server to protect it.

Front 401

Personal electronic device (PED)

Back 401

Any electronic device transported by a user. Examples include smartphones, electronic book readers, and music players.

Front 402

PGP

Back 402

See Pretty Good Privacy (PGP).

Front 403

Phage virus

Back 403

A virus that modifies and alters other programs and databases.

Front 404

Phishing

Back 404

A form of social engineering in which you simply ask someone for a piece of information that you are missing by making it look as if it is a legitimate request. Commonly sent via email.

Front 405

Phreaker

Back 405

Someone who abuses phone systems, as opposed to data systems.

Front 406

Physical access control

Back 406

Control access measures used to restrict physical access to the server(s).

Front 407

Physical barrier

Back 407

An object, such as a locked door, used to restrict physical access to network components.

Front 408

Physical layer

Back 408

The first layer of the OSI model; controls the functional interface. See also Open Systems Interconnection (OSI) model.

Front 409

Physical port

Back 409

On a computer, an interface where you can connect a device.

Front 410

Physical security

Back 410

Security that guards the physical aspects of the network.

Front 411

Ping

Back 411

A TCP/IP utility used to test whether another host is reachable. An Internet Control Message Protocol (ICMP) request is sent to the host, which responds with a reply if it's reachable. The request times out if the host isn't reachable.

Front 412

Ping of death

Back 412

A large Internet Control Message Protocol (ICMP) packet sent to overflow the remote host's buffer. A ping of death usually causes the remote host to reboot or hang.

Front 413

Plain old telephone service (POTS)

Back 413

Standard telephone service, as opposed to other connection technologies like Digital Subscriber Line (DSL).

Front 414

Point-to-point

Back 414

Network communication in which two devices have exclusive access to a network medium. For example, a printer connected to only one workstation is using a point-to-point connection.

Front 415

Point-to-Point Protocol (PPP)

Back 415

A full-duplex line protocol that supersedes Serial Line Internet Protocol (SLIP). It's part of the standard TCP/IP suite and is often used in dial-up connections.

Front 416

Point-to-Point Tunneling Protocol (PPTP)

Back 416

An extension to Point-to-Point Protocol (PPP) that is used in virtual private networks (VPNs). An alternative to PPTP is L2TP.

Front 417

Policies

Back 417

Rules or standards governing usage. These are typically high level in nature.

Front 418

Polymorphic

Back 418

An attribute of some viruses that allows them to mutate and appear differently each time they crop up. The mutations make it harder for virus scanners to detect (and react) to the viruses.

Front 419

Port

Back 419

Some kind of opening that allows network data to pass through.

Front 420

Port Address Translation (PAT)

Back 420

A means of translating between ports on a public and private network. Similar to Network Address Translation (NAT), which translates addresses between public and private.

Front 421

Port scanner

Back 421

The item (physical or software) that scans a server for open ports that can be taken advantage of. Port scanning is the process of sending messages to ports to see which ones are available and which ones aren't.

Front 422

Post Office Protocol (POP)

Back 422

An email access program that can be used to retrieve email from an email server.

Front 423

Post Office Protocol Version 3 (POP3)

Back 423

The protocol used to download email from an SMTP email server to a network client. See also Simple Mail Transfer Protocol (SMTP).

Front 424

Postmortem

Back 424

Anything that occurs “after the fact,” such as an audit or review.

Front 425

POTS

Back 425

See plain old telephone service (POTS).

Front 426

Power conditioner

Back 426

A device that “conditions” the electrical supply to take out spikes and surges.

Front 427

Power system

Back 427

A device that provides electrical power.

Front 428

PPP

Back 428

See Point-to-Point Protocol (PPP).

Front 429

PPTP

Back 429

See Point-to-Point Tunneling Protocol (PPTP).

Front 430

Presentation layer

Back 430

The sixth layer of the OSI model; responsible for formatting data exchange, such as graphic commands, and converting character sets. This layer is also responsible for data compression, data encryption, and data stream redirection. See also Open Systems Interconnection (OSI) model.

Front 431

Preservation of evidence

Back 431

The process of controlling access to evidence within chain-of-custody measures, often by placing it in a controlled-access area with a single custodian responsible for all access.

Front 432

Pretty Good Privacy (PGP)

Back 432

An implementation of RSA encryption. See also RSA.

Front 433

Privacy

Back 433

A state of security in which information isn't seen by unauthorized parties without the express permission of the party involved.

Front 434

Private Branch Exchange (PBX)

Back 434

A system that allows users to connect voice, data, pagers, networks, and almost any other application into a single telecommunications system. A PBX system allows an organization to be its own phone company.

Front 435

Private information

Back 435

Information that isn't for public knowledge.

Front 436

Private key

Back 436

An asymmetric encryption technology in which both the sender and the receiver have different keys. A public key is used to encrypt messages and the private key is used to decrypt them. See also public key.

Front 437

Private network

Back 437

The part of a network that lies behind a firewall and isn't “seen” on the Internet. See also firewall.

Front 438

Promiscuous mode

Back 438

A mode wherein a network interface card (NIC) intercepts all traffic crossing the network wire and not just the traffic intended for it.

Front 439

Protocol analyzer

Back 439

A software and hardware troubleshooting tool that is used to decode protocol information to try to determine the source of a network problem and to establish baselines.

Front 440

Protocols

Back 440

Standards or rules.

Front 441

Proxy

Back 441

A type of firewall that prevents direct communication between a client and a host by acting as an intermediary. See also firewall.

Front 442

Proxy cache server

Back 442

An implementation of a web proxy. The server receives an HTTP request from a web browser and makes the request on behalf of the sending workstation. When the response comes, the proxy cache server caches a copy of the response locally. The next time someone makes a request for the same web page or Internet information, the proxy cache server can fulfill the request out of the cache instead of having to retrieve the resource from the Web.

Front 443

Proxy firewall

Back 443

A proxy server that also acts as a firewall, blocking network access from external networks.

Front 444

Proxy server

Back 444

A type of server that makes a single Internet connection and services requests on behalf of many users.

Front 445

Public information

Back 445

Information that is publicly made available to all.

Front 446

Public key

Back 446

A technology that uses two keys—a public key and a private key—to facilitate communication. The public key is used to encrypt a message to a receiver. See also private key.

Front 447

Public Key Cryptography Standards (PKCS)

Back 447

A set of voluntary standards created by RSA security and industry security leaders.

Front 448

Public Key Infrastructure (PKI)

Back 448

A two-key encryption system wherein messages are encrypted with a private key and decrypted with a public key.

Front 449

Public Key Infrastructure X.509 (PKIX)

Back 449

The Internet Engineering Task Force (IETF) working group developing standards and models for the Public Key Infrastructure (PKI) environment. The most current version is v3.

Front 450

Public key system

Back 450

An encryption system employing a key that is known to users beyond the recipient.

Front 451

Public network

Back 451

The part of a network outside a firewall that is exposed to the public. See also firewall.

Front 452

Quantum cryptography

Back 452

Cryptography based on changing the polarity of a photon. Quantum cryptography makes the process of interception difficult because any attempt to intercept the message changes the value of the message.

Front 453

Radio frequency (RF)

Back 453

The part of the radio spectrum that a device uses.

Front 454

Radio frequency interference (RFI)

Back 454

The byproduct of electrical processes, similar to electromagnetic interference. The major difference is that RFI is usually projected across a radio spectrum.

Front 455

RADIUS

Back 455

See Remote Authentication Dial-In User Service (RADIUS).

Front 456

RAID

Back 456

See Redundant Array of Independent (or Inexpensive) Disks (RAID).

Front 457

RAID levels

Back 457

The different types of RAID, such as RAID-0, RAID-1, and so on.

Front 458

RBAC

Back 458

See role-based access control (RBAC).

Front 459

RC5

Back 459

See Rivest Cipher 5 (RC5).

Front 460

Redundant Array of Independent (or Inexpensive) Disks (RAID)

Back 460

A configuration of multiple hard disks used to provide fault tolerance, should a disk fail, or gains in efficiency. Different levels of RAID exist.

Front 461

Registration authority (RA)

Back 461

An organization that offloads some of the work from a certificate authority (CA). An RA system operates as a middleman in the process. The RA can distribute keys, accept registrations for the CA, and validate identities. The RA doesn't issue certificates; that responsibility remains with the CA.

Front 462

Remote access protocol

Back 462

Any networking protocol that is used to gain access to a network over public communication links.

Front 463

Remote access server (RAS)

Back 463

A computer that has one or more modems installed to enable remote connections to the network.

Front 464

Remote Authentication Dial-In User Service (RADIUS)

Back 464

A mechanism that allows authentication of dial-in and other network connections. RADIUS is commonly used by Internet service providers (ISPs) and in the implementation of virtual private networks (VPNs).

Front 465

Replay attack

Back 465

Any attack where the data is retransmitted repeatedly (often fraudulently or maliciously). In one such possibility, a user can replay a web session and visit sites intended only for the original user.

Front 466

Replication

Back 466

The process of copying directory information to other servers to keep them all synchronized.

Front 467

Repository

Back 467

A database or database server where the certificates are stored.

Front 468

Repudiation attack

Back 468

An attack in which the intruder modifies information in a system.

Front 469

Request for Comments (RFC)

Back 469

A document-creation process and a set of practices that originated in 1969 and is used for proposed changes to Internet standards.

Front 470

Response

Back 470

How you react to an event.

Front 471

Restricted information

Back 471

Information that isn't made available to all and to which access is granted based on some criteria.

Front 472

Retrovirus

Back 472

A virus that attacks or bypasses the antivirus software installed on a computer.

Front 473

Reverse DNS

Back 473

Using an IP address to find a domain name rather than using a domain name to find an IP address (normal DNS). Pointer (PTR) records are used for the reverse lookup, and often reverse DNS is used to authenticate incoming connections.

Front 474

Reverse engineering

Back 474

The process of re-creating the functionality of an item by first deciding what the result is and then creating something from scratch that serves the same purpose.

Front 475

Revocation

Back 475

The process of canceling credentials that have been lost or stolen (or are no longer valid). With certificates, revocation is accomplished with a Certificate Revocation List (CRL).

Front 476

RIP

Back 476

See Routing Information Protocol (RIP).

Front 477

Risk analysis

Back 477

An evaluation of each risk that can be identified. Each risk should be outlined, described, and evaluated on the likelihood of it occurring.

Front 478

Risk assessment

Back 478

An evaluation of how much risk you and your organization are willing to take. An assessment must be performed before any other actions—such as how much to spend on security in terms of dollars and manpower—can be decided.

Front 479

Rivest Cipher 5 (RC5)

Back 479

A cipher algorithm created by Ronald Rivest (for RSA) and known for its speed. It works through blocks of variable sizes using three phases: key expansion, encryption, and decryption.

Front 480

Roaming profile

Back 480

A profile downloaded from a server at each logon. When a user logs out at the end of the session, changes are made and remembered for the next time the user logs on.

Front 481

Rogue server

Back 481

An active Dynamic Host Configuration Protocol (DHCP) server that has been added to the network and is now leasing addresses to users instead of them obtaining an address from your server.

Front 482

Role-based access control (RBAC)

Back 482

A type of control wherein the levels of security closely follow the structure of an organization. The role the person plays in the organization (accountant, salesman, and so on) corresponds to the level of security access they have to data.

Front 483

Rootkit

Back 483

Software program that has the ability to obtain root-level access and hide certain things from the operating system.

Front 484

Route

Back 484

The path to get to the destination from a source.

Front 485

Route cost

Back 485

The number of router hops between the source and the destination in an internetwork.

Front 486

Router

Back 486

A device that connects two or more networks and allows packets to be transmitted and received between them. A router determines the best path for data packets from source to destination.

Front 487

Routing

Back 487

A function of the Network layer that involves moving data throughout a network. Data passes through several network subnetworks using routers that can select the path the data takes. See also router.

Front 488

Routing Information Protocol (RIP)

Back 488

A distance-vector route discovery protocol used by Internetwork Packet Exchange (IPX) and Internet Protocol (IP). IPX uses hops and ticks to determine the cost for a particular route. See also Internetwork Packet Exchange (IPX).

Front 489

Routing table

Back 489

A table that contains information about the locations of other routers on the network and their distance from the current router.

Front 490

RSA

Back 490

One of the providers of cryptography systems to industry and government. RSA stands for the initials of the three founders of RSA Security Inc.: Rivest, Shamir, and Adleman. RSA maintains a list of standards for Public Key Cryptography Standards (PKCS).

Front 491

Rule Set-Based Access Control (RSBAC)

Back 491

An open-source access control framework for the Linux kernel that uses access control modules to implement Mandatory Access Control (MAC).

Front 492

S-HTTP

Back 492

See Secure Hypertext Transfer Protocol (S-HTTP).

Front 493

Sandbox

Back 493

A set of rules used when creating a Java applet that prevents certain functions when the applet is sent as part of a web page.

Front 494

Scanning

Back 494

The process that attackers use to gather information about how a network is configured.

Front 495

Secret key

Back 495

See private key.

Front 496

Secure Electronic Transaction (SET)

Back 496

A protocol developed by Visa and MasterCard for secure credit card transactions. The protocol is becoming an accepted standard by many companies. SET provides encrypted credit card numbers over the Internet, and it's most suited to small amounts of data transmission.

Front 497

Secure Hash Algorithm (SHA)

Back 497

A one-way hash algorithm designed to ensure the integrity of a message.

Front 498

Secure Hypertext Transfer Protocol (S-HTTP)

Back 498

A protocol used for secure communications between a web server and a web browser.

Front 499

Secure Shell (SSH)

Back 499

A replacement for rlogin in Unix/Linux that includes security. rlogin allowed one host to establish a connection with another with no real security being employed; SSH replaces it with slogin and digital certificates.

Front 500

Secure Sockets Layer (SSL)

Back 500

A protocol that secures messages by operating between the Application layer (HTTP) and the Transport layer.

Front 501

Secure WLAN Protocol (SWP)

Back 501

A method of securing wireless networks that is beginning to gain momentum and acceptance.

Front 502

Security Accounts Manager (SAM)

Back 502

A database within Windows NT–based operating systems that contains information about all users and groups and their associated rights and settings within a domain.

Front 503

Security audit

Back 503

An audit of the system (host, network, and so on) for security vulnerabilities and holes.

Front 504

Security log

Back 504

A log file used in Windows NT to keep track of security events specified by the domain's audit policy.

Front 505

Security policies

Back 505

Rules set in place by a company to ensure the security of a network. These may include how often a password must be changed or how many characters a password should be.

Front 506

Security token

Back 506

A piece of data that contains the rights and access privileges of the token bearer as part of the token.

Front 507

Security zone

Back 507

A method of isolating a system from other systems or networks.

Front 508

Segment

Back 508

A unit of data transmission found at the Transport layer of the Open Systems Interconnection (OSI) model and used by TCP.

Front 509

Sensor

Back 509

A device that collects data from the data source and passes it on to the analyzer.

Front 510

Separation of duties

Back 510

A set of policies designed to reduce the risk of fraud and prevent other losses in an organization.

Front 511

Sequence number

Back 511

A number used to determine the order in which parts of a packet are to be reassembled after the packet has been split into sections.

Front 512

Serial Line Internet Protocol (SLIP)

Back 512

An older protocol that was used in early remote-access environments. SLIP was originally designed to connect Unix systems together in a dial-up environment, and it supports only serial communications.

Front 513

Server

Back 513

A computer that provides resources to the clients on the network.

Front 514

Server and client configuration

Back 514

A network in which the resources are located on a server and accessed by clients.

Front 515

Server authentication

Back 515

A process that requires the workstation to authenticate against the server.

Front 516

Service

Back 516

An item that adds functionality to a network by providing resources or doing tasks for other computers.

Front 517

Service account

Back 517

An account created on a server for a user to perform special services, such as a backup operator, an account operator, and a server operator.

Front 518

Service pack

Back 518

Operating system updates from Microsoft.

Front 519

Service-level agreement (SLA)

Back 519

An agreement that specifies performance requirements for a vendor. This agreement may use mean time before failure (MTBF) and mean time to repair (MTTR) as performance measures in the SLA.

Front 520

Session key

Back 520

The agreed-upon (during connection) key used between a client and a server during a session. This key is generated by encrypting the server's digital ID (after validity has been established). The asymmetric key pair is then used to encrypt and verify the session key that is passed back and forth between client and server during the length of the connection.

Front 521

Session layer

Back 521

The fifth layer of the OSI model. It determines how two computers establish, use, and end a session. Security authentication and network naming functions required for applications occur here. The Session layer establishes, maintains, and breaks dialogs between two stations. See also Open Systems Interconnection (OSI) model.

Front 522

SHA

Back 522

See Secure Hash Algorithm (SHA).

Front 523

Share-level security

Back 523

A network security method that assigns passwords to individual files or other network resources (such as printers) instead of assigning rights to network resources to users. The passwords are then given to all users that need access to these resources. All resources are visible from anywhere in the network, and any user who knows the password for a particular network resource can make changes to it.

Front 524

Shoulder surfing

Back 524

Watching someone when they enter their username/password/sensitive data.

Front 525

Signal

Back 525

Transmission from one PC to another. A signal could be a notification to start a session or end a session.

Front 526

Signal encoding

Back 526

The process whereby a protocol at the Physical layer receives information from the upper layers and translates all the data into signals that can be transmitted on a transmission medium.

Front 527

Signaling method

Back 527

The process of transmitting data across the medium. Two types of signaling are digital and analog.

Front 528

Signed applet

Back 528

An applet that doesn't run in the Java sandbox and has higher system access capabilities. Signed applets aren't usually downloaded from the Internet but are provided by in-house or custom programming efforts.

Front 529

Simple Mail Transfer Protocol (SMTP)

Back 529

A protocol for sending email between SMTP servers.

Front 530

Simple Network Management Protocol (SNMP)

Back 530

The management protocol created for sending information about the health of the network-to-network management consoles.

Front 531

Single loss expectancy (SLE)

Back 531

The cost of a single loss when it occurs. This loss can be a critical failure, or it can be the result of an attack.

Front 532

Single sign-on (SSO)

Back 532

A relationship between the client and the network wherein the client is allowed to log on one time, and all resource access is based on that logon (as opposed to needing to log on to each individual server to access the resources there).

Front 533

Site survey

Back 533

A generic site survey involves listening in on an existing wireless network using commercially available technologies. A wireless site survey, or wireless survey, is the process of planning and designing a wireless network, in particular an 802.11.

Front 534

SLIP

Back 534

See Serial Line Internet Protocol (SLIP).

Front 535

SMTP

Back 535

See Simple Mail Transfer Protocol (SMTP).

Front 536

SMTP relay

Back 536

A feature designed into many email servers that allows them to forward email to other email servers. While the ability to act as a relay exists to allow networks to grow, the possibility exists for rogue servers to also participate.

Front 537

Smurf attack

Back 537

An attack in which large volumes of ICMP echo requests (pings) are broadcast to all other machines on the network and in which the source address of the broadcast system has been spoofed to appear as though it came from the target computer. When all the machines that received the broadcast respond, they flood the target with more data than it can handle.

Front 538

Snapshot backup

Back 538

A method of performing backups that creates a compressed file of a database as it exists at the moment, without taking the users offline. A snapshot backup can take the place of other backups. It's often run on mirrored servers, but the snapshot captures only the most recent version of files.

Front 539

Sniffer

Back 539

A physical device that listens in (sniffs) on network traffic and looks for items it can make sense of. There is a legitimate purpose for these devices: Administrators use them to analyze traffic. However, when they're used by sources other than the administrator, they become security risks.

Front 540

Sniffing

Back 540

Analyzing data to look for passwords and anything else of value. Sniffing is also known as wiretapping, eavesdropping, and a number of other terms (packet sniffing, network sniffing, and so on).

Front 541

SNMP

Back 541

See Simple Network Management Protocol (SNMP).

Front 542

Snooping

Back 542

Looking through files in hopes of finding something interesting.

Front 543

Social engineering

Back 543

An attack that uses others by deceiving them. It does not directly target hardware or software, but instead targets and manipulates people.

Front 544

Socket

Back 544

The primary method used to communicate with services and applications such as the Web and Telnet. The socket is a programming construct that enables communication by mapping between ports and addresses.

Front 545

Software exploitation

Back 545

An attack launched against applications and higher-level services.

Front 546

Spam

Back 546

Unwanted, unsolicited email sent in bulk.

Front 547

Spike

Back 547

A momentary or instantaneous increase in power over a power line.

Front 548

Spoofing attack

Back 548

An attempt by someone or something to masquerade as someone else.

Front 549

Spyware

Back 549

Software programs that work—often actively—on behalf of a third party.

Front 550

SSH

Back 550

See Secure Shell (SSH).

Front 551

SSL

Back 551

See Secure Sockets Layer (SSL).

Front 552

State table

Back 552

A firewall security method that monitors the status of all the connections through the firewall.

Front 553

Stateful packet filtering

Back 553

Inspections that occur at all levels of the network and provide additional security using a state table that tracks every communications channel.

Front 554

Static Address Resolution Protocol (ARP) table entry

Back 554

An entry in the Address Resolution Protocol (ARP) table that a user adds manually when a PC will be accessed often.

Front 555

Static routing

Back 555

A method of routing packets where the router's routing table is updated manually by the network administrator instead of automatically by a route discovery protocol.

Front 556

Stealth port

Back 556

A port that is open but might not be obvious (invisible to those who don't know it exists). Trojan horses often exploit them.

Front 557

Stealth virus

Back 557

A virus that attempts to avoid detection by masking itself from applications.

Front 558

Steganography

Back 558

The science of hiding information within other information, such as a picture.

Front 559

Strength

Back 559

The effectiveness of a cryptographic system in preventing unauthorized decryption.

Front 560

Surge protector

Back 560

A device that protects electrical components from momentary or instantaneous increases (called spikes) in a power line.

Front 561

Switched

Back 561

A network that has multiple routes to get from a source to a destination. Switching allows for higher speeds.

Front 562

SWP

Back 562

See Secure WLAN Protocol (SWP).

Front 563

Symmetrical keys

Back 563

The keys used when the same key encrypts and decrypts data.

Front 564

SYN flood

Back 564

A Denial of Service attack in which the hacker sends a barrage of spoofed SYN packets. The receiving station tries to respond to each SYN request for a connection, thereby tying up all the resources. All incoming connections are rejected until all current connections can be established.

Front 565

System architecture

Back 565

Documents that provide you with the blueprint of your organization's software and hardware infrastructure.

Front 566

Tap

Back 566

A type of connection that directly attaches to a cable.

Front 567

TCP

Back 567

See Transmission Control Protocol (TCP).

Front 568

TCP ACK attack

Back 568

An attack that begins as a normal TCP connection and whose purpose is to deny service. It's also known as a TCP SYN flood.

Front 569

TCP sequence attack

Back 569

An attack wherein the attacker intercepts and then responds with a sequence number similar to the one used in the original session. The attack can either disrupt a session or hijack a valid session.

Front 570

TCP SYN flood

Back 570

See TCP ACK attack.

Front 571

TCP wrapper

Back 571

A low-level logging package designed for Unix systems.

Front 572

TCP/IP

Back 572

See Transmission Control Protocol/Internet Protocol (TCP/IP).

Front 573

TCP/IP hijacking

Back 573

An attack in which the attacker commandeers a TCP session from a legitimate user after the legitimate user has achieved authentication, thereby removing the need for the attacker to authenticate himself.

Front 574

Teardrop attack

Back 574

A DoS attack that uses large packets and odd offset values to confuse the receiver and help facilitate a crash.

Front 575

Telnet

Back 575

A protocol that functions at the Application layer of the OSI model, providing terminal emulation capabilities. See also Open Systems Interconnection (OSI) model.

Front 576

Temporal Key Interchange/Integrity Protocol (TKIP)

Back 576

A wrapper that works with wireless encryption to strengthen WEP implementations. It was designed to provide more secure encryption than the notoriously weak Wired Equivalent Privacy (WEP).

Front 577

Terminal Access Controller Access-Control System (TACACS)

Back 577

An authentication system that allows credentials to be accepted from multiple methods, including Kerberos. The TACACS client/server process occurs in the same manner as the Remote Authentication Dial-In User Service (RADIUS) process.

Front 578

Terminal emulator

Back 578

A program that enables a PC to act as a terminal for a mainframe or a Unix system.

Front 579

TFTP

Back 579

See Trivial File Transfer Protocol (TFTP).

Front 580

Thin client

Back 580

Systems that don't provide any disk storage or removable media on their workstations.

Front 581

Third party

Back 581

A party responsible for providing assurance to the relying party that a subscriber is genuine.

Front 582

Threat

Back 582

Any perceivable risk.

Front 583

Three-tier model

Back 583

A system that effectively isolates the end user from the database by introducing a middle-tier server.

Front 584

Time to live (TTL)

Back 584

A field in an IP packet that indicates how many routers the packet can cross (hops it can make) and how long it takes before it's discarded. TTL is also used in Address Resolution Protocol (ARP) tables to indicate how long an entry should remain in the table.

Front 585

TLS

Back 585

See Transport Layer Security (TLS).

Front 586

Token

Back 586

A piece of data holding information about the user. This information can contain group IDs, user IDs, privilege level, and so on.

Front 587

TPM

Back 587

See trusted platform module (TPM).

Front 588

Traceroute

Back 588

See Tracert.

Front 589

Tracert

Back 589

The command-line utility that shows the user every router interface a packet passes through on its way to a destination.

Front 590

Trailer

Back 590

A section of a data packet that contains error-checking information.

Front 591

Transceiver

Back 591

A device that allows the network interface card (NIC) to connect to the network.

Front 592

Transmission

Back 592

Sending packets from the PC to the server. The transmission can occur over a network cable, wireless connection, or other medium.

Front 593

Transmission Control Protocol (TCP)

Back 593

The protocol found at the Host-to-Host layer of the Department of Defense (DoD) model. This protocol breaks data packets into segments, numbers them, and sends them in order. The receiving computer reassembles the data so that the information is readable for the user. In the process, the sender and the receiver confirm that all data has been received; if not, it's resent. TCP is a connection-oriented protocol. See also connection-oriented.

Front 594

Transmission Control Protocol/Internet Protocol (TCP/IP)

Back 594

The protocol suite developed by the Department of Defense (DoD) in conjunction with the Internet. It was designed as an internetworking protocol suite that could route information around network failures. Today it's the de facto standard for communications on the Internet.

Front 595

Transmission media

Back 595

Physical cables and/or wireless technology across which computers are able to communicate.

Front 596

Transport layer

Back 596

The fourth layer of the OSI model. It's responsible for checking that the data packet created in the Session layer was received. If necessary, it also changes the length of messages for transport up or down the remaining layers. See also Open Systems Interconnection (OSI) model.

Front 597

Transport Layer Security (TLS)

Back 597

A protocol whose purpose is to verify that secure communications between a server and a client remain secure. Defined in RFC 2246.

Front 598

Triple-DES (3DES)

Back 598

A symmetric block cipher algorithm used for encryption.

Front 599

Trivial File Transfer Protocol (TFTP)

Back 599

A UDP-based protocol similar to FTP that doesn't provide the security or error-checking features of FTP. See also File Transfer Protocol (FTP).

Front 600

Trojan horse

Back 600

Any application that masquerades as one thing in order to get past scrutiny and then does something malicious. One of the major differences between Trojan horses and viruses is that Trojan horses tend not to replicate themselves.

Front 601

Trust List

Back 601

A list of objects signed by a trusted entity. Also known as a Certificate Trust List (CTL).

Front 602

Trusted Platform Module (TPM)

Back 602

A method of utilizing encryption and storing the passwords on a chip. The hardware holding the chip is then needed to unencrypt the data and make it readable.

Front 603

TTL

Back 603

See time to live (TTL).

Front 604

Tunneling

Back 604

The act of sending data across a public network by encapsulating it into other packets.

Front 605

Two-factor authentication

Back 605

Using two access methods as a part of the authentication process.

Front 606

Two-tier model

Back 606

A model in which the client PC or system runs an application that communicates with a database that is running on a different server.

Front 607

UDP

Back 607

See User Datagram Protocol (UDP).

Front 608

Uniform Resource Locator (URL)

Back 608

A way of identifying a document on the Internet. It consists of the protocol used to access the document and the domain name or IP address of the host that holds the document; for example, http://www.sybex.com.

Front 609

Uninterruptible power supply (UPS)

Back 609

A device that can provide short-term power, usually by using batteries.

Front 610

Uptime

Back 610

The amount of time a particular computer or network component has been functional.

Front 611

URL

Back 611

See Uniform Resource Locator (URL).

Front 612

Usage policies

Back 612

Defined policies governing computer usage.

Front 613

User

Back 613

The person who is using a computer or network or a resource.

Front 614

User Datagram Protocol (UDP)

Back 614

The protocol at the Host-to-Host layer of the TCP/IP Department of Defense (DoD) model, which corresponds to the Transport layer of the OSI model. Packets are divided into datagrams, given numbers, sent, and put back together at the receiving end. UDP is a connectionless protocol. See also connectionless, Open Systems Interconnection (OSI) model.

Front 615

User management policies

Back 615

Defined policies that detail user management.

Front 616

User-level security

Back 616

A type of network security in which user accounts can read, write, change, and take ownership of files. Rights are assigned to user accounts, and each user knows only their own username and password—which makes this the preferred method for securing files.

Front 617

Virtual LAN (VLAN)

Back 617

Local area network (LAN) that allows users on different switch ports to participate in their own network separate from, but still connected to, the other stations on the same or a connected switch.

Front 618

Virtual link

Back 618

A link created by using a switch to limit network traffic.

Front 619

Virtual private network (VPN)

Back 619

System that uses the public Internet as a backbone for a private interconnection (network) between locations.

Front 620

Virus

Back 620

A program intended to damage a computer system. Sophisticated viruses are encrypted and hide in a computer, and might not appear until the user performs a certain action or until a certain date. See also antivirus.

Front 621

Volume

Back 621

The loudness of a sound, or the portion of a hard disk that functions as if it were a separate hard disk.

Front 622

WAN

Back 622

See wide area network (WAN).

Front 623

War driving

Back 623

Driving around with a laptop looking for open wireless access points with which to communicate.

Front 624

Warm site

Back 624

A site that provides some capabilities in the event of a disaster. The organization that wants to use a warm site will need to install, configure, and reestablish operations on systems that might already exist in the warm site.

Front 625

Weak key

Back 625

A cipher hole that can be exploited.

Front 626

Weak key attack

Back 626

An attack that looks for cipher holes.

Front 627

Web proxy

Back 627

A type of proxy that is used to act on behalf of a web client or web server.

Front 628

Web server

Back 628

A server that holds and delivers web pages and other web content using HTTP. See also Hypertext Transfer Protocol (HTTP).

Front 629

WEP

Back 629

See Wired Equivalent Privacy (WEP).

Front 630

Wi-Fi

Back 630

See Wireless Fidelity (Wi-Fi).

Front 631

Wi-Fi protected access (WPA)

Back 631

Security protocol developed by the Wi-Fi Alliance to protect wireless networks and surpass what WEP offered. There are two versions, WPA and WPA2, with the latter being the full implementation of the security features.

Front 632

Wide area network (WAN)

Back 632

A network that crosses local, regional, and/or international boundaries.

Front 633

Windows socket

Back 633

A Microsoft API used to interact with TCP/IP.

Front 634

Wired Equivalent Privacy (WEP)

Back 634

A security protocol for 802.11b (wireless) networks that attempts to establish the same security for them as would be present in a wired network.

Front 635

Wireless access point

Back 635

A wireless bridge used in a multipoint radio frequency (RF) network.

Front 636

Wireless bridge

Back 636

A bridge that performs all the functions of a regular bridge but uses RF instead of cables to transmit signals.

Front 637

Wireless Fidelity (Wi-Fi)

Back 637

A wireless network operating in the 2.4 Ghz or 5 Ghz range.

Front 638

Wireless local area network (WLAN)

Back 638

A local area network that employs wireless access points (WAPs) and clients using the 802.11 standards.

Front 639

Wireless portal

Back 639

The primary method of connecting a wireless device to a network.

Front 640

Wireless technologies

Back 640

Technologies employing wireless communications.

Front 641

Wireless Transport Layer Security (WTLS)

Back 641

The security layer of the Wireless Applications Protocol (WAP). WTLS provides authentication, encryption, and data integrity for wireless devices.

Front 642

Work factor

Back 642

An estimate of the amount of time and effort that would be needed to break a system.

Front 643

Workgroup

Back 643

A specific group of users or network devices, organized by job function or proximity to shared resources.

Front 644

Working copy

Back 644

The copy of the data currently in use on a network.

Front 645

Workstation

Back 645

A computer that isn't a server but is on a network. Generally, a workstation is used to do work, whereas a server is used to store data or perform a network function.

Front 646

World Wide Web Consortium (W3C)

Back 646

An association concerned with interoperability, growth, and standardization of the World Wide Web (WWW). This group is the primary sponsor of XML and other web-enabled technologies.

Front 647

Worm

Back 647

A program similar to a virus. Worms, however, propagate themselves over a network. See also virus.

Front 648

WPA

Back 648

See Wi-FI protected access (WPA).

Front 649

X.500

Back 649

The International Telecommunications Union (ITU) standard for directory services in the late 1980s. The standard was the basis for later models of directory structure, such as Lightweight Directory Access Protocol (LDAP).

Front 650

XSRF

Back 650

See cross-site request forgery (XSRF).

Front 651

Zombie

Back 651

Any system taking directions from a master control computer. Zombies are often utilized in distributed denial of service (DDoS) and botnet attacks.

Front 652

Zone

Back 652

An area in a building where access is individually monitored and controlled.