Cissp Terms And Concepts

Front 1

access

Back 1

A subject’s ability to view, modify, or communicate with an object. Access enables the flow of information between the subject and the object.

Front 2

access control

Back 2

Mechanisms, controls, and methods of limiting access to resources to authorized subjects only.

Front 3

access control list (ACL)

Back 3

A list of subjects that are authorized to access a particular object. Typically, the types of access are read, write, execute, append, modify, delete, and create.

Front 4

access control mechanism

Back 4

Administrative, physical, or technical control that is designed to detect and prevent unauthorized access to a resource or environment.

Front 5

accountability

Back 5

A security principle indicating that individuals must be identifiable and must be held responsible for their actions.

Front 6

accredited

Back 6

A computer system or network that has received official authorization and approval to process sensitive data in a specific operational environment. There must be a security evaluation of the system’s hardware, software, configurations, and controls by technical personnel.

Front 7

add-on security

Back 7

Security protection mechanisms that are hardware or software retrofitted to a system to increase that system’s protection level.

Front 8

administrative controls

Back 8

Security mechanisms that are management’s responsibility and referred to as “soft” controls. These controls include the development and publication of policies, standards, procedures, and guidelines, the screening of personnel, security awareness training, the monitoring of system activity, and change control procedures.

Front 9

AIC triad

Back 9

The three security principles: availability, integrity, and confidentiality.

Front 10

annualized rate of occurrence (ARO)

Back 10

The value that represents the estimated possibility of a specific threat taking place within aone-year timeframe.

Front 11

assurance

Back 11

A measurement of confidence in the level of protection that a specific security control delivers and the degree to which it enforces the security policy.

Front 12

attack

Back 12

An attempt to bypass security controls in a system with the mission of using that system or compromising it. An attack is usually accomplished by exploiting a current vulnerability.

Front 13

audit trail

Back 13

A chronological set of logs and records used to provide evidence of a system’s performance or activity that took place on the system. These logs and records can be used to attempt to reconstruct past events and track the activities that took place and possibly detect and identify intruders.

Front 14

authenticate

Back 14

To verify the identity of a subject requesting the use of a system and/ or access to network resources. The steps to giving a subject access to an object should be identification, authentication, and authorization.

Front 15

authorization

Back 15

Granting access to an object after the subject has been properly identified and authenticated.

Front 16

automated information system (AIS)

Back 16

A computer system that is used to process and transmit data. It is a collection of hardware, software, and firmware that works together to accept, compute, communicate, store, process, transmit, and control data-processing functions.

Front 17

availability

Back 17

The reliability and accessibility of data and resources to authorized individuals in a timely manner.

Front 18

back up

Back 18

Copy and move data to a medium so that it may be restored if the original data is corrupted or destroyed. A full backup copies all the data from the system to the backup medium. An incremental backup copies only the files that have been modified since the previous backup. A differential backup backs up all files since the last full backup.

Front 19

backdoor

Back 19

An undocumented way of gaining access to a computer system. After a system is compromised, an attacker may load a program that listens on a port (backdoor) so that the attacker can enter the system at any time. A backdoor is also referred to as a trapdoor.

Front 20

baseline

Back 20

The minimum level of security necessary to support and enforce a security policy.

Front 21

Bell-LaPadula model

Back 21

The model uses a formal state transition model that describes its access controls and how they should perform. When the system must transition from one state to another, the security of the system should never be lowered or compromised. See also multilevel

Front 22

Biba model

Back 22

A formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity.

Front 23

biometrics

Back 23

When used within computer security used to identify individuals by physiological characteristics, such as a fingerprint, hand geometry or pattern in the iris.

Front 24

browsing

Back 24

Searching through storage media looking for specific information without necessarily knowing what format the information is in. A browsing attack is one in which the attacker looks around a computer system either to see what looks interesting or to find specific information.

Front 25

brute force attack

Back 25

An attack that continually tries different inputs to achieve a predefined goal, which can bemused to obtain credentials for unauthorized access.

Front 26

callback

Back 26

A procedure for identifying a system that accessed an environment remotely. In a callback, the host system disconnects the caller and then dials the authorized telephone number of the remote terminal in order to reestablish the connection. Synonymous with dialback.

Front 27

capability

Back 27

A capability outlines the objects a subject can access and the operations the subject can carry out on the different objects. It indicates the access rights for a specific subject; many times, the capability is in the form of a ticket.

Front 28

certification

Back 28

The technical evaluation of the security components and their compliance for the purpose of accreditation. A certification process can use safeguard evaluation, risk analysis, verification, testing, and auditing techniques to assess the appropriateness of a specific system processing a certain level of information within a particular environment. The certification is the testing of the security component or system, and the accreditation is the approval from management of the security component or system.

Front 29

challenge-response method

Back 29

A method used to verify the identity of a subject by sending the subject an unpredictable or random value. If the subject responds with the expected value in return, the subject is authenticated.

Front 30

ciphertext

Back 30

Data that has been encrypted and is unreadable until it has been converted into plaintext.

Front 31

Clark-Wilson model

Back 31

An integrity model that addresses all three integrity goals: prevent unauthorized users from making modifications, prevent authorized users from making improper modifications, and maintain internal and external consistency through auditing.

Front 32

classification

Back 32

A systematic arrangement of objects into groups or categories according to a set of established criteria. Data and resources can be assigned a level of sensitivity as they are being created, amended, enhanced, stored, or transmitted. The classification level then determines the extent to which the resource needs to be controlled and secured, and is indicative of its value in terms of information assets.

Front 33

cleartext

Back 33

In data communications, cleartext is the form of a message or data which is transferred or stored without cryptographic protection.

Front 34

collusion

Back 34

Two or more people working together to carry out a fraudulent activity. More than one person would need to work together to cause some type of destruction or fraud; this drastically reduces its probability.

Front 35

communications security

Back 35

Controls in place to protect information as it is being transmitted, especially by telecommunications mechanisms.

Front 36

compartment

Back 36

A class of information that has need-to-know access controls beyond those normally provided for access to confidential, secret, or top-secret information. A compartment is the same thing as a category within a security label. Just because a subject has the proper classification, that does not mean it has a need to know. The category, or compartment, of the security label enforces the subject’s need to know.

Front 37

compartmented mode workstation (CMW)

Back 37

A workstation that contains the necessary controls to be able to operate as a trusted computer. The system is trusted to keep data from different classification levels and categories in separate compartments and properly protected.

Front 38

compensating controls

Back 38

Controls that are alternative procedures designed to reduce the risk. They are used to” counterbalance” the effects of an internal control weakness.

Front 39

compromise

Back 39

A violation of the security policy of a system or an organization such that unauthorized disclosure or modification of sensitive information occurs.

Front 40

computer fraud

Back 40

Computer-related crimes involving deliberate misrepresentation, modification, or disclosure of data in order to compromise a system or obtain something of value.

Front 41

confidentiality

Back 41

A security principle that works to ensure that information is not disclosed to unauthorized subjects.

Front 42

configuration management

Back 42

The identification, control, accounting, and documentation of all changes that take place to system hardware, software, firmware, supporting documentation, and test results throughout the lifespan of the system.

Front 43

confinement

Back 43

Controlling information in a manner that prevents sensitive data from being leaked from a program to another program, subject, or object in an unauthorized manner.

Front 44

contingency plan

Back 44

A plan put in place before any potential emergencies, with the mission of dealing with possible future emergencies. It pertains to training personnel, performing backups, preparing critical facilities, and recovering from an emergency or disaster so that business operations can continue.

Front 45

control zone

Back 45

The space within a facility that is used to protect sensitive processing equipment. Controls are in place to protect equipment from physical or technical unauthorized entry or compromise. The zone can also be used to prevent electrical waves carrying sensitive data from leaving the area.

Front 46

cost/benefit analysis

Back 46

An assessment that is performed to ensure that the cost of a safeguard does not outweigh the benefit of the safeguard. Spending more to protect an asset than the asset is actually worth does not make good business sense. All possible safeguards must be evaluated to ensure that the most security-effective and cost-effective choice is made.

Front 47

countermeasure

Back 47

A control, method, technique, or procedure that is put into place to prevent a threat agent from exploiting a vulnerability. A countermeasure is put into place to mitigate risk. Also called a safeguard or control.

Front 48

covert channel

Back 48

A communications path that enables a process to transmit information in a way that violates the system’s security policy.

Front 49

covert storage channel

Back 49

A covert channel that involves writing to a storage location by one process and the direct or indirect reading of the storage location by another process. Covert storage channels typically involve a resource (for example, sectors on a disk) that is shared by two subjects at different security levels.

Front 50

covert timing channel

Back 50

A covert channel in which one process modulates its system resource (for example, CPU cycles), which is interpreted by a second process as some type of communication.

Front 51

cryptanalysis

Back 51

The practice of breaking cryptosystems and algorithms used in encryption and decryption processes.

Front 52

cryptography

Back 52

The science of secret writing that enables storage and transmission of data in a form that is available only to the intended individuals.

Front 53

cryptology

Back 53

The study of cryptography and cryptanalysis.

Front 54

cryptosystem

Back 54

The hardware or software implementation of cryptography.

Front 55

data classification

Back 55

Assignments to data that indicate the level of availability, integrity, and confidentiality that is required for each type of information.

Front 56

data custodian

Back 56

An individual who is responsible for the maintenance and protection of the data. This role is usually filled by the IT department (usually the network administrator). The duties include performing regular backups of the data, implementing security mechanisms, periodically validating the integrity of the data, restoring data from backup media, and fulfilling the requirements specified in the company’s security policy, standards, and guidelines that pertain to information security and data protection.

Front 57

Data Encryption Standard (DES)

Back 57

Symmetric key encryption algorithm that was adopted by the government as a federal standard for protecting sensitive unclassified information. DES was later replaced with Advanced Encryption Standard (AES).

Front 58

data remanence

Back 58

A measure of the magnetic flux density remaining after removal of the applied magnetic force, which is used to erase data. Refers to any data remaining on magnetic storage media.

Front 59

database shadowing

Back 59

A mirroring technology used in databases, in which information is written to at least two hard drives for the purpose of redundancy.

Front 60

declassification

Back 60

An administrative decision or procedure to remove or reduce the security classification information.

Front 61

dedicated security mode

Back 61

The mode in which a system operates if all users have the clearance or authorization to access, and the need to know about, all data processed within the system. All users have been given formal access approval for all information on the system and have signed nondisclosure agreements pertaining to this information.

Front 62

degauss

Back 62

Process that demagnetizes magnetic media so that a very low residue of magnetic inductions left on the media. Used to effectively erase data from media.

Front 63

Delphi technique

Back 63

A group decision method used to ensure that each member of a group gives an honest and anonymous opinion pertaining to the company’s risks.

Front 64

denial of service (DoS)

Back 64

Any action, or series of actions, that prevents a system, or its resources, from functioning in accordance with its intended purpose.

Front 65

dial-up

Back 65

The service whereby a computer terminal can use telephone lines, usually via a modem, to initiate and continue communication with another computer system.

Front 66

dictionary attack

Back 66

A form of attack in which an attacker uses a large set of likely combinations to guess a secret, usually a password.

Front 67

digital signature

Back 67

An electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

Front 68

disaster recovery plan

Back 68

A plan developed to help a company recover from a disaster. It provides procedures for emergency response, extended backup operations, and post-disaster recovery when an organization suffers a loss of computer processing capability or resources and physical facilities.

Front 69

discretionary access control (DAC)

Back 69

An access control model and policy that restricts access to objects based on the identity of the subjects and the groups to which those subjects belong. The data owner has the discretion of allowing or denying others access to the resources it owns.

Front 70

domain

Back 70

The set of objects that a subject is allowed to access. Within this domain, all subjects and objects share a common security policy, procedures, and rules, and they are managed by the same management system.

Front 71

due care

Back 71

Steps taken to show that a company has taken responsibility for the activities that occur within the corporation and has taken the necessary steps to help protect the company, its resources and employees.

Front 72

electronic vaulting

Back 72

The transfer of backup data to an offsite location. This process is primarily a batch process of transmitting data through communications lines to a server at an alternate location.

Front 73

emanations

Back 73

Electrical and electromagnetic signals emitted from electrical equipment that can transmit through the airwaves. These signals carry information that can be captured and deciphered, which can cause a security breach. These are also called emissions.

Front 74

encryption

Back 74

The transformation of plaintext into unreadable ciphertext.

Front 75

end-to-end encryption

Back 75

A technology that encrypts the data payload of a packet.

Front 76

Evaluated Products List (EPL)

Back 76

A list of products that have been evaluated and assigned an assurance rating. The products could be evaluated using several different criterion: TCSEC, ITSEC, or Common Criteria.

Front 77

exposure

Back 77

An instance of being exposed to losses from a threat. A weakness or vulnerability can cause an organization to be exposed to possible damages.

Front 78

exposure factor

Back 78

The percentage of loss a realized threat could have on a certain asset.

Front 79

failover

Back 79

A backup operation that automatically switches to a standby system if the primary system fails or is taken offline. It is an important fault-tolerant function that provides system availability.

Front 80

fail-safe

Back 80

A functionality that ensures that when software or a system fails for any reason, it does not end up in a vulnerable state. After a failure, software might default to no access instead of allowing full control, which would be an example of a fail-safe measure.

Front 81

firmware

Back 81

Software instructions that have been written into read-only memory (ROM) or a programmable ROM (PROM) chip.

Front 82

formal security policy model

Back 82

A mathematical statement of a security policy. When an operating system is created, it can be built upon a predeveloped model that lays out how all activities will take place in each and every situation. This model can be expressed mathematically, which is then translated into a programming language.

Front 83

formal verification

Back 83

Validating and testing of highly trusted systems. The tests are designed to show design verification, consistency between the formal specifications and the formal security policy model, implementation verification, consistency between the formal specifications, and the actual implementation of the product.

Front 84

gateway

Back 84

A system or device that connects two unlike environments or systems. The gateway is usually required to translate between different types of applications or protocols.

Front 85

guidelines

Back 85

Recommended actions and operational guides for users, IT staff, operations staff, and others when a specific standard does not apply.

Front 86

handshaking procedure

Back 86

A dialog between two entities for the purpose of identifying and authenticating the entities to one another. The dialog can take place between two computers or two applications residing on different computers. It is an activity that usually takes place within a protocol.

Front 87

honeypot

Back 87

A computer set up as a sacrificial lamb on the network in the hope that attackers will attack this system instead of actual production systems.

Front 88

identification

Back 88

A subject provides some type of data to an authentication service. Identification is the first step in the authentication process.

Front 89

information owner

Back 89

The person who has final corporate responsibility of data protection and would be the one held liable for any negligence when it comes to protecting the company’s information assets. The person who holds this role—usually a senior executive within the management group of the company—is responsible for assigning a classification to the information and dictating how the information should be protected.

Front 90

integrity

Back 90

A security principle that makes sure that information and systems are not modified maliciously or accidentally.

Front 91

intrusion detection system (IDS)

Back 91

Software employed to monitor and detect possible attacks and behaviors that vary from the normal and expected activity. The IDS can be network based, which monitors network traffic, or host based, which monitors activities of a specific system and protects system files and control mechanisms.

Front 92

isolation

Back 92

The containment of processes in a system in such a way that they are separated from one another to ensure integrity and confidentiality.

Front 93

Kernel

Back 93

The core of an operating system, a kernel manages the machine’s hardware resources (including the processor and the memory), and provides and controls the way any other software component accesses these resources.

Front 94

key

Back 94

A discreet data set that controls the operation of a cryptography algorithm. In encryption, a key specifies the particular transformation of plaintext into ciphertext, or vice versa during decryption. Keys are also used in other cryptographic algorithms, such as digital signature schemes and keyed-hash functions (also known as HMACs), which are often used for authentication and integrity.

Front 95

keystroke monitoring

Back 95

A type of auditing that can review or record keystrokes entered by a user during an active session.

Front 96

lattice-based access control model

Back 96

A mathematical model that allows a system to easily represent the different security levels and control access attempts based on those levels. Every pair of elements has a highest lower bound and a lowest upper bound of access rights. The classes stemmed from military designations.

Front 97

least privilege

Back 97

The security principle that requires each subject to be granted the most restrictive set of privileges needed for the performance of authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized use.

Front 98

life-cycle assurance

Back 98

Confidence that a trusted system is designed, developed, and maintained with formal designs and controls. This includes design specification and verification, implementation, testing, configuration management, and distribution.

Front 99

link encryption

Back 99

A type of encryption technology that encrypts packets’ headers, trailers, and the data payload. Each network communications node, or hop, must decrypt the packets to read its address and routing information and then re-encrypt the packets. This is different from end-to-end encryption.

Front 100

logic bomb

Back 100

A malicious program that is triggered by a specific event or condition.

Front 101

loss potential

Back 101

The potential losses that can be accrued if a threat agent actually exploits a vulnerability.

Front 102

maintenance hook

Back 102

Instructions within a program’s code that enable the developer or maintainer to enter the program without having to go through the usual access control and authentication processes. Maintenance hooks should be removed from the code before it is released to production; otherwise, they can cause serious security risks. Also called trapdoor or backdoor.

Front 103

malware

Back 103

Malicious software. Code written to perform activities that circumvent the security policy of a system. Examples are viruses, malicious applets, Trojan horses, logical bombs, and worms.

Front 104

mandatory access control (MAC)

Back 104

An access policy that restricts subjects’ access to objects based on the security clearance of the subject and the classification of the object. The system enforces the security policy, and users cannot share their files with other users.

Front 105

message authentication code (MAC)

Back 105

In cryptography, a message authentication code (MAC) is a generated value used to authenticate a message. A MAC can be generated by HMAC or CBC-MAC methods. The MAC protects both a message’s integrity (by ensuring that a different MAC will be produced if the message has changed) as well as its authenticity, because only someone who knows the secret key could have modified the message.

Front 106

multilevel security

Back 106

A class of systems containing information with different classifications. Access decisions are based on the subject’s security clearances, need to know, and formal approval.

Front 107

need to know

Back 107

A security principle stating that users should have access only to the information and resources necessary to complete their tasks that fulfill their roles within an organization. Need to know is commonly used in access control criterion by operating systems and applications.

Front 108

node

Back 108

A system that is connected to a network.

Front 109

object

Back 109

A passive entity that contains or receives information. Access to an object potentially implies access to the information that it contains. Examples of objects include records, pages, memory segments, files, directories, directory trees, and programs.

Front 110

object reuse

Back 110

Reassigning to a subject media that previously contained information. Object reuse is a security concern because if insufficient measures were taken to erase the information on the media, the information may be disclosed to unauthorized personnel.

Front 111

one-time pad

Back 111

A method of encryption in which the plaintext is combined with a random “pad,” which should be the same length as the plaintext. This encryption process uses a nonrepeating set of random bits that are combined bitwise (XOR) with the message to produce ciphertext. A one-time pad is a perfect encryption scheme, because it is unbreakable and each pad is used exactly once, but it is impractical because of all of the required overhead.

Front 112

operational assurance

Back 112

A level of confidence of a trusted system’s architecture and implementation that enforces the system’s security policy. This can include system architecture, covert channel analysis, system integrity, and trusted recovery.

Front 113

operational goals

Back 113

Daily goals to be accomplished to ensure the proper operation of an environment.

Front 114

operator

Back 114

An individual who supports the operations of computer systems—usually a mainframe. The individual may monitor the execution of the system, control the flow of jobs, and develop and schedule batch jobs.

Front 115

Orange Book

Back 115

The common name for the Trusted Computer Security Evaluation Criteria (TCSEC).

Front 116

overt channel

Back 116

A path within a computer system or network that is designed for the authorized transfer of data.

Front 117

password

Back 117

A sequence of characters used to prove one’s identity. It is used during a logon process and should be highly protected.

Front 118

penetration

Back 118

A successful attempt at circumventing security controls and gaining access to a system.

Front 119

penetration testing

Back 119

Penetration testing is a method of evaluating the security of a computer system or network by simulating an attack that a malicious hacker would carry out. This is done so that vulnerabilities and weaknesses can be uncovered.

Front 120

permissions

Back 120

The type of authorized interactions that a subject can have with an object. Examples include read, write, execute, add, modify, and delete.

Front 121

personnel security

Back 121

The procedures that are established to ensure that all personnel who have access to sensitive information have the required authority as well as appropriate clearances. Procedures confirm a person’s background and provide assurance of necessary trustworthiness.

Front 122

physical controls

Back 122

Controls that pertain to controlling individual access into the facility and different departments, locking systems and removing unnecessary floppy or CD-ROM drives, protecting the perimeter of the facility, monitoring for intrusion, and checking environmental controls.

Front 123

physical security

Back 123

Controls and procedures put into place to prevent intruders from physically accessing a system or facility. The controls enforce access control and authorized access.

Front 124

piggyback

Back 124

Unauthorized access to a system by using another user’s legitimate credentials.

Front 125

plaintext

Back 125

In cryptography, the original readable text before it is encrypted.

Front 126

playback attack

Back 126

Capturing data and resending the data at a later time in the hope of tricking the receiving system. This is usually carried out to obtain unauthorized access to specific resources.

Front 127

privacy

Back 127

A security principle that protects an individual’s information and employs controls to ensure that this information is not disseminated or accessed in an unauthorized manner.

Front 128

procedure

Back 128

Detailed step-by-step instructions to achieve a certain task, which are used by users, IT staff, operations staff, security members, and others.

Front 129

protection ring

Back 129

An architecture that provides hierarchies of privileged operation modes of a system, which gives certain access rights to processes that are authorized to operate in that mode. Supports the integrity and confidentiality requirements of multitasking operating systems and enables the operating system to protect itself from user programs and rogue processes.

Front 130

protocol

Back 130

A set of rules and formats that enables the standardized exchange of information between different systems.

Front 131

pseudo-flaw

Back 131

An apparent loophole deliberately implanted in an operating system or program as a trap for intruders.

Front 132

public key encryption

Back 132

A type of encryption that uses two mathematically related keys to encrypt and decrypt messages. The private key is known only to the owner, and the public key is available to anyone.

Front 133

purge

Back 133

The removal of sensitive data from a system, storage device, or peripheral device with storage capacity at the end of a processing period. This action is performed in such a way that there is assurance proportional to the sensitivity of the data that the data cannot be reconstructed.

Front 134

qualitative risk analysis

Back 134

A risk analysis method that uses intuition and experience to judge an organization’s exposure to risks. It uses scenarios and ratings systems. Compare to quantitative risk

Front 135

quantitative risk analysis

Back 135

A risk analysis method that attempts to use percentages in damage estimations and assigns real numbers to the costs of countermeasures for particular risks and the amount of damage that could result from the risk. Compare to qualitative risk analysis.

Front 136

RADIUS (Remote Authentication Dial-in User Service)

Back 136

A security service that authenticates and authorizes dial-up users and is a centralized access control mechanism.

Front 137

read

Back 137

An operation that results in the flow of information from an object to a subject and does not give the subject the ability to modify the object or the data within the object.

Front 138

recovery planning

Back 138

The advance planning and preparations that are necessary to minimize loss and to ensure the availability of the critical information systems of an organization after a disruption in service or a disaster.

Front 139

reference monitor concept

Back 139

An access control concept that refers to an abstract machine that mediates all accesses to objects by subjects. The security kernel enforces the reference monitor concept.

Front 140

reliability

Back 140

The assurance of a given system, or individual component, performing its mission adequately for a specified period of time under the expected operating conditions.

Front 141

remote journaling

Back 141

A method of transmitting changes to data to an offsite facility. This takes place as parallel processing of transactions, meaning that changes to the data are saved locally and to an off-site facility. These activities take place in real time and provide redundancy and fault tolerance.

Front 142

repudiation

Back 142

When the sender of a message denies sending the message. The countermeasure to this is to implement digital signatures.

Front 143

residual risk

Back 143

The remaining risk after the security controls have been applied. The conceptual formulas that explain the difference between total and residual risk are threats×vulnerability×asset value=total risk (threats×vulnerability×asset value) ×controls gap=residual risk

Front 144

risk

Back 144

The likelihood of a threat agent taking advantage of a vulnerability and the resulting business impact. A risk is the loss potential, or probability, that a threat will exploit a vulnerability.

Front 145

risk analysis

Back 145

A method of identifying risks and assessing the possible damage that could be caused in order to justify security safeguards.

Front 146

risk management

Back 146

The process of identifying, assessing, and reducing the risk to an acceptable level and implementing the right mechanisms to maintain that level of risk.

Front 147

role-based access control (RBAC)

Back 147

Type of model that provides access to resources based on the role the user holds within the company or the tasks that the user has been assigned.

Front 148

safeguard

Back 148

A software configuration, hardware, or procedure that eliminates a vulnerability or reduces the risk of a threat agent from being able to exploit a vulnerability. Also called a countermeasure or control.

Front 149

secure configuration management

Back 149

Implementing the set of appropriate procedures to control the life cycle of an application, document the necessary change control activities, and ensure that the changes will not violate the security policy.

Front 150

security evaluation

Back 150

Assesses the degree of trust and assurance that can be placed in systems for the secure handling of sensitive information.

Front 151

security kernel

Back 151

The hardware, firmware, and software elements of a trusted computing base (TCB) that implement the reference monitor concept. The kernel must mediate all access between subjects and objects, be protected from modification, and be verifiable as correct.

Front 152

security label

Back 152

An identifier that represents the security level of an object.

Front 153

security perimeter

Back 153

An imaginary boundary between the components within the trusted computing base (TCB) and mechanisms that do not fall within the TCB. It is the distinction between trusted and untrusted processes.

Front 154

security policy

Back 154

Documentation that describes senior management’s directives toward the role that security plays within the organization. It provides a framework within which an organization establishes needed levels of information security to achieve the desired confidentiality, availability, and integrity goals. A policy is a statement of information values, protection responsibilities, and organization commitment managing risks.

Front 155

security testing

Back 155

Testing all security mechanisms and features within a system to determine the level of protection they provide. Security testing can include penetration testing, formal design and implementation verification, and functional testing.

Front 156

sensitive information

Back 156

Information that would cause a negative effect on the company if it were lost or compromised.

Front 157

sensitivity label

Back 157

A piece of information that represents the security level of an object. Sensitivity labels are used by the TCB as the basis for mandatory access control (MAC) decisions.

Front 158

separation of duties

Back 158

A security principle that splits up a critical task among two or more individuals to ensure that one person cannot complete a risky task by himself.

Front 159

shoulder surfing

Back 159

When a person looks over another person’s shoulder and watches keystrokes or watches data as it appears on the screen in order to uncover information in an unauthorized manner.

Front 160

simple security property

Back 160

A Bell-LaPadula security model rule that stipulates that a subject cannot read data at a higher security level.

Front 161

single loss expectancy (SLE)

Back 161

A dollar amount that is assigned to a single event that represents the company’s potential loss amount if a specific threat were to take place. asset value×exposure factor=SLE

Front 162

social engineering

Back 162

The act of tricking another person into providing confidential information by posing as an individual who is authorized to receive that information.

Front 163

spoofing

Back 163

Presenting false information, usually within packets, to trick other systems and hide the origin of the message. This is usually done by hackers so that their identity cannot be successfully uncovered.

Front 164

standards

Back 164

Rules indicating how hardware and software should be implemented, used, and maintained. Standards provide a means to ensure that specific technologies, applications, parameters, and procedures are carried out in a uniform way across the organization. They are compulsory.

Front 165

star property (*-property)

Back 165

A Bell-LaPadula security model rule that stipulates that a subject cannot write data to an object at a lower security level.

Front 166

strategic goals

Back 166

Long-term goals that are broad, general statements of intent. Operational and tactical goals support strategic goals and all are a part of a planning horizon.

Front 167

subject

Back 167

An active entity, generally in the form of a person, process, or device, that causes information to flow among objects or that changes the system state.

Front 168

supervisor state

Back 168

One of several states in which an operating system may operate, and the only one in which privileged instructions may be executed by the CPU.

Front 169

TACACS (Terminal Access Controller Access Control System)

Back 169

A client/server authentication protocol that provides the same type of functionality as RADIUS and is used as a central access control mechanism mainly for remote users.

Front 170

tactical goals

Back 170

Midterm goals to accomplish. These may be milestones to accomplish within a project or specific projects to accomplish in a year. Strategic, tactical, and operational goals make up a planning horizon.

Front 171

technical controls

Back 171

These controls, also called logical access control mechanisms, work in software to provide confidentiality, integrity, or availability protection. Some examples are passwords, identification and authentication methods, security devices, auditing, and the configuration of the network.

Front 172

Tempest

Back 172

The study and control of spurious electronic signals emitted by electrical equipment. Tempest equipment is implemented to prevent intruders from picking up information through the airwaves with listening devices.

Front 173

threat

Back 173

Any potential danger that a vulnerability will be exploited by a threat agent.

Front 174

top-down approach

Back 174

An approach in which the initiation, support, and direction for a project come from top management and work their way down through middle management and then to staff members.

Front 175

topology

Back 175

The physical construction of how nodes are connected to form a network.

Front 176

total risk

Back 176

When a safeguard is not implemented, an organization is faced with the total risk of that particular vulnerability.

Front 177

Trojan horse

Back 177

A computer program that has an apparently or actually useful function, but that also contains additional hidden malicious capabilities to exploit a vulnerability and/or provide unauthorized access into a system.

Front 178

trusted computer system

Back 178

A system that has the necessary controls to ensure that the security policy will not be compromised and that can process a range of sensitive or classified information simultaneously.

Front 179

trusted computing base (TCB)

Back 179

All of the protection mechanisms within a computer system (software, hardware, and firmware) that are responsible for enforcing a security policy.

Front 180

trusted path

Back 180

A mechanism within the system that enables the user to communicate directly with the TCB. This mechanism can be activated only by the user or the TCB and not by an untrusted mechanism or process.

Front 181

trusted recovery

Back 181

A set of procedures that restores a system and its data in a trusted manner after the system has been disrupted or a system failure has occurred.

Front 182

user

Back 182

A person or process that is accessing a computer system.

Front 183

user ID

Back 183

A unique set of characters or code that is used to identify a specific user to a system.

Front 184

validation

Back 184

The act of performing tests and evaluations to test a system’s security level to see if it complies with security specifications and requirements.

Front 185

virus

Back 185

A small application, or string of code, that infects applications. The main function of a virus is to reproduce, and it requires a host application to do this. It can damage data directly or degrade system performance.

Front 186

vulnerability

Back 186

The absence or weakness of a safeguard that could be exploited.

Front 187

wardialing

Back 187

An attack in which a long list of phone numbers is inserted into a wardialing program in the hope of finding a modem that can be exploited to gain unauthorized access.

Front 188

work factor

Back 188

The estimated time and effort required for an attacker to overcome a security control.

Front 189

worm

Back 189

An independent program that can reproduce by copying itself from one system to another. It may damage data directly or degrade system performance by tying up resources.

Front 190

write

Back 190

An operation that results in the flow of information from a subject to an object.