Reading...
Play button
Play button
Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
499 Cards in this Set
- Front
- Back
|
"Content filtering"
|
"Controlling access to a network by analyzing the contents of the incoming and outgoing packets and either letting them pass or denying them based on a list of rules. Differs from packet filtering in that it is the data in the packet that are analyzed instead of the attributes of the packet itself (e.g.# source/target IP address# TCP flags)."
|
|
|
"Continuity"
|
"The acts preventing# mitigating and recovering from disruption. The terms business resumption planning# disaster recovery planning and contingency planning also may be used in this context; they all concentrate on the recovery aspects of continuity."
|
|
|
"Continuous auditing approach"
|
"This approach allows IS auditors to monitor system reliability on a continuous basis and to gather selective audit evidence through the computer."
|
|
|
"Control group"
|
"Members of the operations area that are responsible for the collection# logging and submission of input for the various user groups"
|
|
|
"Control objective"
|
"The objectives of management that are used as the framework for developing and implementing controls (control procedures)."
|
|
|
"Control Objectives for Enterprise Governance"
|
"A discussion document which sets out an ""Enterprise Governance Model"" focusing strongly on both the enterprise business goals and the information technology enablers which facilitate good enterprise governance# published by the Information Systems Audit and Control Foundation in 1999"
|
|
|
"Control perimeter"
|
"The boundary defining the scope of control authority for an entity. For example# if a system is within the control perimeter# the right and ability exists to control it in response to an attack."
|
|
|
"Control risk"
|
"The risk that an error which could occur in an audit area# and which could be material# individually or in combination with other errors# will not be prevented or detected and corrected on a timely basis by the internal control system"
|
|
|
"control risk self-assessment"
|
"An empowering method/process by which management and staff of all levels collectively identify and evaluate IS related risks and controls under the guidance of a facilitator who could be an IS auditor. The IS auditor can utilise CRSA for gathering relevant information about risks and controls and to forge greater collaboration with management and staff. CRSA provides a framework and tools for management and employees to: *Identify and prioritise their business objectives. *Assess and manage high risk areas of business processes. *Self-evaluate the adequacy of controls. *Develop risk treatment recommendations"
|
|
|
"Control section"
|
"The area of the central processing unit (CPU) that executes software# allocates internal memory and transfers operations between the arithmetic-logic# internal storage and output sections of the computer"
|
|
|
"Control weakness"
|
"A deficiency in the design or operation of a control procedure. Control weaknesses can potentially result in risks relevant to the area of activity not being reduced to an acceptable level (relevant risks are those that threaten achievement of the objectives relevant to the area of activity being examined). Control weaknesses can be material when the design or operation of one or more control procedures does not reduce to a relatively low level the risk that misstatements caused by illegal acts or irregularities may occur and not be detected by the related control procedures."
|
|
|
"Controls"
|
"(Control procedures) Those policies and procedures implemented to achieve a related control objective"
|
|
|
"corporate exchange rate"
|
"An exchange rate# which can be used optionally to perform foreign currency conversion. The corporate exchange rate is generally a standard market rate determined by senior financial management for use throughout the organization."
|
|
|
"Corporate governance"
|
"""...the structure through which the objectives of an organization are set# and the means of attaining those objectives# and determines monitoring performance guidelines. Good corporate governance should provide proper incentives for board and management to pursue objectives that are in the interests of the company and stakeholders and should facilitate effective monitoring# thereby encouraging firms to use resources more efficiently."" (Source: Principles of Corporate Governance# 1999 issued by the Organization for Economic Cooperation and Development (OECD))"
|
|
|
"Corrective controls"
|
"These controls are designed to correct errors# omissions and unauthorized uses and intrusions# once they are detected."
|
|
|
"COSO"
|
"A report on ""Internal Control--An Integrated Framework"" sponsored by the Committee of Sponsoring Organizations of the Treadway Commission in 1992. It provides guidance and a comprehensive framework of internal control for all organizations."
|
|
|
"Coupling"
|
"Measure of interconnectivity among software program modules’ structure. Coupling depends on the interface complexity between modules. This can be defined as the point at which entry or reference is made to a module# and what data passes across the interface. In application software design# it is preferable to strive for the lowest possible coupling between modules. Simple connectivity among modules results in software that is easier to understand# maintain and less prone to a ripple or domino effect caused when errors occur at one location and propagate through the system."
|
|
|
"Coverage"
|
"The proportion of known attacks detected by an intrusion detection system"
|
|
|
"Credentialed analysis"
|
"In vulnerability analysis# passive monitoring approaches in which passwords or other access credentials are required. This sort of check usually involves accessing a system data object."
|
|
|
"credit risk"
|
"The risk to earnings or capital arising from an obligor’s failure to meet the terms of any contract with the bank or otherwise to perform as agreed. Internet banking provides the opportunity for banks to expand their geographic range. Customers can reach a given bank from literally anywhere in the world. In dealing with customers over the Internet# absent any personal contact# it is challenging for banks to verify the good faith of their customers# which is an important element in making sound credit decisions."
|
|
|
"Criteria"
|
"The standards and benchmarks used to measure and present the subject matter and against which the IS auditor evaluates the subject matter. Criteria should be: Objective—free from bias Measurable—provide for consistent measurement Complete—include all relevant factors to reach a conclusion Relevant—relate to the subject matter"
|
|
|
"Cross-certification"
|
"A certificate issued by one certification authority to a second certification authority so that users of the first certification authority are able to obtain the public key of the second certification authority and verify the certificates it has created. Often cross certification refers specifically to certificates issued to each other by two CAs at the same level in a hierarchy."
|
|
|
"Cryptography"
|
"The art of designing# analyzing and attacking cryptographic schemes"
|
|
|
"data analysis"
|
"Typically in large organisations where the quantum of data processed by the ERPs are extremely voluminous# analysis of patterns and trends prove to be extremely useful in ascertaining the efficiency and effectiveness of operations. Most ERPs provide opportunities for extraction and analysis of data# some with built-in tools through the use of third-party developed tools that interface with the ERP systems"
|
|
|
"Data communications"
|
"The transfer of data between separate computer processing sites/devices using telephone lines# microwave and/or satellite links"
|
|
|
"Data custodian"
|
"Individuals and departments responsible for the storage and safeguarding of computerized information. This typically is within the IS organization."
|
|
|
"Data dictionary"
|
"A data dictionary is a database that contains the name# type# range of values# source and authorization for access for each data element in a database. It also indicates which application programs use that data so that when a data structure is contemplated# a list of the affected programs can be generated. The data dictionary may be a stand-alone information system used for management or documentation purposes# or it may control the operation of a database."
|
|
|
"Data diddling"
|
"Changing data with malicious intent before or during input into the system"
|
|
|
"Data Encryption Standard (DES)"
|
"A private key cryptosystem published by the National Bureau of Standards (NBS)# the predecessor of the US National Institute of Standards and Technology (NIST). DES has been used commonly for data encryption in the forms of software and hardware implementation (also see private key cryptosystems)."
|
|
|
"data flow"
|
"The flow of data from the input (in Internet banking# ordinarily user input at his/her desktop) to output (in Internet banking# ordinarily data in a bank’s central database). Data flow includes travelling through the communication lines# routers# switches and firewalls as well as processing through various applications on servers which process the data from user fingers to storage in bank central database."
|
|
|
"data integrity"
|
"The property that data meet with a priority expectation of quality and that the data can be relied upon"
|
|
|
"Data leakage"
|
"Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes"
|
|
|
"Data owner"
|
"Individuals# normally managers or directors# who have responsibility for the integrity# accurate reporting and use of computerized data"
|
|
|
"Data security"
|
"Those controls that seek to maintain confidentiality# integrity and availability of information"
|
|
|
"Data structure"
|
"The relationships among files in a database and among data items within each file"
|
|
|
"Database"
|
"A stored collection of related data needed by organizations and individuals to meet their information processing and retrieval requirements"
|
|
|
"Database administrator (DBA)"
|
"An individual or department responsible for the security and information classification of the shared data stored on a database system. This responsibility includes the design# definition and maintenance of the database."
|
|
|
"Database management system (DBMS)"
|
"A complex set of software programs that control the organization# storage and retrieval of data in a database. It also controls the security and integrity of the database."
|
|
|
"Database replication"
|
"The process of creating and managing duplicate versions of a database. Replication not only copies a database but also synchronizes a set of replicas so that changes made to one replica are reflected in all the others. The beauty of replication is that it enables many users to work with their own local copy of a database but have the database updated as if they were working on a single centralized database. For database applications where geographically users are distributed widely# replication is often the most efficient method of database access."
|
|
|
"Database specifications"
|
"These are the requirements for establishing a database application. They include field definitions# field requirements and reporting requirements for the individual information in the database."
|
|
|
"Datagram"
|
"A packet (encapsulated with a frame containing information)# which is transmitted in a packet-switching network from source to destination"
|
|
|
"Data-oriented systems development"
|
"The purpose is to provide usable data rather than a function. The focus of the development is to provide ad hoc reporting for users by developing a suitable accessible database of information."
|
|
|
"DDoS (distributed denial-of-service) attack"
|
"A denial-of-service (DoS) assault from multiple sources; see DoS"
|
|
|
"Decentralization"
|
"The process of distributing computer processing to different locations within an organization"
|
|
|
"Decision support systems (DSS)"
|
"An interactive system that provides the user with easy access to decision models and data# to support semistructured decision-making tasks"
|
|
|
"Decoy server"
|
"See honey pot."
|
|
|
"Decryption"
|
"A technique used to recover the original plaintext from the ciphertext such that it is intelligible to the reader. The decryption is a reverse process of the encryption."
|
|
|
"Decryption key"
|
"A piece of information# in a digitized form# used to recover the plaintext from the corresponding ciphertext by decryption"
|
|
|
"Default deny policy"
|
"A policy whereby access is denied unless it is specifically allowed. The inverse of default allow."
|
|
|
"Default password"
|
"The password used to gain access when a system is first installed on a computer or network device. There is a large list published on the Internet and maintained at several locations. Failure to change these after the installation leaves the system vulnerable."
|
|
|
"Degauss"
|
"To apply a variable# alternating current (AC) field for the purpose of demagnetizing magnetic recording media. The process involves increasing the AC field gradually from zero to some maximum value and back to zero# which leaves a very low residue of magnetic induction on the media. Degauss loosely means to erase."
|
|
|
"Demodulation"
|
"The process of converting an analog telecommunications signal into a digital computer signal"
|
|
|
"Detailed IS ontrols"
|
"Controls over the acquisition# implementation# delivery and support of IS systems and services. They are made up of application controls plus those general controls not included in pervasive controls."
|
|
|
"Detection risk"
|
"The risk that the IS auditor's substantive procedures will not detect an error which could be material# individually or in combination with other errors"
|
|
|
"Detective controls"
|
"These controls exist to detect and report when errors# omissions and unauthorized uses or entries occur."
|
|
|
"Dial-back"
|
"Used as a control over dial-up telecommunications lines. The telecommunications link established through dial-up into the computer from a remote location is interrupted so the computer can dial back to the caller. The link is permitted only if the caller is from a valid phone number or telecommunications channel."
|
|
|
"Dial-in access controls"
|
"Controls that prevent unauthorized access from remote users that attempt to access a secured environment. These controls range from dial-back controls to remote user authentication."
|
|
|
"Digital certificate"
|
"A certificate identifying a public key to its subscriber# corresponding to a private key held by that subscriber. It is a unique code that typically is used to allow the authenticity and integrity of communicated data to be verified."
|
|
|
"digital certification"
|
"A process to authenticate (or certify) a party’s digital signature# carried out by trusted third parties."
|
|
|
"Digital signature"
|
"A piece of information# a digitized form of signature# that provides sender authenticity# message integrity and nonrepudiation. A digital signature is generated using the sender’s private key or applying a one-way hash function."
|
|
|
"Direct reporting engagement"
|
"An engagement where management does not make a written assertion about the effectiveness of their control procedures# and the IS auditor provides an opinion about subject matter directly# such as the effectiveness of the control procedures"
|
|
|
"Discovery sampling"
|
"A form of attribute sampling that is used to determine a specified probability of finding at least one example of an occurrence (attribute) in a population"
|
|
|
"Diskless workstations"
|
"A workstation or PC on a network that does not have its own disk. Instead# it stores files on a network file server."
|
|
|
"Distributed data processing network"
|
"A system of computers connected together by a communications network. Each computer processes its data and the network supports the system as a whole. Such a network enhances communication among the linked computers and allows access to shared files."
|
|
|
"DMZ (demilitarized zone)"
|
"Commonly it is the network segment between the Internet and a private network. It allows access to services from the Internet and the internal private network# while denying access from the Internet directly to the private network."
|
|
|
"DNS (domain name system)"
|
"A hierarchical database that is distributed across the Internet that allows names to be resolved into IP addresses (and vice versa) to locate services such as web and e-mail servers"
|
|
|
"DoS (denial-of-service) attack"
|
"An assault on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate"
|
|
|
"Downloading"
|
"The act of transferring computerized information from one computer to another computer"
|
|
|
"Downtime report"
|
"A report that identifies the elapsed time when a computer is not operating correctly because of machine failure"
|
|
|
"Dry-pipe fire extinguisher system"
|
"Refers to a sprinkler system that does not have water in the pipes during idle usage# unlike a fully charged fire extinguisher system that has water in the pipes at all times. The dry-pipe system is activated at the time of the fire alarm# and water is emitted to the pipes from a water reservoir for discharge to the location of the fire."
|
|
|
"Due care"
|
"Diligence which a person would exercise under a given set of circumstances"
|
|
|
"Due professional care"
|
"Diligence which a person# who possesses a special skill# would exercise under a given set of circumstances"
|
|
|
"Dumb terminal"
|
"A display terminal without processing capability. Dumb terminals are dependent upon the main computer for processing. All entered data are accepted without further editing or validation."
|
|
|
"Duplex routing"
|
"The method or communication mode of routing data over the communication network (also see half duplex and full duplex)"
|
|
|
"Dynamic analysis"
|
"Analysis that is performed in real time or in continuous form"
|
|
|
"Echo checks"
|
"Detects line errors by retransmitting data back to the sending device for comparison with the original transmission"
|
|
|
"e-commerce"
|
"Defined by ISACA as the processes by which organisations conduct business electronically with their customers# suppliers and other external business partners# using the Internet as an enabling technology. It therefore encompasses both business-to-business (B2B) and business-to-consumer (B2C) e-Commerce models# but does not include existing non-Internet e-Commerce methods based on private networks such as EDI and SWIFT."
|
|
|
"Edit controls"
|
"Detects errors in the input portion of information that is sent to the computer for processing. The controls may be manual or automated and allow the user to edit data errors before processing."
|
|
|
"Editing"
|
"Editing ensures that data conform to predetermined criteria and enable early identification of potential errors."
|
|
|
"Electronic cash"
|
"An electronic form functionally equivalent to cash in order to make and receive payments in cyberbanking"
|
|
|
"Electronic data interchange (EDI)"
|
"The electronic transmission of transactions (information) between two organizations. EDI promotes a more efficient paperless environment. EDI transmissions can replace the use of standard documents# including invoices or purchase orders."
|
|
|
"Electronic funds transfer (EFT)"
|
"The exchange of money via telecommunications. EFT refers to any financial transaction that originates at a terminal and transfers a sum of money from one account to another."
|
|
|
"Electronic signature"
|
"Any technique designed to provide the electronic equivalent of a handwritten signature to demonstrate the origin and integrity of specific data. Digital signatures are an example of electronic signatures."
|
|
|
"Electronic vaulting"
|
"A data recovery strategy that allows organizations to recover data within hours after a disaster. It includes recovery of data from an offsite storage media that mirrors data via a communication link. Typically used for batch/journal updates to critical files to supplement full backups taken periodically."
|
|
|
"E-mail/interpersonal messaging"
|
"An individual using a terminal# PC or an application can access a network to send an unstructured message to another individual or group of people."
|
|
|
"Embedded audit module"
|
"Integral part of an application system that is designed to identify and report specific transactions or other information based on pre-determined criteria. Identification of reportable items occurs as part of real-time processing. Reporting may be real-time online# or may use store and forward methods. Also known as integrated test facility or continuous auditing module."
|
|
|
"Encapsulation (objects)"
|
"Encapsulation is the technique used by layered protocols in which a lower layer protocol accepts a message from a higher layer protocol and places it in the data portion of a frame in the lower layer."
|
|
|
"Encryption"
|
"The process of taking an unencrypted message (plaintext)# applying a mathematical function to it (encryption algorithm with a key) and producing an encrypted message (ciphertext)"
|
|
|
"Encryption key"
|
"A piece of information# in a digitized form# used by an encryption algorithm to convert the plaintext to the ciphertext"
|
|
|
"End-user computing"
|
"The ability of end users to design and implement their own information system utilizing computer software products"
|
|
|
"Engagement letter"
|
"Formal document which defines the IS auditor's responsibility# authority and accountability for a specific assignment"
|
|
|
"Enterprise governance"
|
"A broad and wide-ranging concept of corporate governance# covering associated organizations such as global strategic alliance partners. (Source: Control Objectives for Enterprise Governance Discussion Document# published by the Information Systems Audit and Control Foundation in 1999)"
|
|
|
"enterprise resource planning"
|
"First# it denotes the planning and management of resources in an enterprise. Second# it denotes a software system that can be used to manage whole business processes# integrating purchasing# inventory# personnel# customer service# shipping# financial management and other aspects of the business. An ERP system typically is based on a common database# various integrated business process application modules and business analysis tools"
|
|
|
"error"
|
"Error control deviations (compliance testing) or misstatements (substantive testing)"
|
|
|
"Error risk"
|
"The risk of errors occurring in the area being audited"
|
|
|
"Ethernet"
|
"A popular network protocol and cabling scheme that uses a bus topology and CSMA/CD (carrier sense multiple access/collision detection) to prevent network failures or collisions when two devices try to access the network at the same time"
|
|
|
"Evidence"
|
"The information an auditor gathers in the course of performing an IS audit. Evidence is relevant if it pertains to the audit objectives and has a logical relationship to the findings and conclusions it is used to support."
|
|
|
"Exception reports"
|
"An exception report is generated by a program that identifies transactions or data that appear to be incorrect. These items may be outside a predetermined range or may not conform to specified criteria."
|
|
|
"Executable code"
|
"The machine language code that is generally referred to as the object or load module"
|
|
|
"Expert systems"
|
"Expert systems are the most prevalent type of computer systems that arise from the research of artificial intelligence. An expert system has a built in hierarchy of rules# which are acquired from human experts in the appropriate field. Once input is provided# the system should be able to define the nature of the problem and provide recommendations to solve the problem."
|
|
|
"Exposure"
|
"The potential loss to an area due to the occurrence of an adverse event"
|
|
|
"Extended Binary-coded Decimal Interchange Code"
|
"(EBCDIC) An eight-bit code representing 256 characters; used in most large computer systems"
|
|
|
"Extensible Markup Language (XML)"
|
"Promulgated through the World Wide Web Consortium# XML is a web-based application development technique that allows designers to create their own customized tags# thus# enabling the definition# transmission# validation and interpretation of data between applications and organizations."
|
|
|
"External router"
|
"The router at the extreme edge of the network under control# usually connected to an ISP or other service provider; also known as border router"
|
|
|
"Fail-over"
|
"The transfer of service from an incapacitated primary component to its backup component"
|
|
|
"Fail-safe"
|
"Describes the design properties of a computer system that allow it to resist active attempts to attack or bypass it"
|
|
|
"False negative"
|
"In intrusion detection# an error that occurs when an attack is misdiagnosed as a normal activity"
|
|
|
"False positive"
|
"In intrusion detection# an error that occurs when a normal activity is misdiagnosed as an attack"
|
|
|
"Fault tolerance"
|
"A system’s level of resilience to seamlessly react from hardware and/or software failure"
|
|
|
"Feasibility study"
|
"A phase of an SDLC methodology that researches the feasibility and adequacy of resources for the development or acquisition of a system solution to a user need"
|
|
|
"Fiber optic cable"
|
"Glass fibers that transmit binary signals over a telecommunications network. Fiber optic systems have low transmission losses as compared to twisted-pair cables. They do not radiate energy or conduct electricity. They are free from corruption and lightning-induced interference# and they reduce the risk of wiretaps."
|
|
|
"Field"
|
"An individual data element in a computer record. Examples include employee name# customer address# account number# product unit price and product quantity in stock."
|
|
|
"File"
|
"A named collection of related records"
|
|
|
"File layout"
|
"Specifies the length of the file’s record and the sequence and size of its fields. A file layout also will specify the type of data contained within each field. For example# alphanumeric# zoned decimal# packed and binary are types of data."
|
|
|
"File server"
|
"A high-capacity disk storage device or a computer that stores data centrally for network users and manages access to that data. File servers can be dedicated so that no process other than network management can be executed while the network is available; file servers can be non-dedicated so that standard user applications can run while the network is available."
|
|
|
"Filtering router"
|
"A router that is configured to control network access by comparing the attributes of the incoming or outgoing packets to a set of rules"
|
|
|
"FIN (final)"
|
"A flag set in a packet to indicate that this packet is the final data packet of the transmission"
|
|
|
"Financial audit"
|
"An audit designed to determine the accuracy of financial records and information"
|
|
|
"Finger"
|
"A protocol and program that allows the remote identification of users logged into a system"
|
|
|
"Firewall"
|
"A device that forms a barrier between a secure and an open environment. Usually# the open environment is considered hostile. The most notable hostile environment is the Internet. In other words# a firewall enforces a boundary between two or more networks."
|
|
|
"Firmware"
|
"Memory chips with embedded program code that hold their content when power is turned off"
|
|
|
"fiscal year"
|
"Any yearly accounting period without regard to its relationship to a calendar year."
|
|
|
"foreign exchange risk"
|
"Is present when a financial asset or liability is denominated in a foreign currency or is funded by borrowings in another currency"
|
|
|
"Format checking"
|
"The application of an edit# using a predefined field definition to a submitted information stream; a test to ensure that data conform to a predefined format"
|
|
|
"Fourth generation language (4GL)"
|
"English-like# user friendly# nonprocedural computer languages used to program and/or read and process computer files"
|
|
|
"Frame relay"
|
"A packet-switched wide-area-network technology that provides faster performance than older packet-switched WAN technologies such as X.25 networks# because it was designed for today’s reliable circuits and performs less rigorous error detection. Frame relay is best suited for data and image transfers. Because of its variable-length packet architecture# it is not the most efficient technology for real-time voice and video. In a frame-relay network# end nodes establish a connection via a permanent virtual circuit (PVC)."
|
|
|
"Fraud risk"
|
"The risk that activities will include deliberate circumvention of controls with the intent to conceal the perpetuation of irregularities. The unauthorized use of assets or services and abetting or helping to conceal."
|
|
|
"FTP (file transfer protocol)"
|
"A protocol used to transfer files over a TCP/IP network (Internet# UNIX# etc.)"
|
|
|
"Full duplex"
|
"A communications channel over which data can be sent and received simultaneously"
|
|
|
"Function point analysis"
|
"A technique used to determine the size of a development task# based on the number of function points. Function points are factors such as inputs# outputs# inquiries and logical internal sites."
|
|
|
"Gateway"
|
"A hardware/software package that is used to connect networks with different protocols. The gateway has its own processor and memory and can perform protocol and bandwidth conversions."
|
|
|
"General computer controls"
|
"Controls# other than application controls# which relate to the environment within which computer-based application systems are developed# maintained and operated# and which are therefore applicable to all applications. The objectives of general controls are to ensure the proper development and implementation of applications# the integrity of program and data files and of computer operations. Like application controls# general controls may be either manual or programmed. Examples of general controls include the development and implementation of an IS strategy and an IS security policy# the organization of IS staff to separate conflicting duties and planning for disaster prevention and recovery."
|
|
|
"Generalized audit software"
|
"A computer program or series of programs designed to perform certain automated functions. These functions include reading computer files# selecting data# manipulating data# sorting data# summarizing data# performing calculations# selecting samples and printing reports or letters in a format specified by the IS auditor. This technique includes software acquired or written for audit purposes and software embedded in production systems."
|
|
|
"Geographic disk mirroring"
|
"A data recovery strategy that takes a set of physically disparate disks and synchronously mirrors them over high performance communication lines. Any write to a disk on one side will result in a write on the other. The local write will not return until the acknowledgement of the remote write is successful."
|
|
|
"Hacker"
|
"An individual who attempts to gain unauthorized access to a computer system"
|
|
|
"Half duplex"
|
"A communications channel that can handle only one signal at a time. The two stations must alternate their transmissions."
|
|
|
"Handprint scanner"
|
"A biometric device that is used to authenticate a user through palm scans"
|
|
|
"Harden"
|
"To configure a computer or other network device to resist attacks"
|
|
|
"Hardware"
|
"Relates to the technical and physical features of the computer"
|
|
|
"Hash function"
|
"An algorithm that maps or translates one set of bits into another (generally smaller) so that a message yields the same result every time the algorithm is executed using the same message as input. It is computationally infeasible for a message to be derived or reconstituted from the result produced by the algorithm. It is computationally infeasible to find two different messages that produce the same hash result using the same algorithm."
|
|
|
"Hash total"
|
"The total of any numeric data field on a document or computer file. This total is checked against a control total of the same field to facilitate accuracy of processing."
|
|
|
"Hexadecimal"
|
"A numbering system that uses a base of 16 and uses 16 digits: 0# 1# 2# 3# 4# 5# 6# 7# 8# 9# A# B# C# D# E and F. Programmers use hexadecimal numbers as a convenient way of representing binary numbers."
|
|
|
"Hierarchical database"
|
"A database structured in a tree/root or parent/child relationship. Each parent can have many children# but each child may have only one parent."
|
|
|
"Honey pot"
|
"A specially configured server# designed to attract intruders so that their actions do not affect production systems; also known as a decoy server"
|
|
|
"Hot site"
|
"A fully operational offsite data processing facility equipped with both hardware and system software to be used in the event of a disaster"
|
|
|
"HTTP (hyper text transfer protocol)"
|
"A communication protocol used to connect to servers on the World Wide Web. Its primary function is to establish a connection with a web server and transmit HTML pages to the client browser."
|
|
|
"HTTPS (hyper text transfer protocol secure)"
|
"A protocol for accessing a secure web server# whereby all data transferred is encrypted"
|
|
|
"Hub"
|
"A common connection point for devices in a network# hubs commonly are used to connect segments of a LAN. A hub contains multiple ports. When a packet arrives at one port# it is copied to the other ports so that all segments of the LAN can see all packets."
|
|
|
"hyperlink"
|
"Is an electronic pathway that may be displayed in the form of highlighted text# graphics or a button that connects one web page with another web page address."
|
|
|
"hypertext"
|
"A language# which enables electronic documents that present information that can be connected together by links instead of being presented sequentially# as is the case with normal text."
|
|
|
"ICMP (internet control message protocol)"
|
"A set of protocols that allow systems to communicate information about the state of services on other systems. It is used# for example# in determining whether systems are up# maximum packet sizes on links# whether a destination host/network/port is available. Hackers typically (abuse) use ICMP to determine information about the remote site."
|
|
|
"Idle standby"
|
"A fail-over process in which the primary node owns the resource group. The backup node runs idle# only supervising the primary node. In case of a primary node outage# the backup node takes over. The nodes are prioritized# which means the surviving node with the highest priority will acquire the resource group. A higher priority node joining the cluster will thus cause a short service interruption."
|
|
|
"IDS (intrusion detection system)"
|
"An intrusion detection system (IDS) inspects network activity to identify suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system"
|
|
|
"IEEE"
|
"(Institute of Electrical and Electronics Engineers)--Pronounced I-triple-E# IEEE is an organization composed of engineers# scientists and students. The IEEE is best known for developing standards for the computer and electronics industry."
|
|
|
"Image processing"
|
"The process of electronically inputting source documents by taking an image of the document# thereby eliminating the need for key entry"
|
|
|
"implementation life cycle review"
|
"Refers to the controls that support the process of transformation of the organisation’s legacy information systems into the ERP applications. This would largely cover all aspects of systems implementation and configuration# such as change management"
|
|
|
"Incremental testing"
|
"Deliberately testing only the value-added functionality of a software component"
|
|
|
"Independence"
|
"Self-governance and freedom from conflict of interest and undue influence. The IS auditor should be free to make his/her own decisions# not influenced by the organization being audited and its people (managers and employers)."
|
|
|
"Independent appearance"
|
"The outward impression of being self-governing and free from conflict of interest and undue influence"
|
|
|
"Independent attitude"
|
"Impartial point of view which allows the IS auditor to act objectively and with fairness"
|
|
|
"Indexed sequential access method (ISAM)"
|
"A disk access method that stores data sequentially# while also maintaining an index of key fields to all the records in the file for direct access capability"
|
|
|
"Indexed sequential file"
|
"A file format in which records are organized and can be accessed# according to a preestablished key that is part of the record"
|
|
|
"Information engineering"
|
"Data-oriented development techniques that work on the premise that data are at the center of information processing and that certain data relationships are significant to a business and must be represented in the data structure of its systems"
|
|
|
"Information processing facility (IPF)"
|
"The computer room and support areas"
|
|
|
"Inherent risk"
|
"The susceptibility of an audit area to error which could be material# individually or in combination with other errors# assuming that there are no related internal controls"
|
|
|
"Inheritance (objects)"
|
"Inheritance refers to database structures that have a strict hierarchy (no multiple inheritance). Inheritance can initiate other objects irrespective of the class hierarchy# thus there is no strict hierarchy of objects."
|
|
|
"Initial program load (IPL)"
|
"The initialization procedure that causes an operating system to be loaded into storage at the beginning of a workday or after a system malfunction"
|
|
|
"Input controls"
|
"Techniques and procedures used to verify# validate and edit data# to ensure that only correct data are entered into the computer"
|
|
|
"Integrated services digital network (ISDN)"
|
"A public end-to-end digital telecommunications network with signaling# switching and transport capabilities supporting a wide range of service accessed by standardized interfaces with integrated customer control. The standard allows transmission of digital voice# video and data over 64 Kpbs lines."
|
|
|
"Integrated test facilities (ITF)"
|
"Test data are processed in production systems. The data usually represent a set of fictitious entities such as departments# customers and products. Output reports are verified to confirm the correctness of the processing."
|
|
|
"Integrity"
|
"The accuracy and completeness of information as well as to its validity in accordance with business values and expectations"
|
|
|
"Intelligent terminal"
|
"A terminal with built-in processing capability. It has no disk or tape storage but has memory. The terminal interacts with the user by editing and validating data as they are entered prior to final processing."
|
|
|
"interest rate risk"
|
"Is the risk to earnings or capital arising from movements in interest rates. From an economic perspective# a bank focuses on the sensitivity of the value of its assets# liabilities and revenues to changes in interest rates. Internet banking may attract deposits# loans and other relationships from a larger pool of possible customers than other forms of marketing. Greater access to customers who primarily seek the best rate or term reinforces the need for managers to maintain appropriate asset/liability management systems# which should include the ability to react quickly to changing market conditions."
|
|
|
"Interface testing"
|
"A testing technique that is used to evaluate output from one application# while the information is sent as input to another application"
|
|
|
"Internal control"
|
"The policies# procedures# practices and organizational structures designed to provide reasonable assurance that business objectives will be achieved and that undesired events will be prevented or detected and corrected."
|
|
|
"Internal control structure"
|
"The dynamic# integrated processes# effected by the governing body# management and all other staff# that are designed to provide reasonable assurance regarding the achievement of the following general objectives: Effectiveness# efficiency and economy of operations Reliability of management Compliance with applicable laws# regulations and internal policies Management’s strategies for achieving these general objectives are affected by the design and operation of the following components: Control environment Information system Control procedures"
|
|
|
"Internal penetrators"
|
"Authorized users of a computer system who overstep their legitimate access rights. This category is divided into masqueraders and clandestine users."
|
|
|
"Internal storage"
|
"The main memory of the computer’s central processing unit"
|
|
|
"Internet"
|
"1) Two or more networks connected by a router 2) The world’s largest network using TCP/IP protocols to link government# university and commercial institutions"
|
|
|
"Internet banking"
|
"Use of the Internet as a remote delivery channel for banking services. Services include the traditional ones# such as opening an account or transferring funds to different accounts# and new banking services# such as electronic bill presentment and payment (allowing customers to receive and pay bills on a bank’s web site)."
|
|
|
"Internet Engineering Task Force (IETF)"
|
"The Internet standards setting organization with affiliates internationally from network industry representatives. This includes all network industry developers and researchers concerned with evolution and planned growth of the Internet."
|
|
|
"Internet Inter-ORB Protocol (IIOP)"
|
"A protocol developed by the object management group (OMG) to implement Common Object Request Broker Architecture (CORBA) solutions over the World Wide Web. CORBA enables modules of network-based programs to communicate with one another. These modules or program parts# such as tables# arrays# and more complex program subelements# are referred to as objects. Use of IIOP in this process enables browsers and servers to exchange both simple and complex objects. This significantly differs from HTTP# which only supports the transmission of text."
|
|
|
"Internet packet (IP) spoofing"
|
"An attack using packets with the spoofed source Internet packet (IP) addresses. This technique exploits applications that use authentication based on IP addresses. This technique also may enable an unauthorized user to gain root access on the target system."
|
|
|
"intranet"
|
"A private network that uses the infrastructure and standards of the Internet and World Wide Web# but is isolated from the public Internet by firewall barriers."
|
|
|
"Intrusion"
|
"Any intentional violation of the security policy of a system"
|
|
|
"Intrusion detection"
|
"The process of monitoring the events occurring in a computer system or network# detecting signs of security problems"
|
|
|
"Intrusive monitoring"
|
"In vulnerability analysis# gaining information by performing checks that affects the normal operation of the system# even crashing the system"
|
|
|
"IP (Internet protocol)"
|
"Specifies the format of packets and the addressing scheme"
|
|
|
"IPSec (Internet protocol security)"
|
"A set of protocols developed by the IETF to support the secure exchange of packets"
|
|
|
"Irregularities"
|
"Intentional violations of established management policy or regulatory requirements. Deliberate misstatements or omissions of information concerning the area under audit or the organization as a whole; gross negligence or unintentional illegal acts."
|
|
|
"ISO17799"
|
"An international standard that defines information confidentiality# integrity and availability controls"
|
|
|
"ISP (Internet service provider)"
|
"A third party that provides organizations with a variety of Internet# and Internet-related services"
|
|
|
"IT governance"
|
"A structure of relationships and processes to direct and control the enterprise in order to achieve the enterprise's goals by adding value while balancing risk versus return over IT and its processes"
|
|
|
"Job control language (JCL)"
|
"A language used to control run routines in connection with performing tasks on a computer"
|
|
|
"journal entry"
|
"A debit or credit to a general ledger account. See also manual journal entry."
|
|
|
"Judgment sampling"
|
"Any sample that is selected subjectively or in such a manner that the sample selection process is not random or the sampling results are not evaluated mathematically"
|
|
|
"L2F (Layer 2 forwarding)"
|
"A tunnelling protocol developed by Cisco Systems to support the creation of VPNs"
|
|
|
"L2TP (Layer 2 tunneling protocol)"
|
"An extension to PPP to facilitate the creation of VPNs. L2TP merges the best features of PPTP (from Microsoft) and L2F (from Cisco)."
|
|
|
"Latency"
|
"The time it takes a system and network delay to respond. System latency is the time a system takes to retrieve data. Network latency is the time it takes for a packet to travel from source to the final destination."
|
|
|
"LDAP (Lightweight Directory Access Protocol)"
|
"A set of protocols for accessing information directories. It is based on the X.500 standard# but is significantly simpler."
|
|
|
"Leased lines"
|
"A communication line permanently assigned to connect two points# as opposed to a dial-up line that is only available and open when a connection is made by dialing the target machine or network. Also known as a dedicated line."
|
|
|
"legal risk"
|
"Is the risk to earnings or capital arising from violations of# or nonconformance with# laws# rules# regulations# prescribed practices or ethical standards. Banks are subject to various forms of legal risk. This can include the risk that assets will turn out to be worth less or liabilities will turn out to be greater than expected because of inadequate or incorrect legal advice or documentation. In addition# existing laws may fail to resolve legal issues involving a bank; a court case involving a particular bank may have wider implications for banking business and involve costs to it and many or all other banks; and# laws affecting banks or other commercial enterprises may change. Banks are particularly susceptible to legal risks when entering new types of transactions and when the legal right of a counter-party to enter into transactions is not established."
|
|
|
"Librarian"
|
"The individual responsible for the safeguard and maintenance of all program and data files"
|
|
|
"Limit check"
|
"Tests of specified amount fields against stipulated high or low limits of acceptability. When both high and low values are used# the test may be called a range check."
|
|
|
"Link editor (linkage editor)"
|
"A utility program that combines several separately compiled modules into one# resolving internal references between them"
|
|
|
"liquidity risk"
|
"Is the risk to earnings or capital arising from a bank’s inability to meet its obligations when they come due# without incurring unacceptable losses. Internet banking may increase deposit volatility from customers who maintain accounts solely on the basis of rate or terms."
|
|
|
"Local area network (LAN)"
|
"A communication network that serves several users within a specified geographic area. It is made up of servers# workstations# a network operating system and a communications link. Personal computer LANs function as distributed processing systems in which each computer in the network does its own processing and manages some of its data. Shared data are stored in a file server that acts as a remote disk drive to all users in the network."
|
|
|
"Local loop"
|
"The communication lines that provide connectivity between the telecommunications carrier’s central office and the subscriber’s facilities"
|
|
|
"Log"
|
"To record details of information or events in an organized record-keeping system# usually sequenced in the order they occurred"
|
|
|
"Logical access controls"
|
"The policies# procedures# organizational structure and electronic access controls designed to restrict access to computer software and data files"
|
|
|
"Logoff"
|
"Disconnecting from the computer"
|
|
|
"Logon"
|
"The act of connecting to the computer. It typically requires entry of a user ID and password into a computer terminal."
|
|
|
"Logs/Log file"
|
"Files created specifically to record various actions occurring on the system to be monitored# such as failed login attempts# full disk drives and e-mail delivery failures"
|
|
|
"Machine language"
|
"The logical language a computer understands"
|
|
|
"Magnetic card reader"
|
"A card reader that reads cards with a magnetizable surface on which data can be stored and retrieved"
|
|
|
"Magnetic ink character recognition (MICR)"
|
"Used to electronically input# read and interpret information directly from a source document; requires the source document to have specially-coded magnetic ink typeset"
|
|
|
"Management information system (MIS)"
|
"An organized assembly of resources and procedures required to collect# process and distribute data for use in decision making"
|
|
|
"Man-in-the-middle attack"
|
"An attack strategy in which the attacker intercepts the communications stream between two parts of the victim system and then replaces the traffic between the two components with the intruder’s own# eventually assuming control of the communication"
|
|
|
"manual journal entry"
|
"A journal entry entered at a computer terminal. Manual journal entries can include regular# statistical# inter-company and foreign currency entries"
|
|
|
"Mapping"
|
"Diagramming data that are to be exchanged electronically# including how it is to be used and what business management systems need it. It is a preliminary step for developing an applications link. (Also see application tracing and mapping.)"
|
|
|
"Masking"
|
"A computerized technique of blocking out the display of sensitive information# such as passwords# on a computer terminal or report"
|
|
|
"Masqueraders"
|
"Attackers that penetrate systems by using user identifiers and passwords taken from legitimate users"
|
|
|
"Master file"
|
"A file of semipermanent information that is used frequently for processing data or for more than one purpose"
|
|
|
"Materiality"
|
"An auditing concept regarding the importance of an item of information with regard to its impact or effect on the functioning of the entity being audited. An expression of the relative significance or importance of a particular matter in the context of the organization as a whole."
|
|
|
"Memory dump"
|
"The act of copying raw data from one place to another with little or no formatting for readability. Usually# dump refers to copying data from main memory to a display screen or a printer. Dumps are useful for diagnosing bugs. After a program fails# one can study the dump and analyze the contents of memory at the time of the failure. Dumps are usually output in a difficult-to-read form (that is# binary# octal or hexadecimal)# so a memory dump will not help unless each person knows exactly for what to look."
|
|
|
"Message switching"
|
"A telecommunications traffic controlling methodology in which a complete message is sent to a concentration point and stored until the communications path is established"
|
|
|
"Microwave transmission"
|
"A high-capacity line-of-sight transmission of data signals through the atmosphere which often requires relay stations"
|
|
|
"Middleware"
|
"Another term for an application programmer interface (API). It refers to the interfaces that allow programmers to access lower- or higher-level services by providing an intermediary layer that includes function calls to the services."
|
|
|
"Misuse detection"
|
"Detection on the basis of whether the system activity matches that defined as bad"
|
|
|
"Modem (modulator-demodulator)"
|
"Connects a terminal or computer to a communications network via a telephone line. Modems turn digital pulses from the computer into frequencies within the audio range of the telephone system. When acting in the receiver capacity# a modem decodes incoming frequencies."
|
|
|
"Modulation"
|
"The process of converting a digital computer signal into an analog telecommunications signal"
|
|
|
"Monetary unit sampling"
|
"A sampling technique that estimates the amount of overstatement in an account balance"
|
|
|
"Monitor"
|
"Any information collection mechanism utilized by an intrusion detection system"
|
|
|
"Monitoring policy"
|
"The rules outlining the way in which information is captured and interpreted"
|
|
|
"Multiplexing"
|
"The transmission of more than one signal across a physical channel"
|
|
|
"Multiplexor"
|
"A device used for combining several lower-speed channels into a higher-speed channel"
|
|
|
"Mutual takeover"
|
"A fail-over process# which is basically a two-way idle standby: two servers are configured so that both can take over the other node’s resource group. Both must have enough CPU power to run both applications with sufficient speed# or performance losses must be taken into account expected until the failed node reintegrates. This also works nicely in three or more node configurations."
|
|
|
"NAT (Network Address Translation)"
|
"An Internet standard that allows a network to use one set of IP addresses for internal traffic and a second set of addresses for external traffic. The server# providing the NAT service# changes the source address of outgoing packets from the internal to the external address and reverses it for packets returning."
|
|
|
"Netware"
|
"A popular local area network operating system developed by the Novell Corp."
|
|
|
"Network"
|
"A system of interconnected computers and the communications equipment used to connect them"
|
|
|
"Network administrator"
|
"The person responsible for maintaining a LAN and assisting end users"
|
|
|
"Network hop"
|
"An attack strategy in which the attacker successively hacks into a series of connected systems# obscuring his/her identify from the victim of the attack"
|
|
|
"Node"
|
"Point at which terminals are given access to a network"
|
|
|
"Noise"
|
"Disturbances# such as static# in data transmissions that cause messages to be misinterpreted by the receiver"
|
|
|
"Non-intrusive monitoring"
|
"In vulnerability analysis# gaining information by performing standard system status queries and inspecting system attributes"
|
|
|
"nonrepudiable trnasactions"
|
"Transactions that cannot be denied after the fact"
|
|
|
"Nonrepudiation"
|
"The assurance that a party cannot later deny originating data# that it is the provision of proof of the integrity and origin of the data which can be verified by a third party. Nonrepudiation may be provided by a digital signature."
|
|
|
"Normalization"
|
"The elimination of redundant data"
|
|
|
"Numeric check"
|
"An edit check designed to ensure the data in a particular field is numeric"
|
|
|
"Object code"
|
"Machine-readable instructions produced from a compiler or assembler program that has accepted and translated the source code"
|
|
|
"Object Management Group (OMG)"
|
"A consortium with more than 700 affiliates from the software industry. Its purpose is to provide a common framework for developing applications using object-oriented programming techniques. For example# OMG is known principally for promulgating the CORBA specification."
|
|
|
"Object orientation"
|
"An approach to system development where the basic unit of attention is an object# which represents an encapsulation of both data (an object’s attributes) and functionality (an object’s methods). Objects usually are created using a general template called a class. Classes are the basis for most design work in objects. Classes and their objects communicate in defined ways. Aggregate classes interact through messages# which are directed requests for services from one class (the client) to another class (the server). A class may share the structure or methods defined in one or more other classes--a relationship known as inheritance."
|
|
|
"Objectivity"
|
"The ability to exercise judgement# express opinions and present recommendations with impartiality"
|
|
|
"object-oriented system development"
|
"A system development methodology that is organised around ""objects"" rather than ""actions#” and ”data ” rather than ”logic.” Object-oriented analysis is an assessment of a physical system to determine which objects in the real world need to be represented as objects in a software system. Any object-oriented design is software design that is centred around designing the objects that will make up a program. Any object-oriented program is one that is composed of objects or software parts."
|
|
|
"Offline files"
|
"Computer file storage media not physically connected to the computer; typically tapes or tape cartridges used for backup purposes"
|
|
|
"Offsite storage"
|
"A storage facility located away from the building housing the primary information processing facility (IPF)# used for storage of computer media such as offline backup data and storage files"
|
|
|
"Online data processing"
|
"Processing is achieved by entering information into the computer via a video display terminal. The computer immediately accepts or rejects the information# as it is entered."
|
|
|
"Open systems"
|
"Systems for which detailed specifications of their components composition are published in a nonproprietary environment# thereby enabling competing organizations to use these standard components to build competitive systems. The advantages of using open systems include portability# interoperability and integration."
|
|
|
"Operating system"
|
"A master control program that runs the computer and acts as a scheduler and traffic controller. It is the first program copied into the computer’s memory after the computer is turned on and must reside in memory at all times. It is the software that interfaces between the computer hardware (disk# keyboard# mouse# network# modem# printer) and the application software (word processor# spreadsheet# e-mail)# which also controls access to the devices and is partially responsible for security components and sets the standards for the application programs that run in it."
|
|
|
"Operating system audit trails"
|
"Records of system events generated by a specialized operating system mechanism"
|
|
|
"Operational audit"
|
"An audit designed to evaluate the various internal controls# economy and efficiency of a function or department"
|
|
|
"Operational control"
|
"These controls deal with the everyday operation of a company or organization to ensure all objectives are achieved."
|
|
|
"operational risk"
|
"The most important types of operational risk involve breakdowns in internal controls and corporate governance. Such breakdowns can lead to financial losses through error# fraud or failure to perform in a timely manner or cause the interests of the bank to be compromised in some other way# for example# by its dealers# lending officers or other staff exceeding their authority or conducting business in an unethical or risky manner. Other aspects of operational risk include major failure of information technology systems or events such as security problems or other disasters"
|
|
|
"Operator console"
|
"A special terminal used by computer operations personnel to control computer and systems operations functions. These terminals typically provide a high level of computer access and should be properly secured."
|
|
|
"Optical character recognition"
|
"Used to electronically scan and input written information from a source document"
|
|
|
"Optical scanner"
|
"An input device that reads characters and images that are printed or painted on a paper form into the computer."
|
|
|
"Output analyzer"
|
"Checks the accuracy of the results produced by a test run. There are three types of checks that an output analyzer can perform. First# if a standard set of test data and test results exists for a program# the output of a test run after program maintenance can be compared with the set of results that should be produced. Second# as programmers prepare test data and calculate the expected results# these results can be stored on a file and the output analyzer compares the actual results of a test run with the expected results. Third# the output analyzer can act as a query language; it accepts queries about whether certain relationships exist in the file of output results and reports compliance or noncompliance."
|
|
|
"Outsourcing"
|
"A formal agreement with a third party to perform an IS function for an organization"
|
|
|
"Packet"
|
"Data unit that is routed from source to destination in a packet-switched network. A packet contains both routing information and data. Transmission control protocol/Internet protocol (TCP/IP) is such a packet-switched network."
|
|
|
"Packet filtering"
|
"Controlling access to a network by analyzing the attributes of the incoming and outgoing packets and either letting them pass# or denying them# based on a list of rules"
|
|
|
"Packet switching"
|
"The process of transmitting messages in convenient pieces that can be reassembled at the destination"
|
|
|
"Parallel simulation"
|
"Parallel simulation involves the IS auditor writing a program to replicate those application processes that are critical to an audit opinion and using this program to reprocess application system data. The results produced are compared with the results generated by the application system and any discrepancies identified."
|
|
|
"Parallel testing"
|
"The process of feeding test data into two systems# the modified system and an alternative system (possibly the original system) and comparing results"
|
|
|
"Parity check"
|
"A general hardware control# which helps to detect data errors when data are read from memory or communicated from one computer to another. A 1-bit digit (either 0 or 1) is added to a data item to indicate whether the sum of that data item’s bit is odd or even. When the parity bit disagrees with the sum of the other bits# the computer reports an error. The probability of a parity check detecting an error is 50 percent."
|
|
|
"Partitioned file Partitioned file"
|
"A file format in which the file is divided into multiple subfiles and a directory is established to locate each subfile"
|
|
|
"Passive assault"
|
"In a passive assault# intruders attempt to learn some characteristic of the data being transmitted. They may be able to read the contents of the data so the privacy of the data is violated. Alternatively# although the content of the data itself may remain secure# intruders may read and analyze the plaintext source and destination identifiers attached to a message for routing purposes# or they may examine the lengths and frequency of messages being transmitted."
|
|
|
"Passive response"
|
"A response option in intrusion detection in which the system simply reports and records the problem detected# relying on the user to take subsequent action"
|
|
|
"Password"
|
"A protected# generally computer-encrypted string of characters that authenticate a computer user to the computer system"
|
|
|
"Password cracker"
|
"Specialized security checker that tests user’s passwords# searching for passwords that are easy to guess by repeatedly trying words from specially crafted dictionaries. Failing that# many password crackers can brute force all possible combinations in a relatively short period of time with current desktop computer hardware."
|
|
|
"payment system"
|
"A financial system that establishes the means for transferring money between suppliers and users of funds# ordinarily by exchanging debits or credits between banks or financial institutions."
|
|
|
"Penetration testing"
|
"A live test of the effectiveness of security defenses through mimicking the actions of real-life attackers"
|
|
|
"Performance indicators"
|
"A set of metrics designed to measure the extent to which performance objectives are being achieved on an on-going basis. They can include service level agreements# critical success factors# customer satisfaction ratings# internal or external benchmarks# industry best practices and international standards."
|
|
|
"Performance testing"
|
"Comparing the system’s performance to other equivalent systems using well defined benchmarks"
|
|
|
"Peripherals"
|
"Auxiliary computer hardware equipment used for input# output and data storage. Examples include disk drives and printers."
|
|
|
"Permanent virtual circuit (PVC)"
|
"A permanent connection between hosts in a packet switched network"
|
|
|
"Personal identification number (PIN)"
|
"A type of password (i.e.# a secret number assigned to an individual) that# in conjunction with some means of identifying the individual# serves to verify the authenticity of the individual. PINs have been adopted by financial institutions as the primary means of verifying customers in an electronic funds transfer system (EFTS)."
|
|
|
"Pervasive IS controls"
|
"General controls which are designed to manage and monitor the IS environment and which# therefore# affect all IS-related activities"
|
|
|
"Piggy backing"
|
"1) Following an authorized person into a restricted access area; 2) electronically attaching to an authorized telecommunications link to intercept and possibly alter transmissions."
|
|
|
"Plaintext"
|
"Digital information# such as cleartext# that is intelligible to the reader"
|
|
|
"Point-of-presence (POP)"
|
"A phone number that represents the area in which the communications provider or Internet service provider (ISP) provides service"
|
|
|
"Point-of-sale systems (POS)"
|
"Point-of-sale systems enable capture of data at the time and place of transaction. POS terminals may include use of optical scanners for use with bar codes or magnetic card readers for use with credit cards. POS systems may be online to a central computer or may use stand-alone terminals or microcomputers that hold the transactions until the end of a specified period when they are sent to the main computer for batch processing."
|
|
|
"Polymorphism (objects)"
|
"Polymorphism refers to database structures that send the same command to different child objects that can produce different results depending on their family hierarchical tree structure."
|
|
|
"Population"
|
"The entire set of data from which a sample is selected and about which the IS auditor wishes to draw conclusions"
|
|
|
"Port"
|
"An interface point between the CPU and a peripheral device"
|
|
|
"Posting"
|
"The process of actually entering transactions into computerized or manual files. Such transactions might immediately update the master files or may result in memo posting# in which the transactions are accumulated over a period of time# then applied to master file updating."
|
|
|
"PPP (point-to-point protocol)"
|
"A protocol used for transmitting data between two ends of a connection"
|
|
|
"PPTP (point-to-point tunneling protocol)"
|
"A protocol used to transmit data securely between two end points to create a VPN"
|
|
|
"Preventive controls"
|
"These controls are designed to prevent or restrict an error# omission or unauthorized intrusion."
|
|
|
"price risk"
|
"Is the risk to earnings or capital arising from changes in the value of portfolios of financial instruments. Price risk arises from market making# dealing and position taking in interest rate# foreign exchange# equity and commodities markets. Banks may be exposed to price risk if they create or expand deposit brokering# loan sales or securitisation programs as a result of Internet banking activities."
|
|
|
"Privacy"
|
"Freedom from unauthorized intrusion"
|
|
|
"Private key"
|
"A mathematical key (kept secret by the holder) used to create digital signatures and# depending upon the algorithm# to decrypt messages or files encrypted (for confidentiality) with the corresponding public key"
|
|
|
"Private key cryptosystems"
|
"Used in data encryption# it uses a secret key to encrypt the plaintext to the ciphertext. It also uses the same key to decrypt the ciphertext to the corresponding plaintext. In this case# the key is symmetric such that the encryption key is equivalent to the decryption key."
|
|
|
"Privilege"
|
"The level of trust with which a system object is imbued"
|
|
|
"Procedure"
|
"The portion of a security policy that states the general process that will be performed to accomplish a security goal"
|
|
|
"Production programs"
|
"Programs that are used to process live or actual data that were received as input into the production environment."
|
|
|
"Production software"
|
"Software that is being used and executed to support normal and authorized organizational operations. Such software is to be distinguished from test software# which is being developed or modified# but has not yet been authorized for use by management."
|
|
|
"Professional competence"
|
"Proven level of ability# often linked to qualifications issued by relevant professional bodies and compliance with their codes of practice and standards"
|
|
|
"Program evaluation and review technique (PERT)"
|
"A project management technique used in the planning and control of system projects"
|
|
|
"Program flowcharts"
|
"Program flowcharts show the sequence of instructions in a single program or subroutine. The symbols used should be the internationally accepted standard. Program flowcharts should be updated when necessary."
|
|
|
"Program narratives"
|
"Program narratives provide a detailed explanation of program flowcharts# including control points and any external input."
|
|
|
"Project sponsor"
|
"Considered for acquisition the person responsible for high-level decisions# such as changes to the scope and/or budget of the project# and whether or not to implement"
|
|
|
"Project team"
|
"Group of people responsible for a project# whose terms of reference may include the development# acquisition# implementation or maintenance of an application system. The team members may include line management# operational line staff# external contractors and IS auditors."
|
|
|
"Promiscuous mode"
|
"Allows the network interface to capture all network traffic irrespective of the hardware device to which the packet is addressed"
|
|
|
"Protection domain"
|
"The area of the system that the intrusion detection system is meant to monitor and protect"
|
|
|
"Protocol"
|
"The rules by which a network operates and controls the flow and priority of transmissions"
|
|
|
"Protocol converter"
|
"Hardware devices# such as asynchronous and synchronous transmissions# that convert between two different types of transmission"
|
|
|
"Protocol stack"
|
"A set of utilities that implement a particular network protocol. For instance# in Windows machines a TCP/IP stack consists of TCP/IP software# sockets software and hardware driver software."
|
|
|
"Prototyping"
|
"A system development technique that enables users and developers to reach agreement on system requirements. Prototyping uses programmed simulation techniques to represent a model of the final system to the user for advisement and critique. The emphasis is on end-user screens and reports. Internal controls are not a priority item since this is only a model."
|
|
|
"Proxy server"
|
"A server that acts on behalf of a user. Typical proxies accept a connection from a user# make a decision as to whether or not the user or client IP address is permitted to use the proxy# perhaps perform additional authentication# and complete a connection to a remote destination on behalf of the user."
|
|
|
"Public key"
|
"In an asymmetric cryptographic scheme# the key that may be widely published to enable the operation of the scheme"
|
|
|
"Public key cryptosystem"
|
"Used in data encryption# it uses an encryption key# as a public key# to encrypt the plaintext to the ciphertext. It uses the different decryption key# as a secret key# to decrypt the ciphertext to the corresponding plaintext. In contrast to a private key cryptosystem# the decryption key should be secret; however# the encryption key can be known to everyone. In a public key cryptosystem# two keys are asymmetric# such that the encryption key is not equivalent to the decryption key."
|
|
|
"Public key infrastructure"
|
"A system that authentically distributes users’ public keys using certificates"
|
|
|
"Queue"
|
"A group of items that is waiting to be serviced or processed"
|
|
|
"Quick ship"
|
"A recovery solution provided by recovery and/or hardware vendors and includes a pre-established contract to deliver hardware resources within a specified number amount of hours after a disaster occurs. This solution usually provides organizations with the ability to recover within 72 hours or greater."
|
|
|
"RADIUS"
|
"(remote authentication dial-in user service) A type of service providing an authentication and accounting system often used for dial-up and remote access security"
|
|
|
"Random access memory (RAM)"
|
"The computer’s primary working memory. Each byte of memory can be accessed randomly regardless of adjacent bytes."
|
|
|
"Range check"
|
"Range checks ensure that data fall within a predetermined range (also see limit checks)."
|
|
|
"rapid application development"
|
"A methodology that enables organisations to develop strategically important systems faster# while reducing development costs and maintaining quality by using a series of proven application development techniques# within a well-defined methodology."
|
|
|
"Real-time analysis"
|
"Analysis that is performed on a continuous basis# with results gained in time to alter the run-time system"
|
|
|
"Real-time processing"
|
"An interactive online system capability that immediately updates computer files when transactions are initiated through a terminal"
|
|
|
"Reasonable assurance"
|
"A level of comfort short of a guarantee but considered adequate given the costs of the control and the likely benefits achieved"
|
|
|
"Reasonableness check"
|
"Compares data to predefined reasonability limits or occurrence rates established for the data."
|
|
|
"Reciprocal agreement"
|
"Emergency processing agreements between two or more organizations with similar equipment or applications. Typically# participants promise to provide processing time to each other when an emergency arises."
|
|
|
"Record"
|
"A collection of related information treated as a unit. Separate fields within the record are used for processing of the information."
|
|
|
"Record# screen and report layouts"
|
"Record layouts provide information regarding the type of record# its size and the type of data contained in the record. Screen and report layouts describe what information is provided and necessary for input."
|
|
|
"Recovery point objective (RPO)—"
|
"A measurement of the point prior to an outage to which data are to be restored"
|
|
|
"Recovery testing"
|
"A test to check the system’s ability to recover after a software or hardware failure"
|
|
|
"Recovery time objective (RTO)"
|
"The amount of time allowed for the recovery of a business function or resource after a disaster occurs"
|
|
|
"Redo logs"
|
"Files maintained by a system# primarily a database management system# for the purposed of reapplying changes following an error or outage recovery"
|
|
|
"Redundancy check"
|
"Detects transmission errors by appending calculated bits onto the end of each segment of data"
|
|
|
"Reengineering"
|
"A process involving the extraction of components from existing systems and restructuring these components to develop new systems or to enhance the efficiency of existing systems. Existing software systems thus can be modernized to prolong their functionality. An example of this is a software code translator that can take an existing hierarchical database system and transpose it to a relational database system. CASE includes a source code reengineering feature."
|
|
|
"registration authority (RA)"
|
"An entity that may be given responsibility for performing some of the administrative tasks necessary in the registration of subjects# such as confirming the subject's identity# validating that the subject is entitled to have the attributes requested in a certificate and verifying that the subject has possession of the private key associated with the public key requested for a certificate."
|
|
|
"Regression testing"
|
"A testing technique used to retest earlier program abends or logical errors that occurred during the initial testing phase"
|
|
|
"Relevant audit evidence"
|
"Audit evidence is relevant if it pertains to the audit objectives and has a logical relationship to the findings and conclusions it is used to support."
|
|
|
"Reliable audit evidence"
|
"Audit evidence is reliable if# in the IS auditor's opinion# it is valid# factual# objective and supportable."
|
|
|
"Remote job entry (RJE)"
|
"The transmission of job control language (JCL) and batches of transactions from a remote terminal location"
|
|
|
"Remote procedure calls (RPCs)"
|
"The traditional Internet service protocol widely used for many years on UNIX-based operating systems and supported by the Internet Engineering Task Force (IETF) that allows a program on one computer to execute a program on another (e.g.# server). The primary benefit derived from its use is that a system developer need not develop specific procedures for the targeted computer system. For example# in a client-server arrangement# the client program sends a message to the server with appropriate arguments# and the server returns a message containing the results of the program executed. (See also CORBA and DCOM# as two newer object-oriented methods for related RPC functionality.)"
|
|
|
"Repository"
|
"The central database that stores and organizes data"
|
|
|
"repudiation"
|
"The denial by one of the parties to a transaction or participation in all or part of that transaction or of the content of communications related to that transaction."
|
|
|
"reputational risk"
|
"The current and prospective effect on earnings and capital arising from negative public opinion. This affects the bank’s ability to establish new relationships or services or continue servicing existing relationships. Reputation risk may expose the bank to litigation# financial loss or a decline in its customer base. A bank’s reputation can be damaged by Internet banking services that are poorly executed or otherwise alienate customers and the public. An Internet bank has a greater reputation risk as compared to a traditional brick-and-mortar bank since it is easier for its customers to leave and go to a different Internet bank and since it cannot discuss any problems with the customer in person"
|
|
|
"Request for proposal (RFP)"
|
"A document distributed to software vendors requesting them to submit a proposal to develop or provide a software product"
|
|
|
"Requirements definition"
|
"A phase of an SDLC methodology where the affected user groups define the requirements of the system for meeting the defined needs"
|
|
|
"Residual risk"
|
"The risk associated with an event when the control is in place to reduce the effect or likelihood of that event being taken into account"
|
|
|
"Reverse engineering"
|
"A software engineering technique whereby an existing application system code can be redesigned and coded using computer-aided software engineering (CASE) technology"
|
|
|
"RFC (request for comments)"
|
"A document that has been approved by the IETF becomes an RFC and is assigned a unique number once published. If it gains enough interest# it may evolve into an Internet standard."
|
|
|
"Ring topology"
|
"A type of LAN architecture in which the cable forms a loop# with stations attached at intervals around the loop. Signals transmitted around the ring take the form of messages. Each station receives the messages and each station determines# on the basis of an address# whether to accept or process a given message. However# after receiving a message# each station acts as a repeater# retransmitting the message at its original signal strength"
|
|
|
"Risk"
|
"The possibility of an act or event occurring that would have an adverse effect on the organization and its information systems"
|
|
|
"Risk assessment"
|
"A process used to identify and evaluate risks and their potential effects"
|
|
|
"Rootkit"
|
"A software suite designed to aid an intruder in gaining unauthorized administrative access to a computer system"
|
|
|
"Rotating standby"
|
"A fail-over process in which there are two nodes (as in idle standby but without priority). The node that enters the cluster first owns the resource group# and the second will join as a standby node."
|
|
|
"Rounding down"
|
"A method of computer fraud involving a computer code that instructs the computer to remove small amounts of money from an authorized computer transaction by rounding down to the nearest whole value denomination and rerouting the rounded off amount to the perpetrator’s account"
|
|
|
"Router"
|
"A networking device that can send (route) data packets from one local area network (LAN) or wide area network (WAN) to another# based on addressing at the network layer (Layer 3) in the OSI model. Networks connected by routers can use different or similar networking protocols. Routers usually are capable of filtering packets based on parameters# such as source addresses# destination addresses# protocol and network applications (ports)."
|
|
|
"RS-232 interface"
|
"Interface between data terminal equipment and data communications equipment employing serial binary data interchange"
|
|
|
"RSA"
|
"A public key cryptosystem developed by R. Rivest# A. Shamir and L. Adleman. The RSA has two different keys# the public encryption key and the secret decryption key. The strength of the RSA depends on the difficulty of the prime number factorization. For applications with high-level security# the number of the decryption key bits should be greater than 512 bits. RSA is used for both encryption and digital signatures."
|
|
|
"Rulebase"
|
"The list of rules and/or guidance that is used to analyze event data"
|
|
|
"Run instructions"
|
"Computer operating instructions which detail the step-by-step processes that are to occur so an application system can be properly executed. It also identifies how to address problems that occur during processing."
|
|
|
"Run-to-run totals"
|
"Provide verification that all transmitted data are read and processed"
|
|
|
"Salami technique"
|
"A method of computer fraud involving a computer code that instructs the computer to slice off small amounts of money from an authorized computer transaction and reroute this amount to the perpetrator’s account"
|
|
|
"Sampling risk"
|
"The probability that the IS auditor has reached an incorrect conclusion because an audit sample# rather than the whole population# was tested. While sampling risk can be reduced to an acceptably low level by using an appropriate sample size and selection method# it can never be eliminated."
|
|
|
"Scheduling"
|
"A method used in the information processing facility (IPF) to determine and establish the sequence of computer job processing"
|
|
|
"Screening routers"
|
"A router configured to permit or deny traffic based on a set of permission rules installed by the administrator"
|
|
|
"secure socket layer (SSL)"
|
"A protocol originally developed by Netscape Communications to provide a high level of security for its browser software. It has become accepted widely as a means of securing Internet message exchanges. It ensures confidentiality of the data in transmission using encryption."
|
|
|
"Security administrator"
|
"The person responsible for implementing# monitoring and enforcing security rules established and authorized by management"
|
|
|
"Security management"
|
"1) The process of establishing and maintaining security in a computer or network system. The stages of this process include prevention of security problems# detection of intrusions# investigation of intrusions and resolution. 2) In network management# controlling access to the network and resources# finding intrusions# identifying entry points for intruders and repairing or otherwise closing those avenues of access."
|
|
|
"Security perimeter"
|
"The boundary that defines the area of security concern and security policy coverage"
|
|
|
"Security policy"
|
"1) The set of management statements that documents an organization’s philosophy of protecting its computing and information assets 2) The set of security rules enforced by the system’s security features"
|
|
|
"Security software"
|
"Software used to administer logical security. It usually includes authentication of users# access granting according to predefined rules# monitoring and reporting functions."
|
|
|
"Security testing"
|
"Making sure the modified/new system includes appropriate access controls and does not introduce any security holes that might compromise other systems"
|
|
|
"security/transaction risk"
|
"The current and prospective risk to earnings and capital arising from fraud# error and the inability to deliver products or services# maintain a competitive position and manage information. Security risk is evident in each product and service offered and encompasses product development and delivery# transaction processing# systems development# computing systems# complexity of products and services and the internal control environment. A high level of security risk may exist with Internet banking products# particularly if those lines of business are not adequately planned# implemented and monitored"
|
|
|
"Segregation/separation of duties"
|
"A basic control that prevents or detects errors and irregularities by assigning responsibility for initiating transactions# recording transactions and custody of assets to separate individuals. Commonly used in large IT organizations so that no single person is in a position to introduce fraudulent or malicious code without detection."
|
|
|
"Sequence check"
|
"Verifies that the control number follows sequentially and any control numbers out of sequence are rejected or noted on an exception report for further research (can be alpha or numeric and usually utilizes a key field)"
|
|
|
"Sequential file"
|
"A computer file storage format in which one record follows another. Records can be accessed sequentially only. It is required with magnetic tape."
|
|
|
"Service bureau"
|
"A computer facility that provides data processing services to clients on a continual basis"
|
|
|
"Service level agreement (SLA)"
|
"Defined minimum performance measures at or above which the service delivered is considered acceptable"
|
|
|
"Service provider"
|
"The organization providing the outsourced service"
|
|
|
"Service user"
|
"The organization using the outsourced service"
|
|
|
"Shell"
|
"The interface between the user and the system"
|
|
|
"Signatures"
|
"Patterns indicating misuse of a system"
|
|
|
"Simple fail-over"
|
"A fail-over process in which the primary node owns the resource group. The backup node runs a non-critical application (e.g.# a development or test environment) and takes over the critical resource group but not vice versa."
|
|
|
"Simple Object Access Protocol (SOAP)"
|
"A platform-independent XML-based formatted protocol enabling applications to communicate with each other over the Internet. Use of this protocol may provide a significant security risk to web application operations# since use of SOAP piggybacks onto a web-based document object model and is transmitted via the web's HTTP service protocol (port 80) to penetrate server firewalls# which are usually configured to accept port 80 and port 21 (FTP) requests. Web-based document models define how objects on a web page are associated with each other# and how they can be manipulated while being sent from a server to a client browser. SOAP typically relies on XML for presentation formatting and also adds appropriate HTTP-based headers to send it."
|
|
|
"Single point of failure"
|
"A resource whose loss will result in the loss of service or production"
|
|
|
"Smart card"
|
"A small electronic device that contains electronic memory# and possibly an embedded integrated circuit. It can be used for a number of purposes including the storage of digital certificates or digital cash# or it can be used as a token to authenticate users."
|
|
|
"SMTP (Simple Mail Transport Protocol)"
|
"The standard e-mail protocol on the Internet"
|
|
|
"Sniff"
|
"The act of capturing network packets# including those not necessarily destined for the computer running the sniffing software"
|
|
|
"Sniffing"
|
"An attack capturing sensitive pieces of information# such as passwords# passing through the network"
|
|
|
"Software"
|
"Programs and supporting documentation that enable and facilitate use of the computer. Software controls the operation of the hardware."
|
|
|
"Source code"
|
"Source code is the language in which a program is written. Source code is translated into object code by assemblers and compilers. In some cases# source code may be converted automatically into another language by a conversion program. Source code is not executable by the computer directly. It must first be converted into a machine language."
|
|
|
"Source code compare programs"
|
"Programs that provide assurance that the software being audited is the correct version of the software# by providing a meaningful listing of any discrepancies between the two versions of the program"
|
|
|
"Source documents"
|
"The forms used to record data that have been captured. A source document may be a piece of paper# a turnaround document or an image displayed for online data input."
|
|
|
"Source lines of code (SLOC)"
|
"Source lines of code are often used in deriving single-point software-size estimations."
|
|
|
"Spanning port"
|
"A port configured on a network switch to receive copies of traffic from one or more other ports on the switch"
|
|
|
"Split data systems"
|
"A condition in which each of an organization’s regional locations maintains its own financial and operational data while sharing processing with an organizationwide# centralized database. This permits easy sharing of data while maintaining a certain level of autonomy."
|
|
|
"Split DNS"
|
"An implementation of DNS intended to secure responses provided by the server such that different responses are given to internal vs. external users"
|
|
|
"Spoofing"
|
"Faking the sending address of a transmission in order to gain illegal entry into a secure system"
|
|
|
"Spool (simultaneous peripheral operations online)"
|
"An automated function that can be operating system or application based in which electronic data being transmitted between storage areas are spooled or stored until the receiving device or storage area is prepared and able to receive the information. This operation allows more efficient electronic data transfers from one device to another by permitting higher speed sending functions# such as internal memory# to continue on with other operations instead of waiting on the slower speed receiving device# such as a printer."
|
|
|
"Standing data"
|
"Permanent reference data used in transaction processing. These data are changed infrequently# such as a product price file or a name and address file."
|
|
|
"Star topology"
|
"A type of LAN architecture that utilizes a central controller to which all nodes are directly connected. All transmissions from one station to another pass through the central controller# which is responsible for managing and controlling all communication. The central controller often acts as a switching device."
|
|
|
"Static analysis"
|
"Analysis of information that occurs on a noncontinuous basis; also known as interval-based analysis"
|
|
|
"Statistical sampling"
|
"A method of selecting a portion of a population# by means of mathematical calculations and probabilities# for the purpose of making scientifically and mathematically sound inferences regarding the characteristics of the entire population"
|
|
|
"strategic risk"
|
"The current and prospective effect on earnings or capital arising from adverse business decisions# improper implementation of decisions or lack of responsiveness to industry changes."
|
|
|
"Structured programming"
|
"A top-down technique of designing programs and systems. It makes programs more readable# more reliable and more easily maintained."
|
|
|
"Structured Query Language (SQL)"
|
"The primary language used by both application programmers and end users in accessing relational databases"
|
|
|
"Subject matter"
|
"(Area of activity) The specific information subject to the IS auditor’s report and related procedures which can include things such as the design or operation of internal controls and compliance with privacy practices or standards or specified laws and regulations."
|
|
|
"Substantive testing"
|
"Tests of detailed activities and transactions# or analytical review tests# designed to obtain audit evidence on the completeness# accuracy or existence of those activities or transactions during the audit period"
|
|
|
"Sufficient audit evidence"
|
"Audit evidence is sufficient if it is adequate# convincing and would lead another IS auditor to form the same conclusions."
|
|
|
"Surge suppressor"
|
"Filters out electrical surges and spikes"
|
|
|
"SWIFT"
|
"Founded in Brussels in 1973# the Society for the Worldwide Interbank Financial Telecommunication (SWIFT) is a co-operative organisation dedicated to the promotion and development of standardised global interactivity for financial transactions. SWIFT's original mandate was to establish a global communications link for data processing and a common language for international financial transactions. The Society operates a messaging service for financial messages# such as letters of credit# payments# and securities transactions# between member banks worldwide. SWIFT's essential function is to deliver these messages quickly and securely—both of which are prime considerations for financial matters. Member organisations create formatted messages that are then forwarded to SWIFT for delivery to the recipient member organisation. SWIFT operates out of its Brussels headquarters and processes data at centres in Belgium and the United States"
|
|
|
"Switch"
|
"A device that forwards packets between LAN devices or segments. LANs that use switches are called switched LANs."
|
|
|
"Symmetric key encryption"
|
"Two trading partners both share one or more secrets. No one else can read their messages. A different key (or set of keys) is needed for each pair of trading partners. Same key is used for encryption and decryption. (Also see Private Key Cryptosystems)."
|
|
|
"SYN (synchronize)"
|
"A flag set in the initial setup packets to indicate that the communicating parties are synchronizing the sequence numbers used for the data transmission"
|
|
|
"Synchronous transmission"
|
"Block-at-a-time data transmission"
|
|
|
"System exit"
|
"Special system software features and utilities that allow the user to perform complex system maintenance. Use of these exits often permits the user to operate outside of the security access control system."
|
|
|
"System flowcharts"
|
"System flowcharts are graphical representations of the sequence of operations in an information system or program. Information system flowcharts show how data from source documents flow through the computer to final distribution to users. Symbols used should be the internationally accepted standard. System flowcharts should be updated when necessary."
|
|
|
"System narratives"
|
"System narratives provide an overview explanation of system flowcharts# with explanation of key control points and system interfaces."
|
|
|
"System software"
|
"A collection of computer programs used in the design# processing and control of all applications. The programs and processing routines that control the computer hardware# including the operating system and utility programs."
|
|
|
"System testing"
|
"A series of tests designed to ensure that the modified program interacts correctly with other system components. These test procedures typically are performed by the system maintenance staff in their development library."
|
|
|
"Systems acquisition process"
|
"The procedures established to purchase application software# or an upgrade# including evaluation of the supplier's financial stability# track record# resources and references from existing customers"
|
|
|
"Systems analysis"
|
"The systems development phase in which systems specifications and conceptual designs are developed# based on end-user needs and requirements"
|
|
|
"Systems development life cycle (SDLC)"
|
"An approach used to plan# design# develop# test and implement an application system or a major modification to an application system. Typical phases include the feasibility study# requirements study# requirements definition# detailed design# programming# testing# installation and post-implementation review."
|
|
|
"Table look-ups"
|
"Used to ensure that input data agree with predetermined criteria stored in a table"
|
|
|
"TACACS+"
|
"(terminal access controller access control system plus)-- An authentication protocol# often used by remote-access servers"
|
|
|
"Tape management system (TMS)"
|
"A system software tool that logs# monitors and directs computer tape usage"
|
|
|
"Taps"
|
"Wiring devices that may be inserted into communication links for use with analysis probes# LAN analyzers and intrusion detection security systems"
|
|
|
"TCP (transmission control protocol)"
|
"A connection-based Internet protocol that supports reliable data transfer connections. Packet data is verified using checksums and retransmitted if it is missing or corrupted. The application plays no part in validating the transfer."
|
|
|
"TCP/IP protocol"
|
"(Transmission Control Protocol/Internet Protocol) A set of communications protocols that encompasses media access# packet transport# session communications# file transfer# electronic mail# terminal emulation# remote file access and network management. TCP/IP provides the basis for the Internet."
|
|
|
"Tcpdump"
|
"A network monitoring and data acquisition tool that performs filter translation# packet acquisition and packet display"
|
|
|
"technical infrastructure security"
|
"Refers to the security of the infrastructure that supports the ERP networking and telecommunications# operating systems and databases."
|
|
|
"Telecommunications"
|
"Electronic communications by special devices over distances or around devices that preclude direct interpersonal exchange"
|
|
|
"Teleprocessing"
|
"Using telecommunications facilities for handling and processing of computerized information"
|
|
|
"Telnet"
|
"Used to enable remote access to a server computer. Commands typed are run on the remote server."
|
|
|
"Terminal"
|
"A device for sending and receiving computerized data over transmission lines"
|
|
|
"Terms of reference"
|
"A document that confirms the client's and the IS auditor's acceptance of a review assignment"
|
|
|
"Test data"
|
"Simulated transactions that can be used to test processing logic# computations and controls actually programmed in computer applications. Individual programs or an entire system can be tested. This technique includes Integrated Test Facilities (ITFs) and Base Case System Evaluations (BCSEs)."
|
|
|
"Test generators"
|
"Software used to create data to be used in the testing of computer programs"
|
|
|
"Test programs"
|
"Programs that are tested and evaluated before approval into the production environment. Test programs# through a series of change control moves# migrate from the test environment to the production environment and become production programs."
|
|
|
"Third-party review"
|
"An independent audit of the control structure of a service organization# such as a service bureau# with the objective of providing assurances to the users of the service organization that the internal control structure is adequate# effective and sound"
|
|
|
"Threat"
|
"Any situation or event that has the potential to harm a system"
|
|
|
"Token"
|
"A device that is used to authenticate a user# typically in addition to a username and password. It is usually a credit card-sized device that displays a pseudo random number that changes every few minutes."
|
|
|
"Token ring topology"
|
"A type of LAN ring topology in which a frame containing a specific format# called the token# is passed from one station to the next around the ring. When a station receives the token# it is allowed to transmit. The station can send as many frames as desired until a predefined time limit is reached. When a station either has no more frames to send or reaches the time limit# it transmits the token. Token passing prevents data collisions that can occur when two computers begin transmitting at the same time."
|
|
|
"Top-level management"
|
"The highest level of management in the organization# responsible for direction and control of the organization as a whole (such as director# general manager# partner# chief officer and executive manager)."
|
|
|
"Topology"
|
"The physical layout of how computers are linked together. Examples include ring# star and bus."
|
|
|
"Transaction"
|
"Business events or information grouped together because they have a single or similar purpose. Typically# a transaction is applied to a calculation or event that then results in the updating of a holding or master file."
|
|
|
"Transaction log"
|
"A manual or automated log of all updates to data files and databases"
|
|
|
"Transaction protection"
|
"Also known as ""automated remote journaling of redo logs."" A data recovery strategy that is similar to electronic vaulting# except that instead of transmitting several transaction batches daily# the archive logs are shipped as they are created."
|
|
|
"Trap door"
|
"Unauthorized electronic exits# or doorways# out of an authorized computer program into a set of malicious instructions or programs"
|
|
|
"Trojan horse"
|
"Purposefully hidden malicious or damaging code within an authorized computer program. Unlike viruses# they do not replicate themselves# but they can be just as destructive to a single computer."
|
|
|
"Trust"
|
"Generally# the assumption that an entity will behave substantially as expected. Trust may apply only for a specific function. The key role of this term in an authentication framework is to describe the relationship between an authenticating entity and a certificate authority (CA). An authenticating entity must be certain that it can trust the CA to create only valid and reliable certificates# and users of those certificates rely upon the authenticating entity's determination of trust."
|
|
|
"Trusted processes"
|
"Processes certified as supporting a security goal"
|
|
|
"Trusted systems"
|
"Systems that employ sufficient hardware and software assurance measures to allow their use for processing of a range of sensitive or classified information"
|
|
|
"Tuple"
|
"A row or record consisting of a set of attribute value pairs (column or field) in a relational data structure"
|
|
|
"Twisted pairs"
|
"A pair of small# insulated wires that are twisted around each other to minimize interference from other wires in the cable. This is a low-capacity transmission medium."
|
|
|
"UDP (User Datagram Protocol)"
|
"A connectionless Internet protocol that is designed for network efficiency and speed at the expense of reliability. A data request by the client is served by sending packets without testing to verify if they actually arrive at the destination# not if they were corrupted in transit. It is up to the application to determine these factors and request retransmissions."
|
|
|
"Uninterruptible power supply (UPS)"
|
"Provides short-term backup power from batteries for a computer system when the electrical power fails or drops to an unacceptable voltage level"
|
|
|
"Unit testing"
|
"A testing technique that is used to test program logic within a particular program or module. The purpose of the test is to ensure that the program meets system development guidelines and does not abnormally end during processing."
|
|
|
"Universal Description# Discovery and Integration"
|
"(UDDI) A web-based version of the traditional phone book's yellow and white pages enabling businesses to be publicly listed in promoting greater e-commerce activities."
|
|
|
"UNIX"
|
"A multiuser# multitasking operating system that is used widely as the master control program in workstations and especially servers"
|
|
|
"untrustworthy host"
|
"To the basic border firewall# add a host that resides on an untrusted network where the firewall cannot protect it. That host is minimally configured and carefully managed to be as secure as possible. The firewall is configured to require incoming and outgoing traffic to go through the untrustworthy host. The host is referred to as untrustworthy because it cannot be protected by the firewall; therefore# hosts on the trusted networks can place only limited trust in it."
|
|
|
"Uploading"
|
"The process of electronically sending computerized information from one computer to another computer. Most often# the transfer is from a smaller computer to a larger one."
|
|
|
"Useful audit evidence"
|
"Audit evidence is useful if it assists the IS auditors in meeting their audit objectives."
|
|
|
"Utility programs"
|
"Specialized system software used to perform particular computerized functions and routines that are frequently required during normal processing. Examples include sorting# backing up and erasing data."
|
|
|
"Utility software"
|
"Computer programs provided by a computer hardware manufacturer or software vendor and used in running the system. This technique can be used to examine processing activities; to test programs# system activities and operational procedures; to evaluate data file activity; and# to analyze job accounting data."
|
|
|
"Vaccine"
|
"A program designed to detect computer viruses"
|
|
|
"Validity check"
|
"Programmed checking of data validity in accordance with predetermined criteria"
|
|
|
"Value-added network (VAN)"
|
"A data communication network that adds processing services such as error correction# data translation and/or storage to the basic function of transporting data"
|
|
|
"Variable sampling"
|
"A sampling technique used to estimate the average or total value of a population based on a sample; a statistical model used to project a quantitative characteristic# such as a dollar amount"
|
|
|
"Verification"
|
"Checks that data are entered correctly"
|
|
|
"virtual organizations"
|
"Organizations that have no official physical site presence and are made up of diverse geographically dispersed or mobile employees."
|
|
|
"Virtual private network (VPN)"
|
"A private network that is configured within a public network. For years# common carriers have built VPNs that appear as private national or international networks to the customer# but physically share backbone trunks with other customers. VPNs enjoy the security of a private network via access control and encryption# while taking advantage of the economies of scale and built-in management facilities of large public networks."
|
|
|
"Virus"
|
"A destructive computer program that spreads from computer to computer using a range of methods# including infecting floppy disks and other programs. Viruses typically attach themselves to a program and modify it so that the virus code runs when the program is first started. The infected program typically runs normally# but the virus code then infects other programs whenever it can. (Also see worm.)"
|
|
|
"Voice mail"
|
"A system of storing messages in a private recording medium where the called party can later retrieve the messages"
|
|
|
"Vulnerabilities"
|
"Weaknesses in systems that can be exploited in ways that violate security policy"
|
|
|
"vulnerability"
|
"A weakness in system security procedures# system design# implementation or internal controls that could be exploited to violate system security."
|
|
|
"Vulnerability analysis"
|
"Analysis of the security state of a system or its compromise on the basis of information collected at intervals"
|
|
|
"War dialler"
|
"Software packages that sequentially dial telephone numbers# recording any numbers that answer"
|
|
|
"Warm-site"
|
"A warm-site is similar to a hot-site; however# it is not fully equipped with all necessary hardware needed for recovery."
|
|
|
"waterfall development"
|
"Also known as traditional development# it is a very procedure-focused development cycle with formal sign-off at the completion of each level."
|
|
|
"web page"
|
"A viewable screen displaying information# presented through a web browser in a single view sometimes requiring the user to scroll to review the entire page. A bank web page may display the bank’s logo# provide information about bank products and services# or allow a customer to interact with the bank or third parties that have contracted with the bank."
|
|
|
"Web Services Description Language (WSDL)"
|
"An XML-formatted language used to describe a web service's capabilities as collections of communication endpoints capable of exchanging messages. WSDL is the language that UDDI uses. (Also see Universal Description# Discovery and Integration (UDDI))"
|
|
|
"web site"
|
"Consists of one or more web pages that may originate at one or more web server computers. A person can view the pages of a website in any order# as he or she would a magazine."
|
|
|
"Whitebox testing"
|
"A testing approach that uses knowledge of a program/module’s underlying implementation and code intervals to verify its expected behavior."
|
|
|
"Wide area network (WAN)"
|
"A computer network connecting different remote locations that may range from short distances# such as a floor or building# to extremely long transmissions that encompass a large region or several countries"
|
|
|
"Windows NT"
|
"A version of the Windows operating system that supports preemptive multitasking"
|
|
|
"Wiretapping"
|
"The practice of eavesdropping on information being transmitted over telecommunications links"
|
|
|
"world wide web (WWW)"
|
"A sub-network of the Internet through which information is exchanged by text# graphics# audio and video."
|
|
|
"World Wide Web Consortium (W3C)"
|
"An international consortium founded in 1994 of affiliates from public and private organizations involved with the Internet and the web. The W3C's primary mission is to promulgate open standards to further enhance the economic growth of Internet web services globally."
|
|
|
"Worm"
|
"With respect to security# a special type of virus that does not attach itself to programs# but rather spreads via other methods such as e-mail (also see virus)"
|
|
|
"X.25"
|
"A protocol for packet-switching networks"
|
|
|
"X.25 interface"
|
"An interface between data terminal equipment (DTE) and data circuit-terminating equipment (DCE) for terminals operating in the packet mode on some public data networks"
|
|
|
"X.500"
|
"Standard that defines how global directories should be structured. X.500 directories are hierarchical with different levels for each category of information# such as country# state and city."
|
