- 3DESAlso known as Triple Data Encryption Standard, it’s a widely used symmetric key encryption algorithm that encrypts data three times using three different keys. It is considered a more secure alternative to the original Data Encryption Standard (DES) algorithm, as it increases the difficulty of breaking the encryption by using multiple keys. 3DES is commonly used in financial transactions, online payments, and other sensitive data transmissions. It is also used in many security protocols, such as SSL and VPNs, to ensure secure communication between devices.
- 3-legged DMZA network design strategy that uses three security zones – the Internet (untrusted), an intermediary area known as the Demilitarized Zone (DMZ), and the internal network (trusted). The DMZ hosts public-facing services, acting as a buffer between the Internet and the internal network. This model adds an extra layer of protection by ensuring direct traffic between the Internet and the trusted network is minimized and strictly controlled.
- 3-way HandshakeA three-step process used in network communications to establish a connection between a client and a server in TCP/IP protocol. The handshake begins when the client sends a SYN (synchronize) packet to the server to request a connection. The server then responds with a SYN-ACK (synchronize-acknowledge) packet to acknowledge the request. Finally, the client sends an ACK (acknowledge) packet back to the server to confirm. Once this process is completed, the TCP connection is established, allowing for data transmission to take place. This handshake is essential for initiating a reliable session between two devices over a network.
- 10Base2A specific type of Ethernet network standard characterized by a maximum data transfer rate of 10 Mbps, baseband transmission, and a maximum cable segment length of 185 meters. This standard, also known as thin Ethernet or thinnet, uses a thinner and more flexible coaxial cable, allowing for easier installation and management in environments such as office buildings.
- 10Base5A specification for thick Ethernet, a networking standard that also operates at a data transfer rate of 10 Mbps but uses thicker, more rigid coaxial cables that can transmit data over a maximum distance of 500 meters. The name ’10Base5′ is derived from its 10 Mbps speed, baseband transmission, and 500-meter cable limit. Due to its ability to handle greater distances, it’s often used in larger, more sprawling network setups.
- 10BaseTAn Ethernet standard that operates at 10 Mbps and uses baseband transmission over twisted pair cabling. The ‘T’ in 10BaseT stands for ‘Twisted pair,’ indicating the type of cabling used. It is designed for small, local networks and supports star network configurations, which centralize network control and allow easier detection of connection issues.
- 3-2-1 Backup StrategyA best practice for data protection and disaster recovery, recommending three copies of data stored on two different types of storage media, with one of the copies stored off-site. This strategy offers multiple recovery points and storage diversity to increase the likelihood of data recovery after a disaster, ensuring data safety even when faced with hardware failure, natural disaster, or accidental deletion.
- 99.999 UptimeThe high availability of a system or service, quantified as being operational 99.999% of the time, often referred to as “five nines”. This equates to a downtime of approximately 5 minutes and 15 seconds per year, thus indicating a system with highly reliable and uninterrupted service. High availability is crucial for systems where even minimal downtime can lead to significant operational or financial impact.
- AAA ServerA server that provides authentication, authorization, and accounting services for network devices and users. An AAA server is a network security device that controls access to a network by verifying the identity of a user or device and granting or denying access based on predefined policies. It is commonly used in enterprise networks to control access to resources and track user activity.
- AbendStands for abnormal end. It refers to an unexpected termination of a program or system due to an error or bug. It is commonly used in the context of computer systems and software development to refer to a crash or failure.
- AbstractionA fundamental concept in computer science that involves managing complexity by hiding unnecessary details from the user. Abstraction enables users to interact with systems and applications through simplified models without needing to understand the underlying complex workings.
- Abuse Case TestingA testing methodology where scenarios are developed to anticipate and examine potential misuse or malicious behavior against a system. It aims to uncover potential vulnerabilities or flaws that might not be detected through traditional use case testing, which typically focuses on expected and correct usage. By considering the system from an adversary’s perspective, it’s possible to enhance the system’s defenses against illegitimate usage or attacks.
- Acceptable Interruption WindowThis refers to the maximum time period during which a system or service can be down without causing unacceptable harm to the operations or the business. It is a key factor in disaster recovery and business continuity planning, as it helps to set the recovery time objective (RTO). Understanding the acceptable interruption window is crucial for managing downtime risks and ensuring appropriate investment in preventative and recovery measures.
- Acceptable Use PolicyA policy that defines the acceptable behaviors and actions of users when interacting with a network or system. It typically outlines user responsibilities, prohibited activities, and potential consequences for violations. The policy serves as a guideline for proper and respectful use of resources, and it helps protect the network, its users, and the organization from potential legal issues, security breaches, or reputation damage.
- Acceptance (As Related to Risk) Or Accepting RiskAccepted Ways for Handling Risk – In the context of risk management, there are generally accepted strategies for handling risk, which can be summarized as the “Four T’s” of risk management. Treat – Implement measures to reduce the likelihood or impact of the risk. This often involves changing processes, procedures, or technology to mitigate the risk. Transfer – Shift the risk to a third party, typically through insurance, outsourcing, or partnerships. In this way, another entity assumes the responsibility for the risk’s consequences. Tolerate – Accept the risk without action if it falls within the organization’s risk appetite and threshold levels, often because the cost of treating it would exceed the benefit gained from mitigation. Terminate- Avoid the risk altogether by discontinuing the activity that generates the risk. This might mean changing business practices or stopping certain services or functions. There technically also is Risk rejection, we know the risk is there,(…) Read More
- AccessIn the context of IT and cybersecurity, access refers to the permission or ability to enter or use a system, network, resource, or data. Managing access involves authenticating users to confirm their identity and authorizing them to interact with certain information or functionalities based on their roles, responsibilities, and established security policies. Access controls are put in place to prevent unauthorized individuals from gaining entry to sensitive systems or information, thereby protecting the confidentiality, integrity, and availability of data. Access can be categorized into physical access, which pertains to entering facilities, and logical access, related to using computer networks, systems, and data.
- Access ControlRefers to the systematic regulation of the ability of authenticated users to view, use, or alter resources. This procedure safeguards sensitive data from unauthorized access, protects system integrity, and prevents potential disruptions. It includes techniques such as role-based access control (RBAC), discretionary access control (DAC), and mandatory access control (MAC), which decide the level of user access based on assigned roles, user discretion, and adherence to policies, respectively.
- Access Control List (ACL)A table or database that keeps track of the permissions attached to an object, such as a file directory or a network interface. The ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects. It is a key concept in file permissions, network security, and database management, where it is critical to maintain the right balance between security and usability.
- Access Control MatrixA two-dimensional table used to implement an access control policy within a system. In this matrix, the rows represent subjects (like users or processes), and the columns represent objects (like files, directories, or devices). The intersection of a row and a column indicates the access rights that the subject has over the object. It offers a comprehensive view of the access rights within a system, assisting in the design, implementation, and auditing of access control policies.
- Access Control MechanismA process or system that manages access to resources within a system by enforcing policies and rules. These mechanisms often involve elements of identification, authentication, authorization, and accountability. They are integral to maintaining the security of a system by ensuring that only properly authenticated and authorized users gain access to the resources they require and no more.
- Access Control ModelA framework that dictates how subjects (users or processes) access objects (resources) within a system. Common models include Discretionary Access Control (DAC), where access is granted based on user identity; Mandatory Access Control (MAC), where access is determined by comparing the labels (clearances) of the users and the data; and Role-Based Access Control (RBAC), where permissions are based on user roles rather than individual user identities.
- Access LevelA categorization of the degree of authorization that a user has when accessing a network or system. These levels often correspond to the roles of users and determine what kind of operations they can perform on the system. For instance, a user with an administrative access level has more permissions compared to a user with a standard access level. Defining access levels is a key part of access control and is crucial for maintaining system security and data integrity.
- Access management lifecycleThe set of processes and procedures for managing access to a system or network, from initial user authentication to ongoing monitoring and revoking of access. It is used in organizations to ensure the security of their networks and data and to prevent unauthorized access. Examples include implementing password policies, conducting regular audits of user access, and providing training on secure access practices.
- Access MethodThe technique or protocol that a system uses to locate and retrieve data from storage or transmit data over a network. Different access methods might be used depending on the type of data, the storage medium, or the network architecture. By defining standard access methods, systems can ensure data interoperability, optimize performance, and maintain data integrity and security.
- Access PathThe route or means through which data is retrieved from a database. This typically involves a series of steps or operations that the database management system executes based on a given query, such as scanning an index or traversing a table. Efficient access paths can significantly improve query performance and system responsiveness while also ensuring that data access adheres to security and integrity constraints.
- Access point (AP)A device that connects wireless devices to a wired network, allowing them to communicate and access resources on the network. It is used in wireless networks to provide connectivity and access to network resources. Examples of access points include routers and wireless hotspots.
- Access ProfileA predefined set of permissions and settings that determines what a user or role can do within a system. It can include parameters such as data access rights, available functionalities, and interface customization. By assigning users to appropriate access profiles, a system can effectively control access, streamline user management, and ensure that users have the necessary capabilities to perform their tasks without compromising security.
- Access RightsThe privileges or permissions that are granted to a user or group of users within a system or network. These rights can include the ability to read, write, modify, or delete data, as well as access specific resources or functions within the system. For example, a user may have read-only access to a company’s financial reports, while another user may have full access to the company’s customer database.
- Access ServerA server that controls access to a network and its resources, often by providing authentication, authorization, and accounting services. It can serve as a point of entry into a network, handling connection requests from users and deciding whether to grant or deny access based on predefined policies. By centralizing access control, an access server enhances security, simplifies management, and provides a foundation for auditing and monitoring user activities.
- Access TypeThe kind of operations that a user or role can perform on a resource within a system. Common access types include read (viewing data), write (modifying data), execute (running a program or script), and delete (removing data). Defining access types is a critical part of access control, as it helps maintain data integrity, prevent unauthorized actions, and ensure that users have the necessary permissions to perform their tasks.
- AccountabilityThe principle that individuals are held responsible for their actions within a system. In the context of a system, this involves tracking and recording user activities, often through auditing and logging mechanisms, so that actions can be traced back to the individual users who performed them. Accountability helps deter malicious activities, aids in incident response and forensic analysis, and ensures that users follow policies and procedures.
- Accountability of GovernanceThis principle emphasizes that those in governing roles bear responsibility for the decisions and actions within their purview. In the context of a system or network, it means that management is responsible for the establishment, implementation, and effectiveness of security policies and procedures. This accountability ensures that governance roles prioritize system integrity, data protection, and adherence to regulatory standards.
- Accountable PartyThe individual or entity that is ultimately responsible for ensuring that activities involving sensitive information, security processes, or risk management practices are carried out properly and in line with organizational policies and standards. The accountable party is answerable for the outcomes of the decisions made, including the implementation of controls and mitigation of risks, and is typically a senior executive or manager who has the authority to commit resources and enforce actions. This role involves oversight and governance and is distinct from the roles of individuals who may be responsible for performing the day-to-day tasks associated with these activities.
- Account access reviewThe process of regularly reviewing and assessing the access granted to user accounts on a system or network. It is used to ensure that access is appropriate and in line with the user’s current roles and responsibilities and to identify and remove any unnecessary or unused access. Examples of account access reviews include reviewing access to shared resources, such as files and databases, and assessing the need for access to specific applications or systems.
- Account LockoutA security measure that automatically locks an account after a certain number of failed login attempts. It is used to prevent unauthorized access to an account and is commonly found in password policies. Examples – A user tries to log in to their email account and enters the wrong password 5 times, causing the account to be locked. An employee attempts to access a secure database but forgets their password, resulting in their account being locked after 3 failed attempts.
- Account managementThe process of creating, maintaining, and managing user accounts on a system or network. It is used to ensure that only authorized users have access to the system and that access is granted and revoked in a controlled and secure manner. Examples of account management include setting up new user accounts, modifying existing accounts, and disabling accounts when necessary.
- Account Policy EnforcementThe implementation and enforcement of rules and procedures that govern how user accounts are managed within a system. This includes policies on password complexity, account lockouts, session timeouts, and user access rights. Enforcing account policies helps maintain system security, protect user data, prevent unauthorized access, and ensure regulatory compliance.
- AccreditationThe official recognition that a system, product, or individual meets specified requirements or standards. For a system or product, this might involve a thorough assessment of its security features, performance, and reliability. For an individual, it could mean they have demonstrated a certain level of expertise or competence. Accreditation enhances trustworthiness, promotes quality and Consistency, and provides a benchmark for comparison.
- Accreditation of IT SystemsThe formal approval process that a system undergoes to verify that it adheres to a set of predefined standards or guidelines, often related to security, functionality, and reliability. During accreditation, various aspects, such as design, implementation, and operating procedures, are evaluated to ensure compliance. This process enhances confidence in the system’s capabilities and its adherence to necessary norms while also identifying areas of potential improvement.
- Accrediting AuthorityAn entity, often a recognized body or organization, which has the power to grant accreditation to systems, products, or individuals. The authority conducts or oversees assessments to verify compliance with specified requirements or standards. Their role is crucial in maintaining standards of quality, performance, and security, and their endorsement serves as a mark of trust and reliability.
- ACID TransactionA concept used in database management to ensure that all database transactions are processed reliably. ACID stands for Atomicity (transactions are all-or-nothing), Consistency (transactions must leave the database in a consistent state), Isolation (transactions are processed independently), and Durability (once a transaction is committed, it is permanently recorded). This framework is crucial for maintaining data integrity across a variety of applications.
- Acknowledgment (ACK)A signal sent between devices during a communication process to confirm that data has been successfully received. Typically, an ACK is sent from the receiver back to the sender after a packet of data has been received. The use of acknowledgments helps to ensure the reliability of communication systems, as it allows for error detection and prompts retransmission of data if an ACK is not received within a certain time frame.
- Acoustic Side-Channel AttackAn attack method that exploits sound waves produced by a device during its operation to extract sensitive information. By analyzing noises such as keystrokes or fan vibrations, an attacker may be able to infer user inputs, system states, or other confidential data. These attacks highlight the need for comprehensive security measures that consider not just digital but also physical and environmental aspects of system operation.
- AcquisitionsIn the business context, acquisitions refer to the process of one company purchasing most or all of another company’s shares or assets in order to take control of that company. In terms of IT and cybersecurity, acquisitions can have significant implications for technology integration, data management, and security considerations. It is critical to conduct thorough due diligence and plan for the secure integration of systems, networks, and data during the acquisition process to manage potential security risks and ensure regulatory compliance.
- Active DirectoryA directory service developed by Microsoft that provides a centralized and secure platform for managing user accounts, network resources, and access controls in a Windows environment. This concept is commonly used in enterprise IT environments to simplify users, manage permissions, and enforce security policies. Examples of Active Directory features include group policy management, authentication and authorization, and domain-based naming and organization.
- Active Recovery Site (Mirrored)A disaster recovery site that is a real-time replica of the primary site, continually updated with data and transactions from the primary site. In the event of a system disruption or failure at the primary site, the active recovery site can take over almost instantly, ensuring business continuity with minimal downtime. This high-availability solution is crucial for organizations that cannot tolerate significant data loss or downtime.
- Active ResponseA security measure that immediately takes action to prevent or mitigate a potential threat or attack. It is commonly used in intrusion detection and prevention systems. Examples include blocking an IP address after multiple failed login attempts or shutting down a network port that is being used for a malicious attack.
- Active SniffingA method of data interception in IT and Cybersecurity where the attacker actively inserts themselves into a network to intercept and possibly alter data packets passing through the network. Unlike passive sniffing, where the attacker is silent and only listens to network traffic, active sniffing usually involves techniques that can influence or modify the flow of data, such as ARP spoofing, DHCP attacks, or MAC flooding. Active sniffing is detectable due to the intervention in the network communication.
- ActiveXA software framework developed by Microsoft that allows for the creation of interactive web-based applications. It is commonly used in Internet Explorer and other web browsers to provide enhanced functionality and interactivity. Examples of ActiveX controls include video players, PDF viewers, and web-based games. Due to security concerns and the advent of newer technologies, the use of ActiveX has significantly declined and is supported by fewer browsers.
- Address busA set of wires in a computer’s motherboard that carries the address of a memory location to be accessed. It is used to enable communication between the CPU and memory modules. Examples include the 16-bit address bus in early PCs and the 64-bit address bus in modern computers.
- AddressingIn the context of computer networks, addressing refers to the assignment of a unique identifier to each device or destination on the network. This identifier, also known as an IP address, allows devices to communicate with each other and route data packets to their intended destination. Examples of addressing include the use of IP addresses in the Internet Protocol (IP) to identify computers on the Internet and the use of MAC addresses in local area networks (LANs) to identify individual network devices.
- Address Resolution Protocol (ARP)a networking protocol that maps a network’s logical IP address to its physical MAC address. It is used to enable communication between devices on a network. Examples include ARP requests, and ARP replies in the process of resolving an IP address to a MAC address.
- Address spaceThe range of addresses that can be assigned to devices on a network. Address space refers to the range of IP addresses that can be assigned to devices on a network, including both IPv4 and IPv6 addresses. This is used in networking to ensure that each device on the network has a unique address and can communicate with other devices. It is used to identify and locate devices on a network.
- Address Space Layout Randomization (ASLR)A security technique that randomly arranges the positions of key data areas of a program—including the base of the executable and position of libraries, heap, and stack—in a process’s address space. By doing so, it makes it harder for an attacker to predict target addresses, thus mitigating the risk of exploitation techniques such as buffer overflow attacks. ASLR is widely used in modern operating systems to enhance their security posture.
- Adequate SecurityThe level of security considered sufficient to protect an information system, data, or network from unacceptable losses or damage. This typically involves a balance between the potential harm caused by a security incident and the cost and effort of implementing security measures. Adequate security is often defined by regulatory requirements, industry standards, or an organization’s risk tolerance and may vary depending on the nature of the assets being protected and the threat landscape.
- Ad Hoc ModeA wireless network mode where devices connect directly to each other without the use of a central access point. It is used in situations where a temporary network is needed, such as a group of friends sharing files at a party. Examples include Wi-Fi Direct, Bluetooth, and peer-to-peer networking.
- Administrative ControlsPolicies and procedures implemented by an organization to manage and regulate user behavior and system operation. These include security policies, operating procedures, rules of behavior, and personnel controls, among others. Administrative controls are a vital part of an organization’s overall security strategy, serving to guide the appropriate use and handling of resources, define roles and responsibilities, and establish processes for monitoring, incident response, and recovery. They complement technical and physical controls to create a multi-layered defense against security threats.
- Admissible evidenceAny evidence that is legally permitted to be used in a court of law. It must be relevant, reliable, and obtained in a manner that follows the rules of evidence. Admissible evidence is typically used in criminal and civil trials to prove the guilt or innocence of a defendant. Examples of admissible evidence include eyewitness testimony, physical evidence, and expert witness testimony. In IT, it must be gathered and preserved following proper digital forensic procedures to maintain its integrity and authenticity. Examples include logs, digital documents, emails, and digital forensics reports.
- Advanced Encryption Standard (AES)A widely used symmetric encryption standard adopted by the U.S. government and numerous organizations worldwide. It operates on blocks of data and uses a secret key that can be 128, 192, or 256 bits in length. With its strong security properties and efficient performance, AES is an integral part of many protocols and systems for securing data in transit and at rest, making it a fundamental element in safeguarding sensitive information against unauthorized access.
- Advanced Persistent Threat (APT)A sophisticated, systematic, and long-term cyberattack campaign that targets specific entities with the intent to steal information or disrupt operations. APTs are typically conducted by nation-states or state-sponsored groups and are characterized by their stealth and persistence. These attackers use a variety of techniques to gain access to a network, maintain a foothold, and exfiltrate data without being detected over extended periods. APTs require a high degree of expertise and resources to conduct and are considered a significant threat to national security, large corporations, and critical infrastructure.
- AdversaryAn individual, group, or entity that seeks to compromise the security of a system, network, or organization for malicious purposes. Adversaries may have various motivations, including financial gain, espionage, disruption of services, or the achievement of political or ideological goals. They can employ a range of tactics, techniques, and procedures, from brute force attacks and phishing to more sophisticated methods like advanced persistent threats.
- AdvisoryA formal communication, often issued by a trusted security organization, vendor, or government entity, that provides information about a specific security issue, such as a newly discovered vulnerability, a novel threat, or a best practice for securing a system or network. Advisories play a crucial role in raising awareness of security risks and helping organizations respond effectively to maintain their security posture.
- Advisory PolicyA type of policy that provides strategic guidance on actions to be taken to achieve certain objectives, often within the context of security best practices. Unlike mandatory policies that dictate specific requirements, advisory policies typically offer recommendations and guidance for improving security. They can cover a wide range of topics, from password complexity and user behavior to disaster recovery strategies and incident response procedures.
- AdwareA type of software that displays or downloads advertising content, often without the user’s consent. While not always malicious, adware can negatively impact user experience by consuming system resources, causing slowdowns, and inundating the user with unwanted ads. Some forms of adware may also track user behavior or collect personal data without appropriate disclosure, posing privacy risks.
- AgentA software program that performs a specific task on behalf of a user or another program. It is commonly used in distributed computing systems, where multiple agents communicate and coordinate to accomplish a larger goal. For example, an agent on a network may monitor traffic and alert a security administrator of any potential threats.
- AggregationThe process of combining multiple data sources or objects into a single, more comprehensive representation. It is used in data analysis and reporting to provide a more comprehensive view of a specific topic or phenomenon. For example, an aggregation of sales data may show overall trends and patterns across different regions or product categories.
- AgileA methodology often used in software development that emphasizes flexibility, collaboration, customer satisfaction, and rapid delivery. Rather than planning the entire project in detail from the start, Agile encourages adaptive planning, evolutionary development, early delivery, and continuous improvement. This approach can significantly benefit security practices by integrating security considerations into the development process from the beginning and enabling rapid response to changing threats.
- AlertA notification generated by a security system in response to a detected event or condition that may indicate a potential security issue. Alerts are designed to draw attention to anomalies, such as attempted unauthorized access, suspicious network traffic, or deviations from normal system behavior. They play a crucial role in incident response by enabling timely detection and remediation of security incidents.
- Alert SituationA state or condition identified by a security system where immediate attention may be required due to the potential for a security issue. An alert situation could be triggered by a variety of events, such as the detection of malware, multiple failed login attempts, or abnormal user activity. These situations typically require evaluation by a security analyst to determine the appropriate response.
- Algebraic attackA type of cryptanalysis that attacks cryptographic algorithms by describing their operations as systems of algebraic equations. Solving these equations can potentially reveal the secret keys used. Algebraic attacks are particularly relevant for certain types of encryption algorithms, and understanding these attacks is important for designing robust cryptographic systems.
- AlgorithmA step-by-step procedure or formula for solving a problem or accomplishing some objective. In computing and mathematics, an algorithm is a finite sequence of well-defined instructions typically used for calculation, data processing, and automated reasoning. Algorithms are the foundation of all computer programs, and they determine the approach a computer takes to perform a specific task, such as sorting data, finding the shortest path in a network, or encrypting information. They can range from simple procedures, like a recipe for baking a cake, to complex operations, such as those used in machine learning and artificial intelligence.
- Alternate facilitiesSecondary operational sites pre-arranged to be used if primary facilities become unusable due to disasters, system failures, or other disruptions. These facilities are part of an organization’s business continuity and disaster recovery planning, ensuring that critical business functions can continue with minimal downtime. Alternate facilities can range from cold sites (no equipment) to hot sites (fully equipped and ready to operate), and mirror the technology and capabilities of the primary sites to various extents based on the organization’s recovery requirements.
- Alternate ProcessA secondary method or procedure that can be used to perform a task or operation when the primary process is unavailable or compromised. In a security context, this could refer to an alternative way of accessing a system, processing data, or communicating information when the usual method is disrupted. An alternate process is often part of a larger contingency or disaster recovery plan, aiming to maintain business operations during and after a security incident.
- Alternative RoutingA method used in telecommunications and network management where traffic is directed over a different path or route than the primary one in case of failure, congestion, or maintenance. Alternative routing aims to ensure that there is no interruption in service by having backup paths available. In sophisticated networks, routing protocols can automatically detect outages or suboptimal performance and switch to alternate routes in real time, maintaining consistent data flow and service availability. This concept is integral to network resilience and business continuity planning.
- AmortizationA financial concept referring to the process of gradually paying off a debt over time through scheduled, typically fixed, payments. Each payment includes a portion that goes toward reducing the principal amount borrowed and a portion that covers the interest on the debt. Amortization can also refer to the spreading out of the cost of an intangible asset over its useful life for accounting and tax purposes. This allows businesses to write off the value of an asset incrementally, reflecting its consumption, depreciation, or obsolescence over time. In IT, for example, the cost of software or development of a technology project may be amortized over the period it is expected to provide value.
- AmplifiersDevices or systems that increase the strength or magnitude of a signal, such as an audio or radio signal. It is used in communication systems to boost the signal and improve its clarity and reach. Examples of amplifiers include audio amplifiers in speakers and microphones and radio frequency amplifiers in wireless transmitters and receivers.
- AnalogIn telecommunications, analog refers to the transmission of voice, video, or data through continuous signals that vary in frequency or amplitude in response to changes in sound or light. Traditional landline telephones, for instance, convert voice sounds into electrical signals that mimic the sound waves. These analog signals can be transmitted over copper wires and are subject to degradation from noise and distance, contrasting with digital signals, which can be more easily cleaned and amplified. While much of modern telecommunications has shifted toward digital technologies for their efficiency and fidelity, analog technology is still in use in various capacities, such as radio broadcasting and certain audio systems.
- Analytical TechniqueA method of solving problems or making decisions by collecting, organizing, and analyzing data. It is commonly used in security to identify trends and patterns in data, such as network traffic or user behavior, to detect potential threats and prevent attacks. Examples include statistical analysis, data mining, and computational modeling.
- Analytic AttackA technique in cybersecurity where a threat actor attempts to decipher encrypted data by exploiting weaknesses in the cryptographic algorithm. Rather than using brute force to try every possible key, the attacker analyzes the encryption structure to find patterns or inherent flaws that can reveal the plaintext or key. This approach is more sophisticated and often faster than attempting exhaustive key searches.
- Android OSThe Android operating system is an open-source platform developed by Google for mobile devices. While security is a component of the OS, Android is known for its wide app ecosystem, user customization, and integration with various Google services. Security features within Android include app sandboxing, Google Play Protect, and periodic security updates.
- Annualized Loss Expectancy (ALE)A calculation used in risk management to estimate the yearly cost of potential losses from an identified risk. It is determined by multiplying the Annual Rate of Occurrence (ARO) of an event by the Single Loss Expectancy (SLE), which is the cost of a single occurrence of that event. ALE helps organizations prioritize risks and make informed decisions about where to invest in security measures. It’s calculated using the formula ALE = ARO x SLE. ARO (Annual Rate of Occurrence) – The estimated frequency at which a specific threat or event is expected to occur within a one-year period. SLE (Single Loss Expectancy) – The estimated monetary loss or impact from a single occurrence of a specific threat or event.
- Annualized Rate of Occurrence (ARO)A measure used in risk assessment that estimates the likelihood of a particular security incident occurring within a given year. It’s a probabilistic estimate, often based on historical data or expert judgment. By considering the ARO alongside the potential impact of an incident, organizations can better understand and manage their risk exposure, helping to prioritize security investments and mitigation strategies. If it is likely to happen 5 times a year the ARO is 5, if it is likely to happen every 5 years the ARO is 0.2.
- AnomalyRefers to any event, behavior, or state that deviates from an established baseline or norm. In the context of security, an anomaly could indicate a potential security incident, such as unusual network traffic, abnormal user behavior, or unexpected changes in system configuration. Anomalies aren’t necessarily malicious or negative, but they can be indicative of security issues such as malware infections, intrusion attempts, or insider threats.
- Anomaly DetectionA technique used in security to identify unusual patterns or behaviors that may indicate a potential threat. This could involve statistical methods, machine learning algorithms, or other techniques to establish a ‘normal’ baseline and then identify deviations from this baseline. Anomaly detection can be used in many areas of security, from network monitoring to fraud detection to user behavior analytics. It’s an essential component of many intrusion detection or protection systems (IDS/IPS) and security information and event management (SIEM) solutions.
- AnonymityThe state of being unidentified or untraceable within a context or a set of data. Anonymity is highly valued in various scenarios, such as whistleblowing, secure browsing, or privacy-preserving communications, as it allows individuals to interact or share information without fear of retribution or unwarranted scrutiny.
- Anonymization of dataThe process of removing or obfuscating personally identifiable information from a dataset in such a way that the individuals whom the data describes remain anonymous. Techniques for data anonymization might include data masking, pseudonymization, and data shuffling. The goal is to protect individual privacy, especially in cases where data is shared or published, while still enabling useful analysis of the data.
- Anonymous AuthenticationA method of access where a system allows users to interact without providing any identifying information. This is often used to protect user privacy and is typical in services where user identification is unnecessary, like public Wi-Fi access points or certain online forums and services.
- Antimalware SolutionsSoftware tools designed to detect, prevent, and remove malicious software, such as viruses, worms, trojans, ransomware, and spyware. These solutions typically include real-time scanning, threat databases, and removal capabilities to protect systems from infection and help maintain security.
- AnycastA networking technique that allows multiple servers to share the same IP address, with the objective of distributing network traffic and improving availability and performance. When a user makes a request to an anycast IP address, the network routes the request to the nearest or best-performing server based on factors like geographic proximity, latency, and server load. This technique is widely used in content delivery networks (CDNs) and domain name system (DNS) services to ensure fast response times and resilience against outages or attacks.
- Anything as a Service (XaaS)A broad term that refers to the growing trend of delivering various services and applications over the Internet rather than through on-premises installations or traditional software licensing. This can include software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS), as well as numerous other specialized offerings. By leveraging cloud-based delivery models, XaaS providers can offer scalable, flexible, and cost-effective solutions that cater to the diverse needs of businesses and end-users.
- API ConflictsSituations that occur when an API does not operate as expected, potentially due to overlapping functionalities, inconsistencies among different API calls, or version mismatches. Resolving API conflicts often requires careful design, testing, and version control to prevent and address these issues.
- API EndpointsThe specific points of interaction or communication between an API and the software components that use it. In the context of a web API, an endpoint typically refers to a specific URL where an API can receive and send data. Each endpoint corresponds to a specific function or data resource, and it can accept certain types of requests (e.g., GET, POST, PUT, DELETE in the case of a RESTful API) to perform operations like retrieving, adding, modifying, or deleting data.
- Appearance of independenceThe perception or appearance that an individual or organization is not influenced or biased by outside forces. It is used in professional settings, such as in auditing, to ensure impartiality and objectivity. Examples include a judge appearing unbiased in a court case, an auditor appearing independent in a financial audit, and a journalist appearing objective in their reporting.
- AppletA small, client-side program that is typically embedded within a web page to provide interactive features that execute in the context of a user’s browser. Historically, Java applets were common, but due to various security concerns and the phasing out of plugin support by modern web browsers, the use of Java applets has declined significantly. Current web applications now favor using HTML5, JavaScript, or WebAssembly to create dynamic and interactive user experiences directly in the browser without the need for additional plugins.
- ApplicationIn the context of computing, an application refers to a software program that enables users to perform specific tasks or activities. Applications can range from large systems such as enterprise resource planning (ERP) software to smaller tools such as word processors or games. They are designed to interact with users and can manipulate data to produce desired outcomes based on the user’s input and the application’s own logic.
- Application Acquisition ReviewA process or a stage in the software procurement process where the suitability and security aspects of a software application are evaluated before its acquisition. The review can include checks for software’s compliance with security standards, its compatibility with existing systems, potential vulnerabilities, and the reputation and reliability of the software vendor. The goal is to ensure the software meets the organization’s requirements and doesn’t introduce unacceptable risks.
- Application ArchitectureThe high-level structure of a software application, encompassing the way its components interact and how they serve the user’s needs. It involves designing the components and their relationships based on business requirements and constraints to ensure the application’s functionality, performance, security, and manageability.
- Application Aware DevicesThese are devices that can identify, analyze, and act on specific applications and their data within a network. They are used in network security and performance management to provide granular visibility and control over applications. Examples include firewalls, load balancers, and intrusion prevention systems.
- Application BenchmarkingThe practice of testing an application under specific conditions to assess its performance characteristics, such as responsiveness, throughput, and resource usage. It allows the identification of bottlenecks or vulnerabilities in the system and provides a standard of performance against which future changes can be evaluated. This process aids in ensuring the reliability, efficiency, and robustness of the application under various scenarios.
- Application ContainerizationA lightweight alternative to full machine virtualization that involves encapsulating an application in a container with its own operating environment. This provides a high level of isolation between individual applications, ensuring that each can run without interfering with others, thereby improving security, portability, and efficiency.
- Application Development ReviewThe process of assessing an application during its development stage to ensure it meets specified requirements and standards. The review can cover various aspects, including design, coding, testing, and security practices. The aim is to detect and rectify any issues or vulnerabilities early in the development lifecycle, enhancing the quality and security of the final product.
- Application HardeningThis is the process of securing an application by reducing its attack surface and minimizing potential vulnerabilities. Techniques include removing unused features, disabling unnecessary services, configuring robust security settings, and regularly updating the software to patch any known security issues. By hardening an application, organizations can better protect their systems and data from unauthorized access or exploitation.
- Application Implementation ReviewAn assessment conducted to ensure that a newly deployed application meets its intended objectives and adheres to organizational policies and security standards. The review may involve examining the application’s configuration, integration with other systems, and overall performance. This evaluation helps identify any issues or vulnerabilities that may have been introduced during deployment so they can be addressed promptly.
- Application LayerIn the Open Systems Interconnection (OSI) model, the application layer is the 7th layer, which interfaces directly with end-user software applications to manage network communications. It is responsible for high-level protocols such as HTTP for web browsing, FTP for file transfers, and SMTP for email. In the simpler TCP/IP model, the application layer is often conceptualized as layer 4, which encompasses the functionalities of the OSI’s application, presentation, and session layers. This topmost layer in the TCP/IP model enables user applications to interact with the network stack, ensuring that data is properly packaged for communication and interpreted upon receipt.
- Application-level encryptionThe process of encrypting data at the application level rather than at the network or transport level. It is used to protect sensitive information and ensure confidentiality, integrity, and availability. Examples include encrypting a password before storing it in a database, encrypting a file before sending it over the Internet, or encrypting credit card information before processing a transaction.
- Application-Level Gateway FirewallA type of firewall that operates at the application layer of a network’s protocol stack. It filters incoming traffic to certain network services like FTP and Telnet servers and can inspect the actual content of the data packets, not just the source, destination, and port. This allows for a more thorough examination of the packet payload to detect malicious code or protocols, offering a higher level of security compared to other types of firewalls.
- Application or Managed Service Provider (ASP/MSP)These are companies that deliver software services, network management, system maintenance, or other computing services to customers over the Internet. This model allows businesses to access and use sophisticated technology without the need for substantial infrastructure investment or in-house expertise. It’s crucial for ASPs/MSPs to maintain robust security measures to protect customer data and ensure the integrity of the services they provide.
- Application Programming Interface (API)A set of protocols and tools for building software and applications. An API specifies how software components should interact, serving as an intermediary that allows different programs to communicate with each other. They are often thought of as a translator who sits in between different applications and does not speak the same language.
- Application proxyA type of software that acts as an intermediary between a client and a server in order to provide security, performance, and functionality to the client. It is commonly used in network security to protect against cyber threats and to improve network performance. Examples of application proxies include web proxy, FTP proxy, and SOCKS proxy.
- Application securityThe practice of protecting applications from threats and vulnerabilities in order to ensure the confidentiality, integrity, and availability of the information they process and store. It is a crucial aspect of cyber security and involves various measures such as access control, encryption, and vulnerability management. Examples of application security measures include firewalls, intrusion detection systems, and password policies.
- Application Software Tracing and MappingA process of analyzing and visualizing the behavior and structure of software applications. It helps in understanding the flow and interdependencies within an application, aiding in the detection of vulnerabilities, bottlenecks, or inefficiencies. Given the complexity of modern applications, tracing and mapping can be essential tools for maintaining application performance and security.
- Application SystemThis consists of a group of applications working together to deliver a certain function or service, often involving multiple user interfaces, databases, and processes. These systems can be complex and interconnected, making their security crucial. Ensuring the integrity, confidentiality, and availability of data in these systems is a fundamental part of maintaining secure operations.
- Approved APIsThese are Application Programming Interfaces that have been vetted and approved for use within a certain environment. They are recognized as meeting certain criteria for security, reliability, and performance. Using approved APIs is important to maintain the security of applications and systems, as unauthorized or malicious APIs can introduce vulnerabilities or cause data breaches.
- Arbitrary Code ExecutionA security vulnerability that allows an attacker to run unauthorized code on a system or network. It can lead to a full system compromise and is a critical threat to cybersecurity. Examples include exploitation through software vulnerabilities such as buffer overflows or injection flaws.
- ArbitrationIn the context of data transmission, arbitration is the process used to determine which device has control over the communication line at any given time. In a network where multiple devices may need to transmit data simultaneously, an arbitration mechanism ensures that only one device transmits at a time to avoid data collisions. This process is particularly crucial in bus networks or other shared-medium networks where the possibility of data collision is high.
- ArchitectureThe overall design and structure of a system, including the components, relationships, and interfaces between them. In the context of information security, architecture refers to the design of an organization’s security infrastructure and the ways in which it protects against various threats and vulnerabilities. Examples of security architecture include network architecture, application architecture, and data architecture.
- Archive BitA flag or attribute associated with a file or directory that indicates whether it has been modified since the last time it was backed up. The archive bit is commonly used in backup software to identify which files need to be copied or transferred to a storage device.
- Area Border Router (ABR)A router that connects different OSPF (Open Shortest Path First) areas within a network. It is used to connect different OSPF areas and allow for communication between them. Examples include routers in a large enterprise network or a service provider network.
- Arithmetic Logic Unit (ALU)A fundamental building block of a central processing unit (CPU) in a computer system. It performs arithmetic and logical operations on the data stored in the system’s registers or memory. Its functions include addition, subtraction, multiplication, and division, along with bitwise operations and comparisons.
- Armored VirusA type of malicious software designed to make analysis, detection, and removal exceptionally difficult. The term “armored” comes from the virus’s protective mechanisms that resist attempts to study or eliminate it. These mechanisms might involve complex and misleading code, encryption, or self-modifying behavior.
- ARP spoofing/poisoningA cyber-attack where a malicious actor sends fake ARP (Address Resolution Protocol) messages to a network, tricking other devices into sending data to the wrong MAC (Media Access Control) address. It is used to intercept and modify network traffic, steal sensitive information, or launch further attacks. Examples include redirecting traffic to a fake website, intercepting login credentials, or injecting malware into downloads.
- ARP TableThe ARP Table, or Address Resolution Protocol Table, is a table stored in each device on a network, which maps IP addresses to MAC addresses. This table is essential for local network communication because while IP addresses are used for routing data over the network, MAC addresses are used for direct device-to-device communication within the network.
- Artificial IntelligenceA field of computer science focused on creating systems or machines that display human-like intelligence and cognitive functions such as learning, reasoning, problem-solving, perception, and language understanding. AI technologies include machine learning, natural language processing, robotics, and computer vision. In the context of IT and Cybersecurity, AI can be used to automate complex tasks, enhance decision-making, and improve security systems by identifying and responding to threats more efficiently than traditional methods. AI-powered cybersecurity solutions can adapt and evolve to detect new types of attacks, making them a critical component in modern security infrastructures.
- ASCIIASCII, or the American Standard Code for Information Interchange, is a character encoding standard used to represent text in computers and other devices that use text. Each letter, digit, or symbol is assigned a unique 7-bit binary number. ASCII is foundational for many protocols and data manipulation processes, and understanding its role can be crucial in tasks such as data forensics and network traffic analysis.
- ASP (Application Service Provider)A service provider that hosts and delivers software applications over the internet, enabling clients to use software without having to install or manage it on local systems. ASPs support various business applications, offering an alternative to on-premise solutions, which can help reduce IT overhead and facilitate remote access to software functionality.
- AssemblerA type of computer program that interprets software programs written in assembly language into machine language, code, and instructions that can be executed by a computer. The assembler enables the translation of human-readable assembly language into the computer’s binary code. It is often used when direct hardware manipulation, maximum efficiency, or compact code size is required.
- Assembly LanguageA low-level programming language for a computer or other programmable device in which there is a very strong correspondence between the language and the architecture’s machine code instructions. Each assembly language is specific to a particular computer architecture, in contrast to high-level programming languages, which are generally portable across multiple systems. Assembly language is used in reverse engineering and malware analysis, as it provides more direct control of system processes.
- AssessmentThis refers to the evaluation of systems, applications, and networks to identify vulnerabilities, weaknesses, and potential improvements. This process typically involves examining an organization’s people, processes, and technologies. Assessments are critical for identifying security gaps and formulating remediation plans to mitigate the risk of threats and exploits.
- AssetAn asset, in the context of security, is any data, device, or other component of the environment that supports information-related activities. Assets generally hold value for an organization and can be tangible, such as a server or a workstation, or intangible, such as proprietary data or intellectual property. The protection of these assets is the primary focus of security strategies.
- Asset-based risk perspectiveThis involves assessing security risks based on the potential threats to specific assets within an organization. This approach identifies the vulnerabilities and threats specific to each asset and estimates the potential impact if a security incident were to occur. The focus is on protecting the most valuable or sensitive assets to minimize the overall risk to the organization.
- Asset InventoryA comprehensive list or record of an organization’s assets. It includes all types of assets, like hardware, software, data, and other resources, detailing their configuration, location, and ownership. Regularly updating and maintaining the asset inventory is key for effective vulnerability management, incident response, and overall risk management.
- Asset SecurityThe practice of safeguarding an organization’s assets, which encompasses both physical and digital forms, to prevent unauthorized access, theft, and damage. This involves implementing security controls like access management, encryption, physical security measures, and regular security audits to ensure the confidentiality, integrity, and availability of assets.
- Asset valuationThe process of determining the financial or operational value of an organization’s assets. This can include hardware, software, data, or any other resource that supports business functions. The valuation helps in prioritizing resources for security investments, aligning them with the potential loss that could be incurred if the asset were compromised.
- AssuranceThe degree of confidence one has in the security measures implemented to protect an organization’s systems and data. It involves various practices, including regular audits, testing, and reviews, to verify that the implemented security controls are effective and that they meet the organization’s security objectives.
- Assurance EngagementAn examination conducted by an independent party to evaluate the effectiveness of security controls within an organization. The engagement typically includes a thorough review of systems and processes to provide stakeholders with a level of confidence in the security posture of the entity.
- Asymmetric CipherAn encryption algorithm where two separate keys are used, one for encryption (the public key) and another for decryption (the private key). It’s distinct from symmetric ciphers, which use the same key for both encryption and decryption. Asymmetric ciphers, such as RSA, are fundamental for secure data exchange over the Internet.
- Asymmetric Encryption or Asymmetric CryptographyAsymmetric encryption, also known as public-key cryptography, is a form of encryption where keys come in pairs. What one key encrypts, only the other can decrypt. This method enables secure, encrypted communication between parties who have not previously exchanged encryption keys, thus providing a solution to what is known as the key distribution problem. It’s widely used in many types of data exchange and digital signatures.
- Asymmetric keyA pair of keys used in asymmetric encryption. This pair consists of a public key, which may be freely distributed and used for encryption, and a private key, kept secret and used for decryption. The uniqueness of this approach is that data encrypted with one key can only be decrypted by its counterpart, providing a powerful tool for secure communications.
- Asymmetric MultiprocessingA type of multiprocessing system where each processor is assigned specific tasks or applications, leading to an unequal distribution of the computational workload. This contrast with symmetric multiprocessing systems, where each processor performs any task in the workload, often requires a thoughtful approach to security due to the distinct roles of each processor.
- AsynchronousRefers to processes that do not occur at the same time or do not require immediate response, allowing operations to execute independently without waiting for preceding tasks to complete. In computing, asynchronous communication is where data can be transmitted intermittently rather than in a steady stream, with the sender and receiver operating at their own pace and not simultaneously.
- Asynchronous communicationA mode of communication where the parties involved do not need to interact with each other in real-time. Messages can be sent and received at different times, allowing for greater flexibility and convenience. This model is often used in email, discussion forums, and other platforms where instant response is not necessary.
- Asynchronous Token GenerationA method used in security systems to generate a token, such as a one-time password (OTP), without requiring real-time communication between the token generator and the authentication server. This allows the token to be used as an effective form of multifactor authentication, even in scenarios where immediate connectivity is unavailable.
- Asynchronous Transfer Mode (ATM)A networking technology that splits traffic data into small fixed-sized cells, contrary to other networking technologies, which use variable-size packets. ATM provides data link layer services that run over a wide range of networks. Its small, fixed-size cells are well suited for carrying voice and video traffic, as well as data, making it advantageous for multimedia transmission.
- AttackAny action that intends to exploit vulnerabilities or disrupt the normal functioning of systems, networks, or applications. This could be initiated by individuals, groups, or even automated scripts with the aim of compromising system integrity, confidentiality, or availability, often leading to unauthorized access, data theft, or service disruption.
- Attack SurfaceThe total area of potential vulnerabilities in a computer system or network. It is used in cybersecurity to assess the potential risks and vulnerabilities in a system or network. Examples include the open ports and services on a server, the number of users with access to a system, and the type of software installed on a system.
- Attack vectorA path or method used by an attacker to gain access to a computer system or network. It is used in cybersecurity to describe the specific methods and techniques used by attackers to breach the security of a system or network. Examples include exploiting a software vulnerability, using social engineering tactics to trick a user, or using a brute force attack to guess a password.
- AttenuationThe reduction in signal strength as it travels through a medium. In the context of networks, this refers to the reduction in signal strength that occurs as a signal is transmitted over distances, through cables, or via wireless. High attenuation can degrade the quality of data transmission and potentially expose the data to interception if not properly managed and mitigated.
- Attestation EngagementA type of assurance engagement in which an independent auditor examines and reports on controls within an organization, usually according to a recognized framework. The result is an attestation report that can be used to demonstrate compliance to stakeholders.
- AttributeA characteristic or quality of an object or entity. It is used in data modeling to describe the properties or characteristics of a data element. Examples include the name, address, and phone number of a customer or the product name, price, and quantity of an order.
- Attribute-Based Access Control (ABAC)A model that controls access to resources based on the evaluation of attributes associated with the user, the resource to be accessed, and current environmental conditions. This sophisticated method allows for flexible, fine-grained access control, catering to a wide range of potential scenarios. ABAC is particularly useful in complex environments where role-based access control (RBAC) may be too rigid or insufficient.
- Attribute samplingA statistical approach where a subset of data is selected from a larger population based on specific characteristics or “attributes.” The analysis of this sample can then be used to make inferences about the overall population. This method is often employed in various security contexts, such as network monitoring or transaction reviews, to identify anomalous behavior or potential threats without having to analyze every single data point.
- AuditA systematic, independent, and documented process for obtaining and evaluating objectively verifiable evidence to determine the extent to which agreed-upon criteria are met. In a security context, this might involve assessing the effectiveness of controls, compliance with security policies and regulations, or the accuracy of system logging. Audits are essential for identifying vulnerabilities, ensuring accountability, and enhancing overall security posture.
- Audit AccountabilityThe principle that ensures individuals or entities tasked with conducting audits are held responsible for their findings and actions. It requires that all audit activities, results, and decisions be properly documented, enabling transparency and traceability of the auditing process.
- Audit AuthorityThe power or right granted to an individual or organization to conduct an audit. This authority is typically granted by a governing body or regulatory agency and may include the ability to access records, interview individuals, and make recommendations for improvement. Examples of organizations with audit authority include the Internal Revenue Service and the Securities and Exchange Commission.
- Audit CharterA formal document that outlines the purpose, authority, and responsibility of an audit activity. It provides a clear framework for the audit, including the scope of work to be performed, the standards to be adhered to, and the reporting process. An audit charter is essential for setting expectations, ensuring transparency, and fostering a cooperative relationship between the auditors and those being audited.
- Audit evidenceThe information collected during an audit process to support the auditor’s conclusions. This could involve documentation, data analysis, physical checks, interviews, and other information sources. The evidence should be sufficient and appropriate in quality, and it aids in identifying anomalies, validating compliance, and assessing the effectiveness of controls in place.
- Audit Expert SystemsComputer-based systems that utilize specialized knowledge and databases to assist auditors in the decision-making process during an audit. These systems enable the processing and analysis of complex data sets to enhance the quality and efficiency of audits.
- AuditingThe systematic and independent examination of data, statements, records, operations, and performances (financial or otherwise) of an organization for a stated purpose. In the context of systems and networks, it involves the reviewing and checking of system logs, configurations, and data to ensure system integrity, performance, and reliability and to detect any signs of unauthorized access or potential security risks.
- Audit ObjectiveA clear, concise statement of what the audit is intended to achieve. It might involve assessing compliance with specific regulations, determining the effectiveness of certain controls, or evaluating the accuracy of financial reporting. The audit objective provides a guide for planning the audit, conducting the audit work, and assessing the results.
- Auditor’s opinionThe result of an audit procedure and communicates the auditor’s level of assurance in the subject matter being audited. The opinion generally takes the form of a written statement included in the audit report, and it can be “unqualified” or “qualified” depending on whether the auditor believes the information being reviewed is fairly presented, free of material misstatements, and in compliance with applicable standards or laws.
- Audit planA comprehensive strategy outlining the specific steps, methods, and resources to be used in an audit. It includes a schedule, a defined scope, the objectives, and procedures to achieve those objectives. This plan serves as a roadmap, guiding auditors in their tasks and ensuring a structured, systematic approach to the audit process.
- Audit programA set of procedures and steps designed to achieve the audit objectives. It is a detailed plan of action specifying the techniques to be used, the areas to be reviewed, and the chronological order of tasks. The program may be tailored to the unique needs of each audit, taking into consideration the nature, complexity, and size of the entity being audited.
- Audit responsibilityThe accountability of the auditor in conducting an audit. It encompasses the duty to perform the audit with due professional care, maintain objectivity and independence, ensure accuracy in reporting, and comply with relevant standards and regulations. The auditor is also responsible for communicating the audit results in a clear, timely, and truthful manner.
- Audit RiskThe risk that an auditor may issue an incorrect opinion on financial statements due to not detecting material misstatements or errors. It consists of inherent risk, control risk, and detection risk, and effectively managing audit risk is crucial for the credibility of the audit report.
- Audit samplingThe process of selecting a subset of data or transactions for review during an audit. It is used to reduce the amount of information that needs to be examined in order to provide a reasonable assurance of the accuracy and reliability of the data. For example, an auditor may select a random sample of transactions from a company’s sales records to test for accuracy and completeness.
- Audit Subject Matter RiskThe risk related to the specific area or aspect being audited, which may affect the auditor’s ability to obtain accurate and complete information. Factors like the complexity of the subject matter, susceptibility to misstatement or fraud, and changes in the operational environment can influence the level of this risk.
- Audit trailsThe documentation of the steps taken during an audit, including the evidence gathered and the conclusions reached. It is used to provide a record of the audit process and to support the auditor’s findings and recommendations. For example, an audit trail may include a list of the documents reviewed, the questions asked, and the observations made during the audit.
- Audit universeThis encompasses all the potential areas, functions, processes, or units within an organization that could be subjected to audit. It is a comprehensive list of auditable entities and can include systems, departments, business units, or physical locations, among others. The audit universe serves as the basis for developing the audit plan and deciding where to allocate audit resources.
- AuthenticateThis refers to the process of verifying the identity of a user, device, or transaction. It is used to confirm that the user or device has the right to access the information or perform the action being requested. For example, a user may be asked to enter a password or provide a biometric identifier to authenticate their identity before accessing a secure website or system.
- Authentication Header (AH)A protocol used in internet security to authenticate the sender of a message and to protect the message from tampering or interception. It is used in conjunction with Internet Protocol Security (IPSec) to provide end-to-end security for Internet communications. For example, AH may be used to authenticate the sender of an email and to encrypt the contents of the message to protect against unauthorized access.
- Authentication Server (AS) (in Kerberos)In the Kerberos network authentication protocol, the Authentication Server is a key component that provides the initial verification of a principal’s (user or service) credentials. When a principal attempts to authenticate, it communicates with the AS, which checks the provided information against a database of users. If the credentials are valid, the AS issues a Ticket Granting Ticket (TGT) encapsulated within a message that can only be decrypted by the principal’s secret key. The TGT is then used to request access to other network services without resending the principal’s credentials, improving security and efficiency. The AS’s role is crucial in establishing a trusted basis for further secure communications within the Kerberos-protected network environment.
- Authentication systemA process or methodology implemented to verify the legitimacy of a user, system, or device seeking access to a secured environment. Such systems commonly involve credentials like usernames and passwords but can also use more advanced methods, such as biometric identification, smart cards, or digital certificates, in order to uphold the integrity of the secured area or data.
- AuthenticatorA piece of data used to verify the claim of an identity. This could be a password, token, biometric feature, or other element associated with a specific user. In a broader sense, an authenticator can also refer to a device or software that generates or manages such authentication data, for instance, a hardware token that generates one-time passwords.
- AuthenticityThe assurance that a message, transaction, or data origin is indeed from the source it claims to be. Ensuring authenticity is crucial in preventing activities such as phishing, identity theft, and forgery. Techniques used to maintain authenticity include digital signatures and certificates, encryption, and watermarking.
- AuthenticodeA digital signature technology used to verify the authenticity and integrity of software. It uses a certificate issued by a trusted third-party to ensure that the software has not been tampered with and comes from a legitimate source. For example, when downloading a software update, Authenticode may be used to verify that the update is safe and comes from the official software developer.
- AuthorizationThe process of determining what permissions an authenticated user has access to. It’s the step that follows authentication – once the system confirms the user’s identity, it then determines what resources, data, or areas the user can access or manipulate based on predefined policies or rules.
- Authorized vendorA vendor that has been approved by an organization to provide goods or services. This approval is typically based on factors such as the vendor’s reputation, security practices, and pricing. For example, a company may have a list of authorized vendors for office supplies, IT services, or marketing services. Only vendors on this list are allowed to provide services to the company.
- Automated patch managementThe process where software updates are identified, acquired, and applied to systems automatically, without the need for human intervention. This procedure is critical in maintaining system security as it ensures that vulnerabilities are quickly addressed, reducing the window of opportunity for malicious actors to exploit known weaknesses.
- Autonomous system (AS)A collection of connected internet routing protocols and devices that are managed and controlled by a single administrative entity. It is used to route traffic within a network and to other networks and to provide network services such as hosting and content delivery. Each AS is identified by a unique Autonomous System Number (ASN) used for routing decisions.
- Autonomous System Number (ASN)A unique identifier assigned to each Autonomous System (AS) for use in internet routing. This number is used to organize and coordinate the global internet infrastructure, allowing for the establishment of unique routing policies and ensuring that data is efficiently and accurately directed across the web.
- AvailabilityThe accessibility of a system, function, or piece of data when needed. In the context of secure systems, it is one of the three key elements of the CIA triad (Confidentiality, Integrity, Availability) and represents the commitment to ensure that authorized users have continuous and reliable access to resources and data while simultaneously preventing unauthorized access.
- Avalanche EffectIn cryptography, it refers to a desirable property of cryptographic algorithms, where a small change in input leads to a significant and unpredictable change in the output. This effect is essential for the security of encryption schemes; it ensures that the ciphertext is radically different, even with minor alterations to the plaintext, which makes cryptanalysis more difficult.
- ava Network Launch Protocol (JNLP)A protocol that is used to launch Java applets and applications from a web page. It allows the applet or application to be downloaded and run on the user’s computer, while also providing security measures to protect the user’s system from malicious code.
- AwarenessThe understanding and recognition of potential security threats, vulnerabilities, and risks. This can involve training and education programs to help individuals and organizations understand how to identify and protect against these threats. For example, a security awareness program may include training on how to spot phishing emails, the importance of strong passwords, and the proper disposal of confidential documents.
- BackboneThe primary network infrastructure within a system that carries data across different nodes. Typically, it comprises high-speed connectivity paths that enable efficient routing and data transfer across large geographical areas. In complex network architectures, the backbone forms the critical “spinal cord” connecting various subnetworks, supporting smooth and reliable operations.
- BackdoorA method, often covert, that bypasses normal authentication or encryption in a system, allowing unauthorized access or control. Typically associated with malicious intent, these can be inserted intentionally for maintenance or troubleshooting but may also be exploited by adversaries to gain unpermitted access, which can lead to information theft, system damage, or other adverse impacts.
- Background CheckThe process of verifying an individual’s personal and professional history. In cybersecurity, this is a crucial step in vetting personnel who will have access to sensitive data, systems, or facilities. It typically involves reviewing criminal records, employment history, and other relevant information to assess potential security risks.
- Backout Contingency PlanA strategic plan outlining steps to revert changes made during system updates or modifications should these changes result in unforeseen issues or failures. This could include procedures to restore data from backups, reinstating prior configurations, or rolling back software updates. It plays a critical role in maintaining system stability and minimizing downtime, especially in high-risk environments where system reliability is paramount.
- Backup Contingency PlanA comprehensive strategy aimed at maintaining data availability and system functionality in the event of data loss, system failures, or disasters. This plan details the mechanisms, processes, and resources for creating, managing, and restoring from data backups. It is a fundamental component of a robust digital environment, ensuring business continuity and minimizing the negative impact of potential disruptions.
- Backup or Backing UpThe process of creating copies of data that can be used to restore the original information in the event of data loss, corruption, or system failures. This is a critical process in safeguarding data and ensuring business continuity, enabling the restoration of data from a previous point in time and reducing potential damage or disruptions caused by unforeseen events.
- Backup Storage StrategiesThe methodology and planning involved in determining how and where backup data is stored. This might encompass decisions about the type of storage (local, off-site, or cloud), the format of the backup (full, incremental, or differential), and the frequency of backup creation. An effective strategy balances data protection needs, cost, and business continuity objectives to ensure a reliable and efficient recovery process.
- Backup verification dataData that is used to verify the integrity and accuracy of a backup copy. It is used in cybersecurity to ensure that a backup copy can be used to restore an organization’s data in case of a disaster or data loss. Examples include checksum values for each file in a backup, timestamps for each file in a backup, and metadata for each file in a backup.
- BadgeA physical or digital identifier that is used to verify the identity of an individual or the authorization of a device. It is commonly used in the context of access control to ensure that only authorized individuals or devices can enter a secured area or access sensitive information. Examples of badges include a security card, a key fob, or a digital certificate.
- Balanced Magnetic Switch (BMS)A security device used to monitor the opening and closing of doors and windows. It consists of a magnet and a sensor that form a circuit, which, when disturbed (for example, by a door opening), triggers an alert. BMS systems are commonly integrated into broader security systems to detect unauthorized entries.
- Balanced Scorecard (BSC)A strategic planning and management system used to align business activities with the vision and strategy of the organization. Within the realm of risk management, it can help organizations monitor performance against strategic goals, considering perspectives like financial performance, customer knowledge, internal business processes, and learning and growth. This tool is particularly effective in maintaining a comprehensive view of system health, offering valuable insights that can be used for proactive security management and threat mitigation.
- BandwidthThe maximum rate of data transfer across a given path or network connection, typically measured in bits per second (bps). The term is used to denote the capacity of a connection to handle data traffic, affecting the speed and quality of data transfer. High bandwidth is particularly important for the transmission of large volumes of data or for applications with real-time communication needs, such as video conferencing or online gaming.
- BannerA message displayed on a computer screen or network device that identifies the system and provides information about the system’s capabilities and limitations. It is commonly used to provide a warning or disclaimer to users before they access a system or network. Examples include the login banner on a server or the banner displayed by a firewall before allowing access to a network.
- Banner GrabbingA technique used to gather information about computer systems on a network by sending requests and analyzing the responses (the banners) that contain details about the services running on the system. It is often an initial step in network reconnaissance for both legitimate purposes, such as network inventory, and malicious intents, like vulnerability assessment for exploitation.
- Bar codeA series of parallel lines or bars of varying widths that represent data in a machine-readable format. It is commonly used to identify and track products, documents, or other objects in a variety of industries, including retail, healthcare, and logistics. Examples include the barcodes found on retail products, patient identification wristbands in hospitals, and shipping labels for packages.
- BasebandThe original frequency range of a signal before it is modulated for transmission. In data communication, baseband transmission allows digital signals to be sent directly over the medium without modulation into higher frequency ranges. This type of transmission is common in wired local area networks, where the entire bandwidth of the cable is used for a single signal or multiple signals in a time-division multiplexing manner.
- Base CaseThe simplest instance or the starting point in a series of scenarios, typically used as a benchmark in the context of scenario analysis or problem-solving. For instance, in testing a new security feature, the base case could represent the system’s behavior without the new feature being implemented. By examining the base case, one can understand how deviations from this base scenario (like introducing new features or changes) affect the system’s performance or security.
- BaselineA reference point or standard against which the performance or status of a system or process can be measured. It is commonly used in project management, quality control, and performance monitoring to establish a baseline for comparison and to identify deviations or improvements. Examples of baselines in IT include the baseline configuration of a server or network device, the baseline performance of a system or application, and the baseline security posture of an organization.
- Baseline ArchitectureThe current state of an architectural framework within an organization, including the interplay of technology, processes, and people. It provides a comprehensive view of how different components of a system interact, from hardware to applications to data flows. This architecture serves as the reference point for planning future changes, identifying gaps, or analyzing potential impacts of modifications. Its understanding is crucial in maintaining system stability and security, ensuring changes don’t introduce new vulnerabilities or disrupt existing safeguards.
- Baseline ReportingThe process of documenting the standard state or performance level of a system, typically done for comparative analysis over time. In a security context, this can be valuable for identifying abnormalities or potential threats, as significant deviations from the established baseline may indicate an issue. Such reports could include information on normal network traffic patterns, typical user behavior, and system performance metrics, among others.
- Base RegistersIn computer architecture, Base Registers are special-purpose registers that hold the starting address of a memory segment. They play a critical role in memory management and protection, ensuring that memory accesses are within the permitted address space, thereby preventing unauthorized access or modification of data. Incorrect configuration of base registers can lead to security vulnerabilities, potentially allowing for privilege escalation, buffer overflows, or other forms of exploitation.
- Basic AuthenticationAn authentication scheme that transmits a user’s username and password across the network in an unencrypted format, often encoded with Base64. Due to its lack of security features, like encryption or tokenization, it’s considered insecure for transmitting credentials over untrusted networks unless accompanied by a secure transport layer, such as HTTPS.
- Bastion HostA server strategically placed in a network’s DMZ (demilitarized zone) to defend against external threats. The bastion host serves as a strongly secured entry point into the network and typically hosts a single application like a proxy server or VPN gateway.
- Batch ControlA method of managing and coordinating tasks that are processed as a group, or “batch”, rather than individually. This approach is common in environments where large amounts of data are processed and strict control is needed over the execution of tasks. In a security context, batch control mechanisms ensure the integrity and confidentiality of data by enforcing appropriate access controls, audit trails, and error checking across the entire batch of tasks.
- Batch ProcessingThe execution of a series of jobs on a computer without manual intervention. In cybersecurity, batch processing must be handled securely, ensuring that sensitive data processed in batches maintains confidentiality and integrity and that access to batch processes is appropriately restricted and logged.
- Baud rateA measure of the speed of data transmission over a communication channel, defined as the number of signal units per second. It is often used interchangeably with bits per second (bps), but technically, baud rate refers to the number of times the condition of the line changes. For digital systems, this usually equates to the number of bits transmitted per second, influencing the speed and efficiency of data transmission.
- Behavior AnalyticsThe study of patterns and anomalies in data related to user or system behavior to detect potential threats. By establishing a baseline of ‘normal’ activity, this approach can highlight unusual or suspicious actions that deviate from the baseline, indicating a possible security issue. It is widely used for detecting sophisticated attacks that may not trigger traditional security alerts, aiding in timely response to potential threats.
- Behavior BlockingA proactive security technique that monitors and controls the activities of applications to prevent malicious or abnormal actions. Rather than relying on known malware signatures, this method focuses on the actions an application attempts to perform. If these actions match predefined or dynamically learned malicious behavior patterns, the action is blocked, providing a layer of protection against both known and unknown threats.
- Bell-LaPadula ModelA formal model designed for the enforcement of access control in government and military applications. It focuses primarily on maintaining the confidentiality of information and preventing unauthorized users from accessing classified data. The model is known for two significant rules – the “no read up, no write down” (also called the “simple security property” and “*-property”), which restricts the flow of information to protect against data leakage and unauthorized access.
- BenchmarkA standard or reference point used to evaluate the performance of a system, process, or product. It is commonly used in testing and optimization to compare and improve the efficiency and effectiveness of different solutions. Examples include performance metrics, test cases, and reference data.
- BenchmarkingThe process of comparing the performance of a system, process, or product against a benchmark to evaluate its quality and identify areas for improvement. It is commonly used in industries such as manufacturing, finance, and technology to assess and optimize performance. Examples include process audits, customer surveys, and competitive analysis.
- BenefitA positive outcome or advantage that results from an action, decision, or investment. It is commonly used in business and policy analysis to evaluate the value and impact of different options. Examples include cost savings, increased productivity, and improved customer satisfaction.
- Benefits RealizationThe process of identifying, planning, and managing the benefits of a project or program to ensure that they contribute to the organization’s overall goals and strategic objectives. It focuses on achieving the expected enhancements in performance, service, and outcomes as a result of the project’s deliverables.
- BenignIn IT and cybersecurity, benign refers to software or activities that are not harmful to systems or data. While the term can apply to innocuous programs or files, it is also used to describe false positives in security alerts, where benign events are mistakenly flagged as threats.
- Benign environmentA safe, secure, and controlled environment that is free from threats or risks. It is commonly used in testing, research, and development to create a controlled environment for experiments, evaluations, or simulations. Examples include a laboratory, a sandbox, and a virtual machine.
- Best PracticeA procedure or set of procedures that is recognized as effective and efficient, typically representing the standard that should be aimed for in a particular area. In a security context, best practices could cover a wide range of areas, from password policies and access controls to incident response planning and system hardening. Adopting these practices can help organizations improve their security posture and mitigate potential risks.
- Biba ModelA formal security model focused on maintaining data integrity within computer security systems. It employs a lattice-based access control to enforce integrity levels. The model prevents information from lower integrity levels from contaminating higher ones. No Read Up (No Read-Up) – Subjects can’t read data at a higher integrity level (write-up is allowed). No, Write Down (No Write-Down) – Subjects can’t write data to a lower integrity level (read-down is allowed).
- Big DataLarge and complex data sets that traditional data processing applications cannot handle effectively. Big Data often involves the three Vs. Volume (large amounts of data), Velocity (quickly generated or processed), and Variety (different types of data). It’s used for advanced analytics and other data-driven applications.
- BinaryThis pertains to a base-2 number system, which uses only two digits, 0 and 1, to represent all its values. This system is used extensively in digital computers and digital logic because it’s straightforward to implement with digital electronic circuitry. As every piece of data or instruction in a computer is represented in binary, understanding and protecting binary data is critical to overall system security.
- Binary codeA system of representing numbers, letters, and other symbols using only two digits, 0 and 1. This concept is used in computer science to encode and transmit data, as well as to write instructions for computer programs. For example, a binary code for the letter “A” might be 01000001.
- BindingIn computing, this refers to the creation of a linkage between a software object and a data element, a variable and its value, or a user action and a program response. In the realm of cybersecurity, binding often relates to the secure association of credentials with users or devices to ensure secure authentication processes.
- Biometric LocksAdvanced security devices that use unique biological traits, such as fingerprints, eye patterns, or facial recognition, to authenticate and grant access to individuals. Biometric locks enhance security by providing a non-transferable and difficult-to-replicate method for verifying identity.
- BiometricsThe science and technology of using biological characteristics, such as fingerprints or facial features, to identify individuals and verify their identity. This concept is used in various fields, including security, healthcare, and finance, to improve accuracy and reduce the risk of identity fraud.
- BIOS (Basic Input/Output System)A low-level software that controls the hardware of a computer and enables it to boot up and perform basic functions. This concept is used in computers to provide a user-friendly interface for accessing and configuring hardware settings, as well as to boot up the operating system. For example, a BIOS might allow a user to change the boot order of devices, or to enable or disable specific hardware components.
- Birthday AttackA type of cryptographic attack that exploits the mathematics behind the birthday problem in probability theory. It takes advantage of the fact that in a set of randomly chosen people, there’s a high probability that two of them will share the same birthday. Similarly, in cryptography, the attack uses this principle to find collisions in hash functions, which occur when two different inputs produce the same hash output. This can compromise cryptographic systems that rely on the uniqueness of hash values. The attacker generates multiple variants of input data and computes their hash values until a collision is found. This is significantly faster than a brute force search for two inputs with the same hash value due to the birthday paradox’s counterintuitive probability curves. It’s particularly a concern for digital signatures and data integrity checks that rely on hashing algorithms.
- Bit error ratethe number of incorrect bits transmitted in a message, typically measured as a percentage. It is used in communication systems to measure the reliability of a transmission. For example, a bit error rate of 10^-6 means that out of every 1,000,000 bits transmitted, there will be, on average, one error.
- Bit SplittingA method used in data security and encryption where a single bit of data is divided into two or more separate bits. The split bits are then typically distributed across different storage locations or transmission paths. The purpose of bit splitting is to enhance security, since the original bit is not stored or transmitted whole, it becomes more difficult for unauthorized parties to intercept and piece together the complete data.
- Black Box TestingA method of evaluating system functionality without any knowledge of its internal workings or structure. This approach views the system as a “black box,” focusing solely on input and output without concerning itself with internal behavior. It can be applied in various scenarios, including functional testing, integration testing, and system testing. In a security context, it is used in penetration testing to identify vulnerabilities or potential entry points for attacks, mimicking the approach of a potential external attacker.
- Blind FTPA form of FTP where the server allows file transfers without requiring the user to log in with credentials. Typically, such servers are configured to permit anonymous access, often used for distributing files that are meant to be publicly available.
- Blind Test in Penetration TestingThe pentest method in which security professionals simulate an actual attack on a system, with limited information provided about the target beforehand. This approach is designed to mimic the real-world tactics and techniques of potential attackers, who typically have no inside information. It allows organizations to get a realistic understanding of their security vulnerabilities and how well their detection and response mechanisms perform under such conditions.
- BlockchainA distributed database that maintains a continuously growing list of records (blocks) secured by cryptography. It is used in digital currencies and distributed systems to provide a secure and transparent way of storing and verifying data. For example, a blockchain network can be used to record and verify transactions in a decentralized manner without the need for a central authority.
- Block CipherA method of encrypting text where it is divided into blocks, each of which is then encrypted. The encryption of each block happens independently using a symmetric key, meaning the same key is used for both encryption and decryption. The size of the block and the key determines the type of block cipher, such as AES (Advanced Encryption Standard), which is widely used and considered highly secure. The utility of block ciphers in securing data in transit or at rest makes them a critical component in various protocols and applications.
- BlowfishA symmetric-key block cipher invented by Bruce Schneier in 1993. Designed as a general-purpose algorithm, it uses variable-length keys, making it ideal for both domestic and exportable use. Despite its age, Blowfish remains widely utilized due to its speed, simplicity, and security. However, its successor, Twofish, offers enhancements such as larger block sizes and additional security features.
- BluejackingThe practice of sending unsolicited messages or files to Bluetooth-enabled devices. It is used in wireless communication to send short messages or files to nearby devices without the need for a direct connection. For example, Bluejacking can be used to send a promotional message to nearby phones with Bluetooth enabled.
- BluesnarfingA type of unauthorized access to a wireless device through a Bluetooth connection, often between phones, desktops, or laptops. This attack allows access to stored information, like email messages, contact lists, or calendars, without alerting the device’s user. Unlike Bluejacking, which primarily involves sending unsolicited messages, Bluesnarfing is a serious security concern as it allows for theft of information and unauthorized access to personal data.
- Blue teamA team of security professionals who focus on defensive measures to protect an organization’s information systems. It is used in cybersecurity to defend against cyber-attacks and prevent data breaches. Examples include regular security audits, implementing security protocols, and monitoring network traffic.
- BluetoothA wireless technology standard used for exchanging data between fixed and mobile devices over short distances. It utilizes short-wavelength UHF radio waves and is primarily designed for low power consumption. Bluetooth has become a common feature in many types of hardware, from computers and smartphones to audio equipment and car audio systems. Like any wireless technology, it has potential vulnerabilities and can be exploited if not properly secured, such as in the case of Bluejacking or Bluesnarfing.
- Boot SectorA region of a storage device containing machine code to be loaded into RAM by a computer system’s built-in firmware during the boot-up process. It typically includes a small program that tells the computer how to load the operating system and start the initial processes. The boot sector is a critical component in system startup and is often targeted by malware to control the boot process.
- Boot Sector VirusA type of malware that infects the boot sector of storage devices (like hard drives or removable media). Once installed, it is loaded into memory every time the system starts up, enabling it to persist even after a system reboot. It can potentially take control of the system before the operating system is fully loaded, making it particularly dangerous and difficult to detect and remove with standard antivirus tools.
- Border Gateway Protocol (BGP)The protocol that manages how packets are routed across the Internet by exchanging information between autonomous systems (ASes). BGP is used to determine the best available paths for data packet delivery and to maintain a table of IP network routes, which are dynamically updated in response to changes in the network.
- BotShort for robot, in a digital context, refers to an automated program designed to perform specific tasks without human intervention. These tasks can range from benign activities, such as web crawling for search engines, to malicious uses, such as launching distributed denial-of-service attacks (DDoS), spreading spam, or perpetrating click fraud. Because of their potential for misuse, it’s crucial to monitor network activities for unusual patterns that may suggest the presence of malicious bots.
- BotnetA network of infected computers that are controlled by a single entity, often without the knowledge of the computers’ owners. Botnets are typically used to perform distributed denial of service (DDoS) attacks, in which the botnet is used to flood a target website or network with traffic, overwhelming its resources and rendering it inaccessible. Examples of botnets include the Mirai botnet, which was used in several high-profile DDoS attacks, and the Storm botnet, which was one of the largest botnets in history.
- BoundaryIn the context of system security, a boundary refers to the defined barrier between different security domains, helping to manage and restrict the flow of information. This could be physical, such as the walls of a secured server room, or logical, such as a firewall or other security device that filters network traffic. Properly managed boundaries are crucial in limiting potential attack vectors and containing any damage if a breach does occur. A system’s boundary protection mechanisms should be defined based on the sensitivity of the information it handles and the potential threats it faces.
- Bounds CheckingThe practice of verifying that the data being operated on falls within the expected parameters or ‘bounds.’ For instance, in a data array, it would mean ensuring an index does not exceed the size of the array. This prevents errors, crashes, and security vulnerabilities like buffer overflow attacks, where an attacker can exploit an out-of-bounds write to inject malicious code or manipulate the system’s operation.
- Breach Attack Simulations (BAS)These are controlled tests carried out to mimic the tactics and techniques of real-world attackers to assess the effectiveness of an organization’s security posture. By emulating the actions of potential threats in a safe environment, BAS allows organizations to identify potential vulnerabilities, test their response procedures, and understand where improvements might be needed before an actual attack occurs. This proactive approach is a key part of maintaining a robust defense against increasingly sophisticated threats.
- Breach reportingThe process of informing individuals and authorities about a security breach or potential security threat. It is used in the event of a data breach to alert affected individuals and organizations and to determine the cause and prevent further incidents. Examples – A healthcare organization reporting a breach to patients and the government, a financial institution reporting a breach to customers and regulatory bodies.
- Brewer–Nash (BN) modelAlso known as the “Cinderella” or “Chinese Wall” model, Brewer–Nash is a security model designed to prevent conflicts of interest by limiting access to sensitive information. This model ensures that once a user has accessed specific sensitive data, they are prevented from accessing other related information that could lead to a conflict of interest or unethical action. It’s dynamically based on the user’s data access history and is especially applicable in industries where proprietary or confidential information must be strictly controlled, such as finance or law.
- BrickingAn event or action that renders a device unusable, often as a result of a firmware update or software alteration gone wrong. In this state, the device is as useful as a ‘brick.’ This term can also refer to a deliberate act of sabotage or a potential outcome of a severe malware attack. It emphasizes the importance of proper update procedures, reliable software sourcing, and robust security measures to protect against such threats.
- BridgeA network device that connects two different network segments, allowing them to communicate and share data. It is used in network architecture to increase connectivity and improve performance. Examples include a wireless bridge, a network bridge, or a virtual bridge.
- Broadband over Power Line (BPL)A method of data transmission that utilizes the existing electrical power distribution infrastructure to provide broadband internet connectivity. BPL is an alternative means of internet access that can be particularly useful in areas lacking conventional telecommunications infrastructure.
- Broadband TransmissionThe transmission of wide bandwidth data over a high-speed internet connection. Broadband allows multiple signals and traffic types to be transported simultaneously, supporting a variety of services like voice, video, and data. It contrasts with the narrowband, which carries a single data type or signal. Broadband is essential for modern internet access.
- BroadcastIn networking, a broadcast refers to the transmission of data packets that are sent to all devices on a network segment. The broadcast is intended for all recipients within the broadcast domain and does not differentiate between individual devices. In a typical IP network, a broadcast address enables information to be simultaneously sent to every device on the local network. Broadcasts are essential for network operations like address resolution but must be controlled to prevent unnecessary traffic and potential network congestion.
- Broadcast domainA logical division of a computer network where any device can transmit a packet that can be delivered to all other devices without the need for routing. Broadcast domains are typically bounded by routers and are a fundamental concept in network design.
- Broadcast stormA network issue that occurs when there are too many simultaneous broadcast messages in a network, causing the network to become overwhelmed and slow or even halting network functions. This could occur as a result of a configuration error, a malicious attack, or a feedback loop where broadcast messages are continually bounced back and forth between network devices. It’s an example of a potential vulnerability that needs to be managed within broadcast domains.
- Broken authenticationThis refers to flaws or vulnerabilities in a system’s authentication processes that could allow an unauthorized individual to assume the identity of a legitimate user. This could occur due to issues such as weak password policies, insecure account recovery methods, or improperly managed session identifiers. Once an attacker exploits these flaws, they can perform actions with the same privileges as the compromised user, potentially leading to unauthorized data access, data manipulation, or other damaging actions.
- BrowsingThe act of navigating through information resources in a network such as the Internet. This involves accessing and reading websites, downloading files, or using online applications. Browsing can be a vulnerable point for data breaches or malware infections, as users might encounter malicious sites, phishing attempts, or unsafe downloads. Effective measures to ensure secure browsing include the use of up-to-date, secure browsers, enabling automatic updates, utilizing browser security settings, and practicing careful navigation habits such as avoiding unfamiliar websites.
- Brute ForceA trial-and-error method used to decode encrypted data by systematically trying every possible combination of passwords or keys until the correct one is found. It is time-consuming and computationally intensive. This is achieved by systematically checking all possible keys or passwords until the correct one is found. Although this method can be time-consuming and resource-intensive, it can also be effective if the password is weak or the system lacks sufficient security measures to detect and prevent such attempts.
- BudgetA detailed financial plan outlining an organization’s expected revenues and expenses over a specific period, typically a fiscal year. Budgets serve as a blueprint for how a company intends to manage its financial resources, allocating funds to various departments, projects, and initiatives. They are essential tools for financial planning and control, helping businesses prioritize expenditures, forecast financial performance, identify potential shortfalls or surpluses, and make informed strategic decisions based on their financial goals and objectives. Budgets are often revised periodically to reflect actual performance and changing circumstances.
- BufferA temporary storage area for data while it is being transferred from one place to another. Typically, this is used when there is a difference between the rate at which data is received and the rate at which it can be processed or forwarded. Buffers are crucial components in many aspects of computing and networking. However, when not properly managed, buffers can become a point of vulnerability, leading to potential exploits such as buffer overflow attacks.
- Buffer overflow attackA form of security exploit that takes advantage of buffer overflow vulnerabilities in a system. By sending more data to a buffer than it can handle, an attacker can overwrite adjacent memory locations and potentially inject and execute malicious code. This can lead to a variety of harmful outcomes, from crashing the system to gaining unauthorized access or control. These attacks underscore the importance of proper memory management and secure coding practices in systems and applications.
- Bug BountiesIncentive programs offered by organizations where individuals can receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities within software systems. These programs encourage ethical hackers to contribute to the security of software by lawfully reporting potential issues.
- Bulk Data TransferThe movement of large volumes of data across a network, typically used in contexts where speed and efficiency are less critical than the sheer volume of data being moved. This can be seen in backups or data replication between data centers.
- Bulk encryptionThe process of encrypting large amounts of data, often during transit, to protect it from unauthorized access or tampering. This type of encryption can be applied at various levels, such as the file system, disk, or network level, and is often employed in secure data storage or transmission systems. The choice of encryption algorithm, key length, and encryption mode can significantly impact the security level and performance of the bulk encryption process.
- Burden of ProofThe obligation to present evidence to support one’s claim. In legal contexts, it refers to the requirement that a party must show factual evidence to prove their assertions are true, typically resting on the prosecution in criminal cases and on the plaintiff in civil litigation.
- BusIn the context of computing, a bus is a subsystem that transfers data or power between computer components or between computers. It is a shared communication link, used for exchanging data among multiple hardware components inside and outside the system. The use of a bus involves multipoint electrical paths, which allow data to be sent from one part of a computer to another.
- Business Balanced ScorecardA strategic planning and management tool that translates an organization’s vision and strategy into clear objectives and measures across four perspectives – financial, customer, internal business processes, and learning and growth. It helps align business activities with the vision and strategy of the organization, improve internal and external communications, and monitor organizational performance against strategic goals.
- Business caseA structured document providing the justification for the initiation of a project or task based on its expected commercial benefits. It outlines the objectives, risks, costs, benefits, and potential alternatives to inform decision-making. It’s vital to ensure that resources and efforts invested in a particular project or initiative are worthwhile and aligned with the organization’s strategic goals.
- Business continuityThe ability of an organization to maintain essential functions during and after a disaster has occurred. This involves planning and preparation to ensure that an organization can continue to operate in case of serious incidents or disasters and can recover to an operational state within a reasonably short period. This concept extends beyond disaster recovery to include keeping all aspects of a business functioning amidst disruptive events.
- Business Continuity Planning (BCP)The process of creating systems of prevention and recovery to deal with potential threats to an organization. BCP involves identifying critical business processes, determining acceptable downtime for each of these, and establishing protocols to restore function quickly and efficiently after a disruption. The end result of this process is a Business Continuity Plan – a comprehensive written document that guides an organization in responding to and recovering from disruptive incidents.
- Business ControlPractices and mechanisms established by an organization to regulate business processes, manage risks, and achieve objectives. Controls span across various domains, including financial, operational, IT, and security, and are critical for maintaining order, ensuring compliance, and safeguarding assets against fraud and other threats.
- Business dependency assessmentAn analysis process that identifies the critical operational elements within an organization, such as people, information, and processes, which are necessary to deliver the key products and services. This process also identifies the interdependencies between these elements and the impact that a disruption to them might have. Understanding these dependencies and their potential impact is crucial in prioritizing recovery strategies and resources during an incident.
- Business functionThe specific activities and processes that are performed by a business to achieve its objectives. It is used to define the core operations of the business. For example, the production function of a manufacturing company or the sales function of a retail store.
- Business goal A business goal is an objective that an organization aims to achieve, such as increasing revenue, improving customer satisfaction, or enhancing security posture. In IT and cybersecurity, technology strategies are often aligned with these goals to support the overall vision and success of the business.
- Business impactThe potential consequences or effects of an event, incident, or change on the operation, reputation, or financial stability of an organization. From a security perspective, the impact can be the result of a successful cyber-attack, data breach, or system failure and may include consequences such as operational downtime, financial loss, or reputational damage.
- Business Impact Analysis (BIA)A systematic process to identify and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency. A BIA is crucial for developing an effective business continuity plan as it aids in understanding the organization’s business processes, determining the impact of disruptions, and establishing recovery priorities.
- Business interruptionAn unexpected event that causes a halt or significant disruption in the normal operations of a business, such as a natural disaster, cyber-attack, or power outage. It can lead to substantial losses, and therefore, the prompt restoration of services is vital. Preparing for and managing business interruption is a central element of business continuity and disaster recovery planning.
- Business Model for Information Security (BMIS)A holistic and business-oriented approach to managing information security and provides understanding and insight into managing complex systems. It helps organizations understand the different factors that influence successful information security by considering people, processes, and technology, as well as strategy, architecture, and governance.
- Business Need Identification – AgreeThe “agree” phase of business need identification involves reaching a consensus among stakeholders about which needs should be prioritized and how they should be addressed. This may involve negotiating with different parties to come to an agreement about the best course of action or using a decision-making process to determine which needs are most important.
- Business Need Identification – AskThe “ask” phase of business need identification involves gathering information about the business needs that a particular project or initiative is intended to address. This may involve asking stakeholders or other relevant parties about their needs and priorities or conducting market research to gather data about what customers or clients are looking for.
- Business Need Identification – DocumentThe “document” phase of business need identification involves creating a written record of the business needs identified and how they will be addressed. This may involve creating a written plan or proposal outlining the details of the project or initiative, as well as any relevant timelines, budgets, or other considerations.
- Business Need Identification – EvaluateThe “evaluate” phase of business need identification involves evaluating the information gathered during the “ask” phase to determine which needs are most pressing and how they can best be addressed. This may involve analyzing data or conducting interviews with stakeholders to better understand the underlying issues and how they can be resolved.
- Business objectiveA specific, measurable goal that an organization aims to achieve to further its mission and vision. Objectives are often time-bound and may include targets related to growth, efficiency, or other aspects of organizational performance. These objectives often drive the strategies and tasks necessary to maintain security and protect the organization’s valuable assets.
- Business ProcessA structured set of activities or tasks that produce a specific service or product for a particular group of customers. Business processes are fundamental to an organization’s operations and are optimized for efficiency, effectiveness, and adaptability.
- Business process controlThe mechanisms implemented within an organization to manage and regulate business processes. These controls aim to ensure that processes are efficient, effective, and adaptable and that they meet the organization’s objectives and comply with laws and regulations. The security and reliability of these controls are essential in preventing unauthorized activities and maintaining overall operational effectiveness.
- Business process integrityInvolves maintaining the accuracy, consistency, and trustworthiness of business processes over their entire lifecycle. This concept is key to ensuring that these processes function as intended, are free from any form of alteration or corruption, and that they produce reliable and consistent outcomes. Ensuring business process integrity often requires security measures like access controls and audit trails.
- Business process ownerA person or group who is responsible for defining, implementing, and maintaining a business process. It is used to ensure that the process is aligned with the organization’s goals and objectives and to identify and address any issues or gaps in the process. Examples include a department manager, a project team leader, or a process improvement specialist.
- Business Process Reengineering (BPR)A management strategy that involves the fundamental rethinking and radical redesign of business processes to achieve significant improvements in critical areas such as cost, quality, service, and speed. BPR endeavors to break down and rebuild processes to make them more efficient and aligned with the overall goals of the organization.
- Business riskThe potential for loss, damage, or destruction of an organization’s value—be it in terms of physical or non-physical assets—caused by internal or external vulnerabilities that may prevent it from achieving its objectives. Such risks can arise from various factors, including financial uncertainty, strategic management decisions, legal liabilities, accidents, and natural disasters. Ensuring adequate security measures are in place to protect an organization’s data and assets is a critical component of business risk management.
- Business Service Provider (BSP)A company that offers organizations various business solutions and services, often through software as a service (SaaS) model. BSPs might specialize in delivering applications for enterprise resource planning, customer relationship management, or human resources management, among others. When engaging with BSPs, organizations must assess the providers’ security measures to ensure the protection of sensitive business data.
- Business sponsorTypically a high-ranking executive who takes ownership of the successful delivery of a project within an organization. They ensure the project aligns with the organization’s goals and provides resources and decision-making power. A critical part of their role is ensuring that the project adheres to necessary security protocols, which is crucial in the design, implementation, and operation of any system within an organization.
- Business strategyThe plan of action implemented by a business to attain specific goals and objectives, such as increasing profits, expanding market share, or improving customer satisfaction. A comprehensive business strategy includes considerations around data security, safeguarding assets, and maintaining reputation, ensuring that the company’s operations and growth are not undermined by security incidents or data breaches.
- Business-to-business (B2B) B2B refers to the exchange of products, services, or information between businesses, rather than between businesses and consumers. Cybersecurity in B2B transactions is crucial to protect trade secrets, customer data, and maintain the integrity of business operations.
- Business-to-consumer E-commerce (B2C)The online sale of products or services by businesses directly to consumers. This process often involves financial transactions and the exchange of personal data, making the implementation of robust security measures crucial to protect the consumers’ personal and financial information and to maintain the trust and reputation of the businesses involved.
- Bus topologyA network design where each computer and network device are connected to a single cable or backbone. In this topology, information sent from a device moves in both directions along the backbone until it reaches its destination device. If the backbone fails, the entire network typically becomes unusable, highlighting the importance of regular checks and maintenance in these setups. Despite this drawback, bus topology is appreciated for its simplicity and cost-effectiveness, especially for small networks.
- BYOD (Bring Your Own Device)A corporate policy allowing employees to use their personal electronic devices for work-related tasks. This approach can increase flexibility and employee satisfaction but also introduces security implications. Personal devices may not have the same stringent security controls as company-issued hardware, potentially exposing the network to malware or data breaches. To mitigate risks, businesses often implement BYOD security policies that include the use of VPNs, mandatory antivirus software, regular security updates, and the compartmentalization of company data through containerization or secure applications. These measures aim to safeguard sensitive information while accommodating the convenience of using personal devices.
- Bypass Label Processing (BLP)In certain security models, BLP refers to mechanisms that allow for selectively skipping security checks under predefined conditions, often to balance security with system performance. It is typically used in high-performance systems where certain types of data or operations are deemed low-risk, and the overhead of constant checks is unwarranted. Due to the risks inherent in not performing standard security checks, BLP should only be used when appropriate compensating controls are in place.
- Cable lockA physical security tool designed to prevent theft of devices. Typically, it is a cable that is securely attached to an immovable object at one end and a device (like a laptop) at the other end. While not a direct deterrent for advanced attacks, cable locks can help prevent opportunistic theft and tampering, enhancing the overall security posture of an environment.
- Cable modemA type of network bridge that allows bi-directional data communication via radio frequency channels on a hybrid fiber-coaxial and radio frequency over glass infrastructure. Cable modems are primarily used to deliver broadband Internet access, leveraging the high bandwidth of a HFC and RFoG network.
- CablesThe physical paths used to transmit data between devices. They come in various types, including Ethernet cables, coaxial cables, and fiber optic cables, each with different data transmission speeds, noise resistance, and physical reach. Ensuring the appropriate selection and proper maintenance of cables is crucial for network efficiency and reliability.
- Cache memoryA type of computer memory that temporarily stores frequently used data for quick access. By leveraging cache memory, a system can significantly improve its performance and efficiency, as fetching data from the cache (located close to the processor) is faster than obtaining it from primary memory locations. Cache memory management is essential to avoid possible vulnerabilities, such as cache-based side-channel attacks.
- Cache-timing AttackA side-channel attack that exploits the timing information of a system’s cache to gain insights into the data and operations processed by the system. Attackers measure the time it takes to perform certain operations to make inferences about the data, such as cryptographic keys, in the cache. These attacks are sophisticated and rely on understanding the timing discrepancies caused by cache hits and misses.
- Caesar cipherA type of substitution cipher that is used to encode messages by shifting each letter in the original message by a fixed number of places in the alphabet. It is a simple and easily breakable cipher but is still sometimes used as a basic form of encryption for simple communication or as a starting point for more complex ciphers. For example, the message “Hello” with a shift of 3 would be encoded as “Khoor”.
- CallbackIn the context of secure communications, callback is a method of authenticating a user where a server initiates a new connection to the user’s registered contact information (e.g., phone number or IP address) after receiving a request. This ensures that the access request is indeed coming from a trusted source. This method, though not widely used today due to more advanced techniques, adds an extra layer of security to verify the user’s identity.
- CapabilityIn a broader sense, capability refers to the set of functionalities or features a system, device, or software possesses that enable it to perform its tasks or roles effectively. This could include computational power, access permissions, and other software or hardware features. From a security standpoint, understanding a system’s capabilities helps identify potential weak points and areas for improvement.
- Capability Maturity Model Integration (CMMI)An enhancement of the original Capability Maturity Model (CMM), CMMI is a process and behavioral model that helps organizations streamline process improvement and encourage productive, efficient behaviors that decrease risks in software, product, and service development. The model provides a set of best practices that guide businesses through a continuum of improvements from an initial, ad hoc state of processes to a mature, disciplined state.
- Capability TableA security tool used in certain computer systems to define the access rights a certain user, process or a piece of software has over specific resources in the system. The table lists out the objects and the corresponding actions that can be performed on those objects, providing a comprehensive view of what is and isn’t permitted, thereby assisting in the enforcement of a secure environment.
- Capacity Stress TestingThe process of testing a system’s ability to handle its intended workload without experiencing performance issues. This typically involves simulating high traffic or data loads and monitoring how the system handles them, which can help identify bottlenecks or points of failure that may need to be addressed to ensure optimal performance during peak usage times.
- Capital Expenditure/Expense (CAPEX)The spending of funds by an organization to acquire or upgrade physical assets such as buildings, equipment, or hardware infrastructure. In the context of digital security, it may include the purchase of servers, storage devices, security appliances, or other significant hardware tools that are used to enhance or maintain security measures within an organization.
- Captive PortalA web page that a user must view and interact with before accessing a public network. Upon connecting to the network, the user’s browser is redirected to the captive portal, which may require authentication, payment, acceptance of EULA/usage policies, or other actions from the user. Captive portals are commonly used in public Wi-Fi networks to control access and ensure security.
- Card SwipeThe action of reading the magnetic stripe of a card, such as a credit or debit card, through a card reader device. Card swipe technology is utilized to facilitate electronic transactions by securely transferring cardholder information to a point-of-sale (POS) system. Security measures are integral to card swipe systems to protect against fraud and unauthorized data breaches.
- Carlisle Adams/Stafford Tavares (CAST)A series of symmetric encryption algorithms, including CAST-128 and CAST-256. Named after their developers, Carlisle Adams and Stafford Tavares, these algorithms are used to secure data during transmission or storage, ensuring confidentiality and preventing unauthorized access. CAST-128 is commonly used in various encryption protocols, including Secure Shell (SSH) and OpenVPN.
- Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)A protocol used for controlling traffic in wireless networks to prevent collisions or simultaneous data transmissions that can cause data corruption. Before sending data, devices using CSMA/CA first check if the transmission medium is free. If it’s occupied, the device waits for a random period before checking again, reducing the likelihood of multiple devices transmitting simultaneously and causing a collision.
- Carrier Sense Multiple Access with Collision Detection (CSMA/CD)A network protocol that operates at the data link layer (Layer 2) of the OSI model, which manages communication between devices in a wired network, such as Ethernet. The protocol allows devices to detect whether the shared communication channel is busy before attempting to transmit data, thus avoiding potential collisions. If a collision is detected, the devices involved will stop transmitting, wait for a random period, and then attempt to transmit again. This process continues until a successful transmission is achieved. CSMA/CD is crucial in ensuring effective communication and data integrity in networks where multiple devices are competing for bandwidth.
- Cascading Style Sheets (CSS)A stylesheet language used for describing the presentation of a document written in a markup language. CSS is commonly used in web development to control the appearance and layout of web pages. Examples of using CSS include defining the font, color, and size of text on a webpage or setting the position and size of images and other elements on the page.
- CBC-MAC (Cipher Block Chaining Message Authentication Code)A cryptographic technique that provides data origin authentication and data integrity for block ciphers. In this method, input data is divided into fixed-size blocks, which are then encrypted and combined sequentially using a chaining mechanism. The final encrypted block serves as the MAC (Message Authentication Code) that can be verified by the recipient to ensure the message has not been tampered with or altered during transmission. As an essential component of secure communication protocols, CBC-MAC protects sensitive information from unauthorized access, manipulation, or impersonation attacks.
- CC (Certified in Cybersecurity)A key entry-level IT/Cybersecurity certification, the CC is a stepping stone for those new to the field. Offered by ISC2, it caters to the increasing number of individuals pursuing cybersecurity careers without prior IT experience. Achieving the CC signifies a fundamental understanding of essential technical concepts and an ability to learn on the job, giving employers confidence in the holder’s capabilities.
- CCSP (Certified Cloud Security Professional)An advanced-level certification offered by ISC2 that validates expertise in cloud security architecture, design, operations, and service orchestration. CCSP certification is aimed at IT and information security leaders who aim to ensure the security of cloud environments.
- CCTV SurveillanceThe use of video cameras (Closed-Circuit Television) to transmit a signal to a specific, limited set of monitors for security and monitoring purposes. It’s commonly employed in public areas, businesses, and private properties to deter crime, monitor traffic, ensure public safety, and gather evidence for legal purposes. Advanced systems may include features like motion detection, night vision, and remote access. The widespread use of CCTV has implications for privacy and civil liberties, which are addressed by various regulations and laws.
- CellIn the context of computer systems, a cell is a fundamental unit of data storage, often found in a grid within a database or a spreadsheet. Each cell is identified by its unique address, resulting from the combination of its corresponding row and column labels, and can hold a piece of data such as a text string, a number, or a formula. Proper cell management, including access controls and data encryption, is crucial to prevent unauthorized data access or manipulation, ensuring data integrity and confidentiality.
- Cell-level Encryption (CLE)A database encryption method that encrypts individual cells, or fields, within a database table, allowing for fine-grained control over access to sensitive data. Each cell can be encrypted with a unique key, which prevents unauthorized users from reading the data while still allowing the database to perform complex queries, as the database structure remains accessible.
- Cell SuppressionA data protection technique used in statistical databases to ensure the privacy and confidentiality of sensitive information. By intentionally withholding (suppressing) the publication of certain data cells (individual entries or values) in a released table, this method prevents the disclosure of information that could be used to identify individuals or confidential attributes, especially in tables with small cell counts. Cell suppression is a form of data anonymization aimed at reducing the risk of re-identification in datasets that are shared or published for research, analysis, or public use.
- Cellular networksA type of wireless communication network that uses radio frequencies to transmit data between mobile devices and the network operator’s network infrastructure. Cellular networks are commonly used in smartphones and other mobile devices to provide access to the Internet, phone calls, and other services. Examples of cellular networks include GSM, LTE, and 5G networks.
- Centralized data processingA system in which data is collected and processed in a single location or server. It is commonly used in organizations to manage and control access to data. For example, a company may use centralized data processing to manage employee records and financial data.
- Central Processing Unit (CPU)The primary component of a computer that performs most of the processing inside a computer. Known as the “brain” of the computer, it executes instructions from programs, performing basic arithmetic, logic, controlling, and input/output (I/O) operations specified by the instructions. The CPU’s performance is a key determinant of the computer’s overall system speed.
- CertificateOften referred to as a digital certificate or a public key certificate, a certificate is a digital document that binds a public key to an identity. This document is used in various forms of online transactions and communications to prove the identity of an entity, like a person, company, or server. Certificates play a key role in public key infrastructure (PKI) systems, helping to prevent impersonation and interception by confirming that an entity is who it claims to be and thus promoting trust and security in digital communications.
- Certificate Authority (CA)An entity that issues digital certificates, which are used to verify the identity of organizations and individuals in digital communications, ensuring secure transactions and data transfer over the Internet. The CA validates entities and binds a public key with an identity, producing a certificate that can be used for secure communication.
- Certificate-based authenticationA digital identification process where a client or server proves their identity to another by showing a digital certificate. It’s a way to ensure that an individual, device, or website is exactly who or what it purports to be to avoid spoofing or man-in-the-middle attacks. The certificates are issued by a trusted Certificate Authority, which verifies the identity of the entity before issuing the certificate. Certificate-based authentication is widely used in secure environments due to its robustness and ability to provide two-factor and mutual authentication.
- Certificate ManagementThe process of creating, storing, distributing, revoking, and managing digital certificates. It involves oversight of the lifecycle of certificates to ensure they are up to date and being used correctly, preventing security lapses due to expired or compromised certificates. Good certificate management practices are essential for maintaining the security of encrypted communications and transactions.
- Certificate PoliciesA set of rules that outline the applicability of a specific certificate to a particular community and/or class of application with common security requirements. These rules define what actions should be taken under different circumstances, such as the process of issuing, renewing, or revoking a certificate. By providing a framework for the application and use of digital certificates, Certificate Policies ensure that all entities involved follow consistent practices, which is crucial for maintaining trust and security in digital transactions and communications.
- Certificate Practice Statement (CPS)A detailed document published by a Certificate Authority that outlines the practices and procedures used to manage the lifecycle of a certificate, from its issuance to its expiration or revocation. The CPS provides a comprehensive view of the CA’s operations, including validation procedures, security measures, and liabilities. By adhering to the guidelines outlined in the CPS, the CA ensures the integrity, authenticity, and reliability of the certificates it issues, which, in turn, fosters trust and security in digital environments.
- Certificate RevocationThe process of declaring a digital certificate as no longer valid before its scheduled expiration date. This can occur due to a number of reasons such as the certificate’s private key being compromised, the certificate being issued in error, or the certificate holder no longer requiring the certificate. The revocation is typically handled by the issuing Certificate Authority, and the status of the revoked certificate is updated in real-time on a Certificate Revocation List (CRL) or via an Online Certificate Status Protocol (OCSP) responder. Timely certificate revocation is critical in maintaining a secure digital environment as it prevents the use of invalid certificates, thereby protecting against unauthorized access and data breaches.
- Certificate Revocation List (CRL)A specific type of document maintained and published by a Certificate Authority that contains a list of digital certificates that have been revoked before their scheduled expiration date. The CRL is regularly updated and checked by services using the certificates, ensuring that any certificate that has been revoked is not trusted. By providing real-time information about the validity of certificates, CRLs play a vital role in maintaining the trust and security inherent in digital transactions and communications.
- Certification of SystemsThe formal process by which a system is evaluated against predefined criteria or standards to ensure it meets certain requirements related to quality, performance, and security. System certification often involves rigorous testing, analysis, and review by independent assessors or certifying bodies. In the context of IT and cybersecurity, certification might assess a system’s compliance with security standards, such as ISO/IEC 27001, Common Criteria (ISO/IEC 15408), or NIST frameworks. Achieving certification typically signals that a system is reliable, secure, and trustworthy, and it can be a critical factor for businesses that prioritize data protection and wish to ensure the confidentiality, integrity, and availability of their information systems.
- Chain Of CustodyA process that tracks the movement and handling of evidence from the moment it is collected until the moment it is presented in court. It includes a written record of all individuals who have had custody of the evidence, documenting each transfer of custody and the reason for the transfer. In digital forensics, maintaining a proper chain of custody is crucial for the integrity of digital evidence. It ensures that digital evidence, such as log files or hard drives, can be verified as being handled and stored in a secure manner, preventing tampering or unauthorized access and making the evidence legally admissible in court.
- Challenge Handshake Authentication Protocol (CHAP)A network authentication protocol where the server challenges a client to prove its identity. The server sends a unique challenge string, and the client responds with a value obtained by hashing the challenge with its password. If the values match, authentication is successful. CHAP provides more security than password-based authentication because the password is not sent over the network. It also periodically re-authenticates to protect against session hijacking.
- Challenge-response authenticationA method of authentication in which a server presents a question or challenge to a user or system seeking access, who must then provide a valid answer or response. This type of authentication is often used in scenarios where passwords alone are deemed insufficiently secure. The challenge is typically a random number, and the response is the correct encryption of this number using a shared key. By ensuring that the response is correct, the system verifies the identity of the user or system, thereby enhancing the security of the access process.
- Challenge/Response TokenA security token or device that produces a response code used in authentication processes. When presented with a challenge, such as a numeric code or a nonce provided by the authentication system, the token generates a corresponding response based on a secret key or algorithm. This response is then used to verify the user’s identity. These tokens enhance security by requiring something the user has (the token) in addition to something the user knows (a PIN or password).
- Change advisory board (CAB)A committee made up of stakeholders and subject matter experts whose role is to assess, prioritize, and approve changes to an environment or system. The CAB is responsible for evaluating the proposed changes in terms of their potential benefits, risks, and impacts to ensure changes are managed methodically to prevent negative effects and maintain smooth operations. This group plays a significant role in ensuring changes do not unintentionally introduce new vulnerabilities or weaken existing safeguards.
- Change controlA systematic approach to managing alterations to a system, project, or process. The process typically includes steps like documenting, evaluating, approving, and implementing changes. The goal is to prevent unnecessary changes, minimize the risk of adverse effects, and ensure that all modifications are traceable and well-documented. This is especially crucial for maintaining the integrity of the environment, as unplanned or unapproved changes can lead to vulnerabilities or inconsistencies that can be exploited by malicious parties.
- Change control board (CCB)A group that reviews, approves, or rejects proposed changes to a project or system. This body evaluates the implications of the changes on the whole system, taking into account factors such as risk, cost, and schedule. The CCB’s role is to ensure that the proposed changes are beneficial, feasible, and compatible with the existing structure and that they do not negatively impact the overall functionality and security.
- Change DocumentationThe detailed record of any alterations made to a system, project, or process. It includes information about the nature of changes, the individuals who authorized them, the time of their implementation, the reasons for their necessity, and the impact they had. This record serves as an important audit trail for understanding modifications over time and aids in tracking any changes that could potentially introduce vulnerabilities or inconsistencies into a system.
- Change ManagementA structured approach to handling modifications, both from the organization’s perspective and on the individual level. It entails planning, testing, implementing, and reviewing changes to ensure they are managed in a controlled manner. The aim of change management is to minimize disruption, reduce potential vulnerabilities arising from system modifications, and prevent unnecessary consequences that could weaken the overall system.
- Change Management BoardA governance body typically established to oversee and approve changes in an organization, ensuring they align with strategic objectives and do not introduce undue risk. The term “Change Management Board” is less commonly used than “Change Advisory Board” (CAB) or “Change Control Board” (CCB), both of which serve a similar function within the ITIL framework for managing changes effectively.
- ChannelsIn a communication context, channels refer to the medium through which data is transmitted from one place to another. This could include physical channels, such as wires or fiber optic cables, and wireless channels, such as those used in radio or infrared communication. From a security perspective, protecting these channels is essential to ensure that data is not intercepted, tampered with, or accessed by unauthorized individuals during transmission.
- Channel Service Unit/Digital Service Unit (CSU/DSU)Hardware devices used in digital telecommunications to connect the end customer’s equipment with the public switched network. A CSU/DSU translates the digital signals produced by the customer’s equipment into signals that can be transmitted over the carrier’s network and vice versa. These devices are essential for enabling reliable data transmission over digital communication lines such as T1 and T3 connections.
- Chaos engineeringA method of testing the resilience and robustness of systems by intentionally introducing failures or disruptions into a system in a controlled manner. It is used to identify and address potential weaknesses or vulnerabilities in a system and to ensure that it can withstand unexpected failures or events. Examples of chaos engineering include testing the ability of a system to recover from a database failure or simulating a network outage.
- Check digitA form of redundancy check used for error detection on identification numbers (e.g., bank account numbers, credit card numbers). It is a digit added to a string of numbers and is calculated from the other digits in the string. The presence of this additional digit helps in identifying incorrect input of the number sequence, thereby aiding in the prevention of data entry errors and enhancing the integrity of data.
- Check Digit Verification (Self-Checking Digit)A form of error detection mechanism that ensures the integrity of data during transmission or entry. It involves using a formula to calculate a check digit from the other digits in a string and then comparing that check digit to the one included with the string. If the calculated check digit matches the included one, the data is assumed to be correct; if not, an error is assumed, prompting a recheck or rejection of the data. This mechanism helps maintain data accuracy and can serve as a first line of defense against certain types of data corruption or fraudulent activity.
- ChecklistA structured list of items required, things to be done, or points to be considered, used as a reminder. From a security perspective, a checklist can help ensure that all necessary procedures have been followed, security controls are in place, and potential vulnerabilities are addressed. This might include tasks to perform, security controls to implement, or guidelines to follow when developing or managing a system. Checklists can help reduce human error and ensure a consistent approach to managing security.
- Checklist testA test that is conducted by following a checklist of specific steps or tasks. It is commonly used in quality assurance or compliance testing to ensure that all necessary steps are followed and all relevant criteria are met. Examples of checklist tests include a checklist for testing the functionality of a software application or a checklist for conducting a security audit.
- Checkpoint restart proceduresA method of managing long-running processes where intermediary results of a process are saved at ‘checkpoints.’ If the process is interrupted, rather than starting from the beginning, it restarts from the last checkpoint. This strategy is crucial for maintaining system availability and data integrity during unexpected events like system crashes or power outages. Besides saving time, these procedures can also help prevent data loss and minimize the potential for data corruption.
- ChecksumA calculated value that is used to determine the integrity of data. This value is computed from the binary sequence of a digital file or message, creating a unique signature of sorts. When the data is transferred or retrieved, the checksum is recalculated and compared with the original. If the values match, the data is considered intact; if they don’t, it indicates that the data has been corrupted or tampered with during transmission or storage.
- Check wordA form of data verification that’s used to detect errors after data transmission or storage. It is similar to a check digit but applies to a word or string of characters rather than just a number. By calculating a check word from a data string and comparing it to a stored or transmitted check word, it is possible to identify errors such as corruption or tampering. Maintaining the integrity of data is a key component of information security, making check words a useful tool in error detection and prevention.
- Chief Executive Officer (CEO)The highest-ranking executive in a company or organization, responsible for making major corporate decisions, managing overall operations and resources, acting as the main point of communication between the board of directors and corporate operations, and being the public face of the company. The CEO is often elected by the board and its shareholders.
- Chief Financial Officer (CFO)The senior executive responsible for managing an organization’s financial operations and reporting, including financial planning and analysis, accounting, and budgeting. They often work closely with the CEO and other senior executives to develop and implement strategic plans and policies.
- Chief Information Officer (CIO)The senior executive responsible for overseeing an organization’s information technology (IT) strategy, policies, and operations. They work closely with the CEO and other senior executives to develop and implement IT solutions that align with the organization’s business goals and objectives.
- Chief Information Security Officer (CISO)The senior executive responsible for overseeing an organization’s information security strategy, policies, and operations. They work closely with the CIO and other senior executives to develop and implement security solutions that protect the organization’s sensitive data and assets.
- Chief Security Officer (CSO)The senior executive responsible for overseeing an organization’s overall security strategy, policies, and operations. They work closely with the CEO and other senior executives to develop and implement solutions that protect the organization’s physical, cyber, and human assets.
- Chief Technology Officer (CTO)The senior executive responsible for overseeing an organization’s technology strategy, policies, and operations. They work closely with the CEO and other senior executives to develop and implement technology solutions that align with the organization’s business goals and objectives.
- Chosen-ciphertext attackIn a chosen-ciphertext attack, the attacker has access to a ciphertext (encrypted message) and is able to manipulate it in some way to try and derive the plaintext (original message). For example, the attacker may try to modify the ciphertext and see how the resulting decryption changes in order to learn more about the encryption algorithm and key being used.
- Chosen-plaintext attackIn a chosen-plaintext attack, the attacker has access to a plaintext (original message) and is able to encrypt it using the same algorithm and key that the target uses. By comparing the resulting ciphertext to the ciphertext of other known messages, the attacker may be able to determine the encryption algorithm and key being used.
- CIA TriadA widely-used information security model that represents the three fundamental principles of security – Confidentiality, Integrity, and Availability. Confidentiality is about protecting information from being accessed by unauthorized parties, integrity ensures that the information is accurate and hasn’t been improperly modified, and availability ensures that the information is accessible to authorized users when needed. The triad serves as a simple framework for keeping an organization’s sensitive data secure.
- CI/CD EnvironmentsCI/CD stands for Continuous Integration and Continuous Delivery/Deployment. Continuous Integration involves integrating changes from different contributors into a central repository frequently, which encourages catching integration bugs early. Continuous Delivery/Deployment involves automating the release process to get validated changes deployed to production quickly and sustainably. From a security perspective, CI/CD environments should be set up to include automated security checks and tests at various stages, such as static code analysis for potential vulnerabilities and dynamic testing in staging environments, to ensure that security is a part of the process from start to finish.
- CipherAn algorithm used for performing encryption or decryption—a series of well-defined steps that can be followed to transform an input (plaintext) into an output (ciphertext) or vice versa. Ciphers are fundamental to modern cryptography and operate based on a piece of auxiliary information known as a key. The key determines the particular transformation of plaintext into ciphertext, or vice versa, during encryption and decryption.
- Cipher Block Chaining (CBC) ModeA mode of operation for block ciphers where each block of plaintext is XORed with the previous ciphertext block before being encrypted. This method ensures that identical plaintext blocks will encrypt to different ciphertext blocks, enhancing security. It uses an initialization vector (IV) for the first block to ensure randomness.
- Cipher Feedback (CFB) ModeA mode of operation for block cipher systems that effectively converts a block cipher into a self-synchronizing stream cipher. In CFB mode, the previous ciphertext block is encrypted, and the output is XORed with the current plaintext block to get the current ciphertext block. As with CBC mode, the chaining mechanism causes the output to be highly sensitive to changes in the input, increasing security by masking patterns in the plaintext.
- Cipher SuiteA set of algorithms that work together to secure network connections. It defines the way that a system will implement cryptographic functions such as key exchange, bulk encryption, and message authentication. When two devices communicate, they agree on a cipher suite to use for the session, ensuring that both parties have the necessary mechanisms to establish a secure communication channel.
- Ciphertext-only attackA type of attack where an attacker only has access to the ciphertext of a message or data and not the plaintext or the key used to encrypt it. This type of attack is often used to test the security of a cipher algorithm or to try to break the encryption. Examples include using statistical analysis to try to determine the key used to encrypt a message or using a brute-force attack to try all possible keys.
- Ciphertext or Cipher TextThe output of the encryption process. It is the scrambled, unreadable version of an original plaintext message that has been encrypted using a cipher. Ciphertext is designed to be meaningless and confusing, so it is unreadable and incomprehensible to anyone who intercepts it without the correct decryption key.
- Circuit-Level Gateway FirewallA type of firewall that operates at the session layer of the OSI model, or the TCP/IP stack’s equivalent, typically used to manage whether inside devices can connect to outside networks like the Internet. It creates a virtual circuit between the client and the server, hiding and protecting the network’s internal characteristics and information by seeming to initiate all connections.
- Circuit-switched networkA type of network where a dedicated communication path is established between two devices before they start communicating. This path, or circuit, remains open for the duration of the communication session and is then terminated or “switched” once the session ends. Such networks are traditionally used for telephone communications, where a direct and constant connection helps ensure that the entire conversation arrives intact.
- CISM (Certified Information Security Manager)A highly respected certification in the field of information security management, CISM is the benchmark for individuals overseeing an organization’s information security. Offered by ISACA, it is tailored for those responsible for managing, designing, and overseeing an enterprise’s information security.
- CISSP (Certified Information Systems Security Professional)The most in-demand IT/Cybersecurity certification, the CISSP is golden standard. It is offered by ISC2 and is designed for experienced security practitioners, managers, and executives who want to demonstrate their knowledge across a wide array of security practices and principles.
- Clark-Wilson ModelA security model focused on maintaining data integrity by enforcing a transaction-based approach. It ensures that users can only execute transactions for which they are authorized, and each transaction must maintain the system’s integrity by transforming data from one consistent state to another. The model also requires auditing of these transactions to provide accountability.
- ClassificationThe process of categorizing data based on its level of sensitivity, value, and criticality. Data can be classified into different categories, such as public, internal, confidential, or highly confidential. The aim of classification is to apply appropriate security controls to safeguard the data. The level of security and access controls implemented is determined by the data’s classification.
- ClassifiedThe data or information that has been given a specific classification level based on its sensitivity and the potential impact on an organization or a nation should it be disclosed unauthorizedly. Common classifications include confidential, secret, and top secret. Access to classified information is typically restricted to individuals who have the necessary clearance level and a legitimate need to know.
- Classified Information SpillageAn event where information that has been classified is transferred, processed, or stored on a system that is not accredited or authorized to handle data of such classification level. The spillage could occur accidentally or deliberately, and it poses a significant risk because it may lead to unauthorized disclosure of sensitive or classified information. Measures are taken in organizations to prevent such spillages and to manage them effectively when they occur.
- Classless Interdomain Routing (CIDR)A method for allocating IP addresses and routing Internet Protocol packets. It effectively replaced the previous system based on classes (Class A, B, and C) and allows for more efficient and flexible allocation of IP addresses. CIDR notation is a compact representation of an IP address and its associated routing prefix, helping reduce the size of routing tables and make more IP addresses available within organizations.
- Class LoaderIn the context of programming languages like Java, a class loader is part of the runtime environment, responsible for finding and loading class files as required by the program. It plays a crucial role in Java’s security model, as it’s responsible for loading (or linking) classes in a secure manner from local file systems, network locations, or other sources. The class loader’s security measures are critical in preventing unauthorized access to sensitive resources.
- CLASSPATHAn environment variable in Java programming that tells the Java Virtual Machine (JVM) and Java technology-based applications where to find class libraries, including user-defined class libraries. This is crucial for the execution of Java applications, as CLASSPATH can be set to point to the directories where related class files are stored.
- Clean Desk PolicyA corporate directive that specifies how employees should leave their working space when they aren’t there. This policy aims to protect sensitive information by ensuring that all papers, sticky notes, flash drives, and other information storage devices are properly stored away and secured when not in immediate use. It also includes shutting down computers or locking them when left unattended. Such a policy reduces the risk of sensitive data being exposed to unauthorized personnel or visitors.
- Cleanroom MethodologyA rigorous software development process aimed at producing defect-free software by applying engineering principles of process control and quality assurance. It emphasizes formal specification, incremental development, and statistical quality control, often involving automated tools to track defects and users’ behavior to refine the software iteratively without introducing errors.
- ClearanceThe authorization given to an individual, allowing them to access certain classified information or areas. This process involves a thorough assessment of the individual’s background, including past conduct, trustworthiness, and loyalty to their nation. The clearance level required depends on the sensitivity of the information that the individual needs to access.
- Clearance LevelThis denotes the degree to which an individual may access classified data or secure areas. There are several levels of clearance, which can vary depending on the organization or country but generally include levels such as Confidential, Secret, and Top Secret. The higher the clearance level, the more sensitive the information the individual can access. To receive a specific clearance level, an individual must undergo a background investigation to assess their trustworthiness and reliability.
- CleartextData that is transmitted or stored unencrypted and thus can be easily read and understood without any need for decryption. While it facilitates ease of use and interoperability, it poses significant security risks as it can be easily intercepted and read by unauthorized individuals, potentially leading to data leakage, privacy violations, or other security incidents.
- ClientA computer or device that accesses a server or network to request and receive information or services. Clients are typically connected to a server or network through a client-server architecture, where the client sends a request to the server, and the server responds with the requested information or service.
- Client/Server NetworkA network architecture where multiple client devices or programs connect to centralized servers to access services, resources, or share data. Servers provide various functionalities – like email, file storage, or web page hosting – while clients make requests to servers to utilize these services. This model is foundational to modern computing and the Internet.
- Client-Side AttackAn attack that targets vulnerabilities in client software that interacts with a compromised server or processes malicious data. Common examples include attacking a user’s web browser via malicious web pages, email clients via phishing emails, or software applications via malicious data files. These attacks often rely on the execution of malicious scripts or the exploitation of vulnerabilities in the client software. The aim is often to gain unauthorized access, steal sensitive data, or establish a persistent presence on the victim’s system.
- Client-side key managementA strategy in data encryption where the encryption keys are generated and controlled by the client rather than the server. This approach gives the client exclusive control over the encryption and decryption of their data, adding an extra layer of security as even the service provider does not have access to the encryption keys. This model is common in zero-knowledge systems and enhances the privacy and security of the encrypted data.
- Client-side validationThe verification of data on the client side of a client-server interaction, usually before the data is sent to the server. This can include ensuring form fields are filled out correctly, input matches expected formats, and other checks. While enhancing user experience by providing immediate feedback, it must not be the sole method of validation due to the potential for bypassing by malicious users; server-side validation provides an additional necessary layer of security.
- Clipping LevelIn the context of security, a threshold at which a system begins to take notice of or log certain user activities, typically to detect potential unauthorized actions or policy violations. For example, setting a clipping level for incorrect password attempts might involve the system recording or alerting administrators after a certain number of failed logins to prevent brute-force attacks.
- Closed Security EnvironmentA state where an entity has full control over the system or network and can ensure that unauthorized users cannot gain access. Typically, this involves rigorous access controls, stringent security policies, and practices such as keeping all hardware physically secure. In such environments, the system’s operation or the data within it is deemed so critical that an extra layer of protection is required to prevent unauthorized access or compromise.
- Closed SystemIn computing, a closed system refers to a software or hardware system that is proprietary and restricts access to its data and operations from outside sources. It operates under strict control, often with no interoperability with other systems, and users cannot modify it freely. This is opposed to an open system, which is designed to be interoperable and modifiable. In thermodynamics, a closed system can exchange energy but not matter with its surroundings.
- Cloud Access Security Broker (CASB)A service that acts as a gatekeeper, allowing organizations to extend their security policies beyond their own infrastructure to cloud services. It sits between the cloud service user and cloud applications and can enforce security policies such as authentication, single sign-on, and more. By providing visibility into and control over cloud applications, CASBs help organizations maintain compliance and protect data in the cloud.
- Cloud auditing and complianceThe systematic evaluation of cloud-based systems and services to ensure that they meet regulatory and organizational security policies. This process helps verify that data is being handled in a manner that meets various compliance standards, such as GDPR, HIPAA, or SOC 2, and can involve both automated scans and manual reviews. These audits are critical in mitigating risk, identifying vulnerabilities, and ensuring the integrity and confidentiality of data in the cloud.
- Cloud backup as a serviceA data backup and recovery solution that involves storing data on a remote, cloud-based server. It is used to ensure that data is protected against loss due to hardware failure, natural disasters, or other unforeseen events. Examples include using a cloud-based storage service like Google Drive or Dropbox to store data or using a specialized cloud backup service like Carbonite or Mozy to store data.
- Cloud backupsThe process of storing copies of digital data in a remote, cloud-based server. This practice is a key part of data loss prevention strategies, providing a safeguard against issues like hardware failure, accidental deletion, or cyberattacks. The cloud’s scalability and accessibility advantages over traditional, on-premises backup methods make it an increasingly popular choice for ensuring data resilience and continuity.
- Cloud brokersThird-party entities that serve as intermediaries between cloud service providers and consumers. They simplify the purchasing process and assist customers in selecting services that best meet their needs. Furthermore, cloud brokers can provide value-added services such as managing contracts, handling service issues, and ensuring that performance and security requirements are met.
- Cloud burstingA strategy used to manage spikes in workload by dynamically allocating additional resources from a public cloud when the capacity of a private cloud is exceeded. This process can happen automatically and is seamless to the end-user. Cloud bursting provides a cost-effective solution to manage workload fluctuations without over-provisioning resources.
- CLOUD (Clarifying Lawful Overseas Use of Data) ActA US law that allows federal law enforcement agencies, under certain circumstances, to compel U.S.-based technology companies to provide requested data stored on servers, regardless of whether the data is stored in the US or on foreign soil. This legislation aims to improve law enforcement agencies’ access to digital information for investigations and court proceedings, but it has also raised privacy and data sovereignty concerns.
- Cloud Clustered StorageA distributed storage system that pools together resources from multiple cloud servers, ensuring high availability and scalability. Cloud clustered storage provides redundancy and fault tolerance for managing and storing large volumes of data across a cloud environment.
- Cloud co-lo (co-located) environmentsA co-located cloud environment refers to the practice of housing privately owned servers and networking equipment in a third-party data center instead of keeping it on-premises. The data center provides the power, bandwidth, IP address, and cooling systems that the server requires to function optimally, while the client retains full control and responsibility over its own equipment. This model combines the benefits of private infrastructure with the convenience and scalability of a cloud-like environment.
- Cloud ComputingA computational model that enables on-demand access to shared resources, such as servers, storage, applications, and services, over the Internet. This model allows businesses and individuals to access technology services without the need for substantial infrastructure investment or ongoing maintenance, enhancing operational agility and scalability.
- Cloud Computing Roles and ResponsibilitiesIn cloud computing, various roles and responsibilities are defined to ensure smooth operations and clear governance. Key roles typically include the cloud service provider (offering the cloud service), the cloud consumer (using the services), and sometimes a cloud broker (facilitating the relationship between the other two). Each role has specific responsibilities tied to data management, service provision, security, and compliance.
- Cloud containersLightweight, stand-alone, executable packages that include everything needed to run a piece of software, including the code, a runtime, libraries, environment variables, and config files. They isolate software from its environment to ensure that it works uniformly despite differences, for instance, between staging and production.
- Cloud content-based discoveryRefers to methods employed to identify, classify, and control data residing within cloud environments based on the content contained within those files. This is crucial for the identification and protection of sensitive data, aiding in adherence to compliance requirements and enforcing data security policies.
- Cloud Controls Matrix (CCM)A comprehensive framework designed by the Cloud Security Alliance to ensure the necessary security controls in cloud environments are in place and to streamline due diligence processes. CCM covers multiple areas, including compliance, data governance, facility security, human resources, information security, legal issues, operations management, risk management, release management, resilience, and security architecture. It offers organizations a clear roadmap for implementing security controls and reducing risk when leveraging cloud-based resources.
- Cloud CouplingThe degree to which a cloud service or application is interconnected with other cloud services. Cloud coupling can range from loosely coupled systems, which operate independently, to tightly coupled systems, which rely heavily on each other, affecting scalability and resilience.
- Cloud Customers vs. Cloud UsersCloud customers are the entities that contract with a cloud service provider to use their services. This could be organizations, teams, or individuals. On the other hand, cloud users are those who interact with the cloud system to perform various tasks. While all users are customers, not all customers are users, such as when an organization is a customer, but its employees are the users.
- Cloud Data Access ResponsibilitiesRefers to the delineation of accountability regarding who is responsible for managing and safeguarding data hosted in the cloud. Responsibilities can vary depending on the service model (IaaS, PaaS, SaaS) and the provider-customer agreement, but typically, the cloud provider secures the infrastructure while the customer is responsible for protecting their data through access controls, encryption, and compliance with privacy regulations.
- Cloud deployment modelsThe various ways that cloud services can be deployed based on infrastructure ownership and access. These include public clouds, which are accessible to the general public; private clouds, which are used exclusively by a single organization; hybrid clouds, which combine public and private cloud services; and multi-cloud environments, which use multiple cloud services, often from different providers.
- Cloud Deviations and ExceptionsRefers to the instances where cloud services or deployments diverge from standard operational procedures, security policies, or compliance requirements. Deviations may be intentional or unintentional, whereas exceptions are typically authorized variances granted for specific reasons. Documenting and managing these deviations and exceptions are critical for maintaining the security and integrity of cloud environments, ensuring that risks are identified, assessed, and mitigated appropriately and that compliance with industry standards and regulations is maintained.
- Cloud-FirstAn organizational policy or strategy where cloud solutions are prioritized and preferred over on-premises solutions. Under a cloud-first strategy, when a business needs a new application or infrastructure, the default approach is to consider cloud-based options first due to their potential benefits, such as cost-effectiveness, scalability, and flexibility.
- Cloud library preservationThe process of securely storing and preserving digital resources in a cloud environment. The aim is to ensure long-term accessibility, maintain data integrity, and protect the resources from data loss or corruption. Key activities include implementing secure backup strategies, maintaining versions of data, and ensuring the appropriate metadata is retained for the accurate retrieval and utilization of the resources.
- Cloud logical locationThe virtual or logical location of data in the cloud, which may be distinct from its physical location. This virtual location is defined by the network paths used to access the data and is relevant in contexts where data access speed, network costs, and legal or regulatory restrictions on data location are important considerations.
- Cloud migrationThe process of moving data, applications, or other business elements from an on-premises environment into a cloud (public or private) or from one cloud environment to another. The migration process can be a complex task, requiring careful planning and execution to minimize disruption to services and ensure data integrity and security during the transfer.
- Cloud-NativeThe design and development of applications specifically for the cloud environment. Cloud-native applications are designed to leverage the advantages of cloud computing frameworks, including scalability, flexibility, and resilience. These applications are generally developed using microservices architecture, managed through DevOps processes, and run in containers, enabling them to be easily scaled and modified.
- Cloud Privacy IssuesThe potential privacy concerns and risks that arise when storing data or conducting activities in a cloud environment. Because data stored in the cloud is often spread across multiple servers in various locations, it can be subject to different privacy laws and regulations. Furthermore, as the data is under the control of a third-party cloud service provider, there could be concerns about unauthorized data access, data mining, or issues with data ownership.
- Cloud provider responsibilitiesThe duties and obligations of cloud service providers are to ensure the availability, integrity, and security of their services. These responsibilities often include maintaining infrastructure, implementing security measures to protect data and systems, providing reliable access, managing system updates, and ensuring compliance with relevant regulations and standards. They are typically outlined in the service level agreement (SLA) between the provider and the customer.
- Cloud provider security responsibilitiesThe specific duties and tasks that a cloud service provider must undertake to ensure the security of the data and applications they host. These responsibilities can range from physical security measures, such as controlling access to data centers, to digital security practices, like encryption, intrusion detection systems, and frequent security audits. The exact responsibilities can vary depending on the cloud service model, with more duties falling on the provider in infrastructure as a Service (IaaS) and less in software as a Service (SaaS).
- Cloud recovery preparationThe process of planning and implementing strategies to recover data, applications, and systems hosted in the cloud in the event of a disaster or disruption. This includes setting up backups, creating disaster recovery plans, ensuring redundancy, and establishing failover systems. It’s crucial for maintaining business continuity and minimizing downtime in the event of an outage or other disruptive events.
- Cloud resource poolingThe model of sharing resources among multiple users in a cloud environment. In this paradigm, the provider’s computing resources, such as storage, processing power, memory, and network bandwidth, are pooled together and allocated dynamically to meet the demands of individual users. This allows for efficient utilization of resources, scalability, and cost-effectiveness, as users only pay for the resources they use.
- Cloud Risks by Deployment ModelThe potential security threats and challenges vary by the cloud deployment model—public, private, or hybrid cloud. Public Cloud – Risks include data breaches, loss of control over data security, and shared technology vulnerabilities due to the multi-tenant nature. Private Cloud – Less exposure to external threats but higher responsibility for securing and maintaining the infrastructure compared to public clouds. Hybrid Cloud – Combines public and private cloud risks, plus challenges in data and application interoperability and complexities in consistently applying security policies across diverse environments.
- Cloud roles and responsibilitiesThe definition of the tasks, duties, and responsibilities of different stakeholders in a cloud environment. It’s critical for delineating the obligations of cloud service providers and customers in managing and securing cloud resources, data, and services. A clear definition of roles and responsibilities helps ensure accountability, promotes transparency and improves overall security and efficiency in cloud operations.
- Cloud Security Alliance’s Cloud Controls Matrix (CSA CCM)A comprehensive and structured framework established by the Cloud Security Alliance to help organizations identify and assess the security risks associated with cloud environments. It provides a detailed list of security controls categorized into different domains, serving as a guide for organizations to design, implement, and evaluate their cloud security strategies.
- Cloud Security Alliance’s IoT Security Control FrameworkA comprehensive set of practices and controls designed to secure Internet of Things (IoT) devices and their associated data. The framework addresses the unique security challenges posed by IoT, providing guidance on device identity, secure communication, data protection, and regular updates. It aids organizations in mitigating the risks associated with the increasing connectivity and complexity of IoT ecosystems.
- Cloud Security FrameworksA set of policies, guidelines, and procedures designed to manage the risks and security posture of cloud computing environments. These frameworks guide organizations in securing data, applications, and infrastructure in the cloud.
- Cloud Service ModelsThey encompass the different layers of cloud computing that offer varying degrees of control from infrastructure to applications. Infrastructure as a Service (IaaS) provides virtualized computing resources over the Internet, such as servers and storage. Platform as a Service (PaaS) supplies a cloud-based environment for developers to create, manage, and deploy applications without the complexity of building and maintaining the underlying infrastructure. Software as a Service (SaaS) delivers fully managed applications to users on a subscription basis, eliminating the need for installations and running software on individual computers. Each model shifts more operational responsibility from the consumer to the cloud provider.
- Cloud Service Models (SaaS, PaaS, IaaS)The three main categories of cloud computing services that define the type of service provided. SaaS (Software as a Service) delivers software applications over the Internet, PaaS (Platform as a Service) offers a cloud platform and environment to develop and deploy applications, and IaaS (Infrastructure as a Service) provides virtualized computing resources over the Internet.
- Cloud service provider contractsThese are legally binding agreements between an organization and a cloud service provider. They detail the terms of service, roles and responsibilities, performance metrics, data privacy and security provisions, costs, and what happens in the event of a dispute or termination of service. Understanding these contracts is crucial in ensuring that service expectations are met and risks are properly managed.
- Cloud Service Provider (CSP)Companies that offer a range of computing services over the Internet. These services can span from simple storage and computing resources to complete applications and platforms. Customers often leverage these services to reduce infrastructure costs, increase scalability, and improve business agility.
- Cloud Storage – Volume vs. ObjectIn cloud storage, “volume storage” refers to block storage that acts like a traditional disk drive and is suitable for scenarios where low-latency access is crucial, such as databases. “Object storage” treats data as individual objects accessed via a unique identifier and is ideal for storing large quantities of unstructured data, offering benefits like scalability and easy access through APIs.
- ClusteringThe process of grouping a set of objects, nodes, or data points in such a way that objects in the same group (a cluster) are more similar to each other than to those in other groups. In the context of systems and networks, clustering is used to enhance performance, availability, and resilience by distributing workloads across multiple nodes or servers.
- Clustering of Pseudorandom NumbersThis refers to the undesirable pattern in pseudorandom number generation where values are not evenly distributed but rather appear grouped or “clustered” together. Such patterns can compromise the security of cryptographic systems that rely on pseudo-randomness, making them vulnerable to predictability and potential attacks.
- CMAC (Cipher-based Message Authentication Code)A cryptographic technique for message authentication using a symmetric key block cipher algorithm such as AES. It provides integrity and authenticity for messages or data by producing a fixed-size output, known as a tag or MAC, which is sent along with the message. The receiver then computes the CMAC using the same secret key to verify the integrity of the message. CMAC is resistant to forgery and is widely used in various security protocols and applications.
- CMBs (Change Management Boards)These are groups of stakeholders and technical experts who evaluate, approve, and prioritize changes within an organization, often in regard to project management or software development. Their role involves evaluating the risk, cost, and potential impact of proposed changes, ensuring that the implementation of changes does not disrupt existing workflows or create new vulnerabilities in the system.
- Coaxial CableA type of electrical cable consisting of a central conductor surrounded by an insulating layer over which a metallic shield is placed. This construction is then enclosed in an outer insulating layer. Coaxial cables are used to transmit data, video, and voice communications, they are known for their ability to shield signals from external electromagnetic interference, making them suitable for a range of telecommunications and networking applications. They have been widely used for cable television and internet service connections.
- COBIT (Control Objectives for Information and Related Technologies)A framework created by ISACA for information governance and management. It is used globally to help businesses achieve strategic goals through effective and innovative use of IT while mitigating risks and managing organizational complexity. COBIT provides a set of generic processes for the management of information systems, each with a high-level control objective, input/output tasks, process controls, and performance measures.
- CODASYL (Conference on Data Systems Languages)An influential consortium established in the late 1950s that played a pioneering role in the development of database management systems and the COBOL programming language. CODASYL’s work led to the creation of the network database model, a precursor to the relational model, which was widely used in business applications.
- Code analysis toolsSoftware utilities that scan application code to identify potential security vulnerabilities, programming errors, and adherence to coding standards and best practices. These tools are critical in improving the quality of software by detecting flaws early in the development lifecycle, reducing the risk of vulnerabilities being exploited, and minimizing the cost of remediation.
- Code EscrowA legal agreement involving at least three parties – a software licensing organization, the licensing customer, and an escrow agent. In this arrangement, the software’s source code is given to an independent third party (the escrow agent) for safekeeping. The escrow agent releases the source code to the licensee in the event that the licensor fails to meet contractual obligations, such as maintenance, support, or bankruptcy, ensuring business continuity and access to critical functionalities.
- Code of EthicsA guiding document that outlines expected behaviors and decision-making approaches within an organization or profession. It serves as a set of principles to guide professionals in carrying out their work with integrity, honesty, and responsibility. Violation of the code of ethics can lead to disciplinary actions, including termination of employment or membership.
- Code of ethics ISACAA set of principles specifically designed for IT governance, risk, cybersecurity, and assurance professionals. These principles stipulate professional standards for fairness, honesty, confidentiality, and professional competence. ISACA members and certification holders are required to adhere to this code, promoting trust and value in the industries they serve.
- Code of ethics – ISC2A set of professional principles adhered to by members of ISC2 (International Information System Security Certification Consortium), a non-profit organization specializing in training and certifications for cybersecurity professionals. The code stipulates four mandatory canons – Protect society, the common good, necessary public trust and confidence, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals. Advance and protect the profession.
- Code protection and logic hidingThe various techniques used to obfuscate the internal workings of a program or system. The main purpose is to prevent reverse engineering or unauthorized modification, thereby securing intellectual property and maintaining the integrity of the software. Techniques used can range from simple code obfuscation to more advanced methods like encryption or running code in a secure environment.
- Code repositoryA centralized place where developers store, manage, track, and control different versions of software code. It enables collaboration, allowing multiple contributors to work on a project without overwriting each other’s changes. This tool is vital for maintaining version control and enabling rapid recovery if necessary. Repositories can be hosted on a local server or on a cloud-based platform, with popular services including GitHub and Bitbucket.
- Code reviewThe systematic examination of source code, usually carried out by someone other than the author, with the goal of identifying bugs, security breaches, or violations of development guidelines. This process not only enhances the overall quality of the software but also promotes knowledge sharing among the team, leading to better understanding and collaboration.
- Coding guidelines and standardsA set of conventions or rules established for a specific programming language or development environment. These rules dictate the use of naming conventions, commenting, indentation, error handling, and more, with the intent of improving code readability, maintainability, and robustness. Adhering to such guidelines and standards is essential for facilitating team collaboration and ensuring the consistent quality of the software product.
- Coding practicesThe methods and procedures that programmers follow when writing their code. Good coding practices aim to improve the quality of software and the efficiency of the development process. They may include techniques such as code reuse, modularization, commenting, consistent indentation, error handling, and adhering to naming conventions. These practices help ensure that the code is clean, readable, efficient, and easy to maintain and debug.
- Cognitive PasswordsThese are security questions used to authenticate a user’s identity based on personal knowledge. They can be less secure than other forms of authentication due to the possibility of answers being easily guessed or researched. It’s important to select questions with answers that are not publicly available to increase security.
- CohesionIn software design, cohesion refers to the degree to which the elements inside a module belong together. In essence, it’s the measure of how closely related the responsibilities of a module are. High cohesion in software modules is desirable as it promotes the maintainability and reliability of the software. This concept is important in the context of secure software design, as low cohesion can lead to software vulnerabilities due to poorly defined module boundaries.
- Cold RolloverRefers to transitioning to a secondary system or network during a planned or unplanned outage, where the secondary system is started from an inactive state. It generally requires manual intervention to restore services and data from backups, leading to longer restoration times compared to hot or warm rollovers.
- Cold SiteA backup location that is kept on standby for use if the primary business location becomes unavailable due to a disaster or other disruptive event. Unlike a hot site, a cold site doesn’t have pre-installed hardware and software ready to take over operations. Instead, it provides the necessary space and infrastructure for setting up a temporary operational environment, but setting it up could take several days or even weeks.
- Cold StartIn computing, a cold start refers to powering up a device or system from a completely off state, as opposed to a warm start or reboot, which involves restarting the system without interruption to power. In the context of cloud services or big data, it can also refer to the challenge of making accurate recommendations or decisions when there is insufficient data about users or items, commonly faced by recommendation systems.
- Collaborative ComputingThe use of interconnected computer systems and software to allow users to work together, often in real-time, toward a shared goal. This could include tools like shared documents, chat programs, or video conferencing. As collaboration often happens over networks, secure practices are crucial to prevent unauthorized access, data leakage, and other security threats.
- Collection of EvidenceThe process of collecting evidence involves systematically gathering data and information that can help investigate and resolve a security incident or breach. This can include log files, network traffic data, copies of malicious software, or user access records. Proper handling and storage of collected evidence is crucial to maintaining its integrity and usability, especially if it is needed for legal proceedings.
- Collision – CryptographyIn the context of cryptography, a collision refers to an event where two different input values yield the same hash output in a hash function. Such collisions undermine the cryptographic assurance that hash values are unique, thereby challenging data integrity and security. Robust cryptographic systems aim to minimize the likelihood of such occurrences.
- Collision – NetworkingIn computer networking, a collision is an event where multiple data packets transmitted from different devices collide on a network segment. Collisions occur in half-duplex networks, typically Ethernet, leading to packet loss and requiring retransmission. To minimize collisions, collision detection algorithms like CSMA/CD (Carrier Sense Multiple Access with Collision Detection) are employed.
- CollusionA situation where two or more entities (individuals, systems, or processes) unlawfully or maliciously cooperate to deceive or defraud. In terms of security, this could involve users sharing access credentials, systems working together to bypass security protocols, or processes being manipulated to allow unauthorized actions. Preventing collusion is an important aspect of maintaining robust security controls.
- Command control (C&C) serverA computer or network that is used by attackers to remotely control and manage the activities of a network of infected computers, known as a botnet. C&C servers are used to send commands, receive data, and coordinate the activities of the botnet. Examples of C&C servers include DarkComet, Mirai, and TrickBot.
- Command-line Interface (CLI)A user interface that allows users to interact with an operating system or software by typing text-based commands. It can provide a powerful tool for automating tasks, running scripts, or directly interacting with system files. In the hands of a skilled professional, the CLI can be an effective tool for system maintenance and troubleshooting, but it can also be a vector for executing malicious commands if accessed by an unauthorized user.
- Commercial Off-The-Shelf (COTS) SoftwareA pre-packaged software that is readily available for purchase and use by organizations. It is used in businesses and government agencies to reduce the cost and time of software development. Examples include Microsoft Office and Adobe Photoshop.
- Common Access Card (CAC)A type of identification card used by the US government and military to grant access to secure facilities and networks. The card contains a microprocessor chip that can store and transmit digital information, such as biometric data and security credentials. For example, military personnel may use their CAC card to enter a secure base or to log in to a classified network.
- Common Criteria (CC)An international set of guidelines and specifications developed for evaluating information security products, specifically to ensure they meet an agreed-upon security standard for government deployments. It provides a broad range of evaluation criteria for various types of products and systems, and its use can help to ensure a consistent and reliable level of security.
- Common Gateway Interface (CGI)A standard that enables web servers to execute an external program, often a script, to generate dynamic web content. It acts as the interface between the web server and the program that generates the web page content. While CGI scripts can provide powerful functionality, they can also introduce security risks if not properly designed or isolated from sensitive system operations.
- Common Vulnerabilities and Exposures (CVE)A publicly available, free-to-use list of reported vulnerabilities in software and firmware. Each CVE entry includes an identification number, a description, and at least one public reference. Maintained by the MITRE Corporation, CVE provides a standardized method for sharing information about vulnerabilities, allowing organizations to better protect their systems against known issues.
- Common Vulnerability Scoring System (CVSS)A universally open and standardized method for rating IT vulnerabilities. CVSS helps organizations prioritize their responses to system vulnerabilities by offering a calculated score between 0 and 10 based on factors such as the complexity of exploiting a vulnerability, whether it requires local or network access, and what kind of impact it would have if successfully exploited.
- Common Weakness Enumeration (CWE)A community-driven project that maintains a list of software security weaknesses. These weaknesses, identified by common terms and definitions, represent the conditions that lead to software vulnerabilities. By understanding and identifying these weaknesses, organizations, and developers can create more secure software systems and address issues before they lead to exploitable vulnerabilities.
- Common Weakness Scoring System (CWSS)A framework for scoring the severity of software weaknesses listed in CWE based on various factors, including the potential impact of the weakness and the context of the software environment. It helps organizations prioritize software weaknesses to address the most significant risks first.
- Community CloudA shared cloud computing environment where resources are accessible by a specific group of organizations or individuals with shared concerns or objectives. This setup allows for a higher level of privacy, security, or policy compliance than a public cloud while also offering cost savings and resource-sharing advantages of the cloud technology.
- Companion VirusA type of malware that attaches itself to valid executable files on a system. Instead of modifying the original file, it creates a new program with the same name in a different directory. When the user attempts to run the original program, the virus program executes instead, often running the original program afterward to avoid detection.
- CompartmentalizationThe strategic division of various components, resources, or entities within a larger system to limit exposure to threats and minimize potential damage. This separation can be achieved in several ways, such as through physical separation, virtualization, or role-based access controls, ensuring that a compromise in one area doesn’t lead to a breach in others.
- Compartmented ModeIn a compartmented mode setup, users are given access only to the data they require to perform their tasks and nothing else, thereby minimizing the exposure and possible leakage of sensitive information. This is a rigorous application of the principle of least privilege, often used in environments dealing with highly sensitive data, such as military or intelligence operations.
- Compensating controlAlso known as an alternative control, compensating control is a mechanism that is put in place to satisfy the requirement for a security measure that is deemed too difficult or impractical to implement at the moment. While it may not be an exact replacement, a compensating control should provide a similar level of defense against the identified risk, thus maintaining the integrity of the security system.
- CompilerA computer program that translates source code written in a high-level programming language into machine code that can be executed by a computer. It is commonly used in software development to create efficient and optimized programs. Examples include GCC and Microsoft Visual C++.
- Completeness CheckA validation process that ensures all necessary data entries or transaction steps are completed before processing. Completeness checks are vital for maintaining data integrity and the accuracy of operations in various systems.
- Complexity as the enemy of securityThis concept suggests that as a system becomes more complex, it’s harder to maintain its security. Each additional component or feature in a system could potentially introduce new vulnerabilities or make it harder to identify existing ones. Simplifying systems and eliminating unnecessary elements can, therefore, be an effective strategy for enhancing their overall security.
- ComplianceThe process of ensuring that an organization follows relevant laws, regulations, and standards. This includes internal policies and procedures, as well as external requirements such as regulatory standards or contractual obligations. Compliance activities can range from regular audits and checks to training and education programs designed to prevent violations and ensure that all operations align with the expected requirements.
- Compliance DocumentsOfficial documents that evidence an organization’s adherence to regulatory standards, laws, and internal policies. They can include policy manuals, procedural guidelines, audit results, training records, and other records demonstrating regulatory compliance. These documents are often essential in audits or investigations to demonstrate that an organization has met its compliance obligations.
- Compliance Testing or Compliance CheckingThe process of verifying whether systems, processes, and practices conform to established regulations, standards, and policies. Compliance testing is critical for ensuring that organizations meet legal requirements and industry standards, which can include data protection laws and security frameworks.
- ComponentIn the context of system architecture, a component is an individual part that performs a specific function within the larger system. It can refer to hardware elements (like a CPU or a hard drive), software elements (like a module or function), or sub-systems. Components typically interact with other elements within the system and are designed to be interchangeable or replaceable, promoting flexibility and scalability.
- Comprehensive AuditA comprehensive audit is an in-depth review and examination of all aspects of an organization’s operations, systems, and processes to ensure adherence to regulations, policies, and standards. It aims to verify compliance, evaluate risk management effectiveness, and identify areas for improvement.
- Compression VirusesA type of malware that compresses executable files and embeds itself within them. When an infected file is run, the virus is activated and decompresses the original file to try to hide its presence. These viruses can be difficult to detect because they may appear as standard compressed files to users and some antivirus programs.
- CompromiseIn the realm of information security, a compromise refers to a situation where unauthorized access is gained to a system or data, violating the confidentiality, integrity, or availability of the information. This could be due to an external attack, insider threat, or inadvertent actions. The consequences can range from information leakage and system malfunction to financial loss and reputation damage.
- Compromising EmanationsThese are unintended signals or ‘leakage’ that provide information about the data being processed in a system. These emanations could be electrical, thermal, mechanical, or acoustical signals that can be captured and interpreted by unauthorized individuals to extract sensitive data. These can be mitigated by using emission security (EMSEC) measures.
- Computer AbuseAny action that misuses computing resources or uses them in ways that are unethical, illegal, or in violation of an agreement. This can include a broad range of activities, such as unauthorized access, the creation or distribution of malicious software, identity theft, spamming, violation of privacy, and intellectual property theft.
- Computer-Aided Software Engineering (CASE)The use of computer-based tools to support the development, testing, and maintenance of software. It is used to automate and streamline the software development process and to improve the quality and reliability of software. Examples of CASE tools include modeling tools, code generation tools, and testing tools.
- Computer-Assisted Audit Technique (CAAT)A set of tools and techniques used by auditors to analyze an organization’s data with software, improving efficiency and accuracy in audit processes. CAATs include data extraction and analysis tools, which can automate procedures to identify anomalies or patterns in data related to financial statements or compliance.
- Computer Emergency Response Team (CERT)A group of experts that responds to security incidents, especially those involving the Internet. They handle breaches, viruses, and other potential catastrophic incidents in an attempt to minimize damage and recovery time. Their roles may also extend to educating users about potential threats, reporting vulnerabilities, and providing guidance on how to safeguard data and systems.
- Computer ForensicsThe application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computing device and who was responsible.
- Computer Fraud and Abuse Act (CFAA)The CFAA is a US statute that criminalizes unauthorized and improper access to computers and networks. It addresses a range of computer-related offenses, including hacking, unauthorized access to obtain information, causing damage, trafficking in passwords, and more.
- Computer Security Act (CSA) of 1987A United States federal law enacted to improve the security and privacy of sensitive information in federal computer systems and to establish minimum acceptable security practices for such systems. The CSA mandated the establishment of standards and guidelines for federal computer systems and tasked the National Bureau of Standards (now the National Institute of Standards and Technology) with their development and the training of federal computer system users.
- Computer Sequence CheckingThis refers to methods used in computing to verify the sequence and integrity of data transmitted or stored. Techniques such as checksums, sequence numbers, and cyclic redundancy checks (CRC) can detect and correct errors to ensure the data received is in the correct order and unaltered.
- Concealment cipherAlso known as a steganographic cipher, concealment cipher hides the existence of a message within another innocent-looking message. Unlike traditional ciphers, which make it apparent that a message has been encrypted, a concealment cipher’s goal is to prevent an observer from even suspecting that a hidden message exists. This is achieved by embedding the secret information within the ordinary data in such a way that it doesn’t alter the apparent nature of the data.
- Conclusive EvidenceA proof that is so strong and compelling that it effectively eliminates any reasonable doubt about a particular fact or assertion. In the context of digital forensics, it’s the digital data that can be produced in court as an indisputable fact or proof to confirm an event or action. The nature of conclusive evidence is such that it can’t be contradicted or disproved by any other evidence.
- ConcurrencyThe simultaneous execution or handling of multiple operations, tasks, or transactions. In computing, concurrency enables a system to perform various computational processes during overlapping time periods, increasing efficiency, especially in multi-core processors, distributed systems, or networks. It’s a fundamental concept for developing applications that perform several tasks at once, such as web servers and interactive applications. Concurrency mechanisms manage access to shared resources to avoid conflicting actions and data inconsistencies.
- Concurrency ControlA process in databases and software systems that ensures data integrity and consistency when multiple users access or modify data simultaneously. Concurrency control mechanisms prevent conflicting changes and maintain database transaction accuracy.
- Condition monitoringThe continuous monitoring of a system or component to assess its current state and predict when it may fail. This is often used in the field of cloud computing to ensure that servers and other infrastructure are operating optimally and to prevent downtime. Examples include monitoring the temperature and humidity of a server room or using predictive maintenance software to identify potential hardware failures.
- ConfidentialityA fundamental principle of information security that mandates restricting access to information to authorized users only. It’s about ensuring that sensitive information is not disclosed to unauthorized individuals or entities. Confidentiality measures include the use of passwords, encryption, access control lists, and security policies that define who can access what data and under which circumstances. It is the C of the CIA triad.
- Configurable controlA feature or setting within a system or application that can be adjusted to enhance control over the operating environment. This can include anything from user permissions to data access controls, all aimed at managing risk and safeguarding the system or data within it.
- Configuration controlA practice aimed at maintaining consistency of a system or component’s performance, functional, and physical attributes with its requirements, design, and operational information throughout its life. It involves processes such as identifying configurations, controlling changes, and ensuring that configurations conform to applicable standards and requirements, thus helping avoid unnecessary modifications and maintaining system reliability.
- Configuration item (CI)A component of a system that is subject to configuration management. This could be a piece of hardware, a software module, a network configuration, or any other part of a system that requires monitoring and management for changes. CIs are individually identifiable and manageable, and their status is maintained and updated throughout their lifecycle.
- Configuration ManagementA systems engineering process for establishing and maintaining consistency of a product’s performance, functional, and physical attributes with its requirements, design, and operational information throughout its life. This process helps identify and manage changes to the system in a controlled manner, ensuring system integrity over time.
- Configuration Management Database (CMDB)A database that holds information about the components of an information system and the relationships between those components. Used in IT service management, a CMDB helps organizations understand the relationships between these components and track their configuration. It is a fundamental part of the ITIL framework for managing IT services.
- Confusion in Ciphertext from CryptographyA property of cryptographic algorithms that aims to obscure the relationship between the key and the ciphertext, making it difficult for an attacker to deduce any meaningful patterns or information. The concept of confusion was introduced by Claude Shannon to ensure that each bit of the ciphertext should depend on several parts of the key, creating a complex and non-obvious relationship. This is typically achieved through substitution algorithms and other complex transformations. Confusion adds to the security of encryption schemes by making them more resistant to cryptanalysis and brute-force attacks.
- ConnectionlessA type of network communication where data packets are sent from one device to another without establishing a dedicated connection, allowing for quick data transmission. However, packets may arrive out of order or get lost, as there is no assurance of delivery, making it less reliable than connection-oriented services.
- Connection-orientedA network communication type that establishes a dedicated connection path before data is transmitted. This ensures reliable and ordered delivery of packets from sender to receiver. Protocols like TCP use a connection-oriented approach to guarantee that data is received accurately and completely.
- Console logA record of events or activities that have occurred within an operating system or software interface. They are instrumental in monitoring system behavior and troubleshooting issues. Console logs capture details such as error messages, system status updates, user activities, or program execution details, which can be reviewed for diagnostic and auditing purposes.
- Constrained Data Item (CDI)A Constrained Data Item (CDI) refers to any data within a secure environment that is subject to access or handling restrictions based on security policies or regulatory requirements. Proper control and oversight are necessary to ensure that CDs are not improperly altered, disclosed, or destroyed, thereby mitigating potential risks associated with sensitive or classified information.
- Constraint-based/logic programmingA type of programming paradigm that uses logical constraints and rules to represent and solve problems. It is often used for tasks such as optimization, scheduling, and planning, as well as for artificial intelligence and expert systems. Examples of constraint-based programming languages include Prolog and Mercury.
- Construct a Platform for Risk Analysis of Security Critical Systems (CORAS)A model-driven method for conducting security risk analysis. CORAS offers a customized language for threat and risk modeling and comes with detailed guidelines explaining each step of the risk analysis process. It includes tools that support the execution of these steps, as well as libraries for documenting and reusing common types of threats, vulnerabilities, and treatments. The CORAS method is particularly designed for precise, unambiguous, and efficient risk modeling of security-critical systems and is often used in industries that demand a high level of security assurance.
- ConsumerizationThe influence that consumer-originated technologies and preferences are exerting on broader business and organizational contexts. In many cases, these consumer technologies are being adopted by businesses due to their ease of use, convenience, or innovative features. However, it poses certain challenges in terms of ensuring security and control over business data and processes, as the boundary between personal and professional technology use blurs.
- Contact alarmsAlarms that are triggered by the activation of a contact device. They are commonly used in security systems to alert individuals or authorities of an unauthorized entry or attempted entry. Examples include alarm systems that are triggered by the opening of a door or window, pressure mats that trigger an alarm when stepped on, or touch-sensitive pads that trigger an alarm when touched.
- ContainerizationA lightweight form of virtualization that allows for the packaging and isolation of applications with their entire runtime environment—all of the necessary code, system tools, libraries, and settings included. This encapsulation ensures that the application works uniformly and consistently across different computing environments. Containers are more portable and use fewer resources than traditional hardware-based or full-machine virtualization approaches, such as virtual machines (VMs) because they share the host system’s kernel rather than requiring their own operating system. This technology is widely used to streamline and simplify the deployment of applications, enhance scalability, and improve security by isolating applications from each other and the underlying infrastructure.
- ContainmentIn a security context, containment refers to the strategies and actions taken to prevent the spread of a threat, such as a malware infection or a security breach, within a system or network. It helps in minimizing damage by isolating affected areas, thus preventing further compromise of data or resources.
- ContaminationIn the context of security, contamination refers to the unintentional introduction or infiltration of unwanted elements, such as malware or erroneous data, into a system or network. This can lead to data corruption, system disruption, or other adverse effects that may compromise the integrity and reliability of the system.
- Content-based access control (CBAC)A security approach where access to information is granted or denied based on the content within the data objects rather than solely based on user credentials or roles. This method is useful for managing access to classified or sensitive information, ensuring that only content that a user is authorized to view can be accessed.
- Content Distribution Network (CDN)A geographically distributed network of servers and data centers that work together to provide fast delivery of internet content. By caching content at the network edge, closest to users, it minimizes latency and accelerates site load times, making it particularly useful for handling heavy content such as video or during traffic spikes.
- Content FilteringThe practice of blocking or allowing content based on specific criteria to enhance user safety, improve network efficiency, or comply with company policies. It is commonly used in email systems to filter out spam or malicious emails and in web filters to restrict access to inappropriate or harmful websites.
- Content inspectionAn in-depth analysis method used to examine data, such as emails, web pages, or files, to detect threats that might not be noticed by traditional defense mechanisms. This involves looking beyond just the metadata and examining the actual content for potentially harmful substances, like malware or violations of policy guidelines.
- Contention-Based ProtocolsNetwork protocols that allow multiple devices to access the network medium in a manner where conflicts could occur. If two or more devices try to transmit data at the same time, a collision can occur, causing the data to become corrupt. Protocols like CSMA/CD (Carrier Sense Multiple Access/Collision Detection) used in Ethernet networks are examples of contention-based protocols.
- ContextIn terms of security, context refers to the understanding of the surrounding factors, environment, and circumstances that are relevant to a decision, action, or event. Context can involve various data points such as user behavior, network activity, or system configurations, which, when analyzed collectively, can provide more accurate insights or trigger alerts if anomalies are detected.
- Context-aware access controlA security approach that evaluates the context of a user’s access request — such as location, time, and device security state — before granting or denying permission. This dynamic form of access control can adjust the level of access based on situational factors, enhancing security by adapting to potential risk changes.
- Contingency keyThis is a cryptographic key used for emergency purposes when normal operations are disrupted. The contingency key may be used to regain access to an encrypted system or data if the original key is lost, compromised, or unavailable. It should be securely stored and managed due to its high importance for business continuity and crisis management.
- Contingency PlanningThe process of developing preparedness for potential emergencies or unexpected situations that can disrupt normal operations. It involves identifying critical functions, assessing risks, and establishing procedures to ensure business continuity and recovery. Contingency plans aim to minimize impact and guide rapid and effective responses to incidents such as natural disasters, cyber-attacks, or equipment failures.
- ContinuityThe unbroken and consistent existence or operation of something over a period of time. In a security context, it usually relates to business continuity, which emphasizes maintaining essential functions during and after a disaster has occurred. The goal is to ensure the organization’s ability to perform its mission, regardless of the disruptive circumstances or events.
- Continuity Of Operations (COOP)A set of protocols and planning efforts to ensure that an organization’s essential functions can continue during and after a disaster or disruption. COOP planning involves identifying vital services and procedures that must be maintained, creating strategies for recovery, and regularly testing and updating the plan to ensure effectiveness in a variety of emergency scenarios.
- Continuous auditing approachA systematic and ongoing process of evaluating and monitoring an organization’s financial and operational activities. This approach allows for regular and frequent assessments of internal controls, processes, and risks. Examples of continuous auditing include real-time monitoring of financial transactions, regular audits of key business processes, and ongoing risk assessments.
- Continuous AvailabilityA state where an organization’s services or systems are designed in such a way that they remain accessible at all times, without any interruption or downtime. This involves strategies like redundancy, fault tolerance, and high availability, ensuring seamless operation even during maintenance or in case of failures.
- Continuous Delivery/Deployment (CD)A software development practice where changes to code, such as new features, bug fixes, and configuration changes, are built, tested, and prepared for release in an automated and efficient manner. This approach aims to make releases painless and low-risk events that can be performed at any time, on demand, ensuring the rapid and reliable delivery of software.
- Continuous Full-Cycle TestingA testing practice that continually evaluates software throughout its development life cycle, from initial design to final release. This approach helps catch and address issues early, reduce the risk of software failures, and ensure that the final product meets quality and security standards.
- Continuous ImprovementAn ongoing effort to incrementally enhance procedures, products, or services. The objective is to achieve higher efficiency and quality by eliminating waste, reducing delays, and improving the current methodologies. It’s a key component of many methodologies, where regular assessments lead to small enhancements that cumulate into significant improvements over time.
- Continuous Integration (CI)A software development practice where developers regularly merge their changes into a central repository, after which automated builds and tests are run. The main goals of CI are to find and address bugs quicker, improve software quality, and reduce the time it takes to validate and release new software updates.
- Continuous Integration/Continuous Delivery (CI/CD)Software development practices that automate the integration of code changes into a repository and the delivery or deployment of applications to production environments. CI/CD streamlines the development process, reduces the time to release, and enhances the reliability of software releases.
- Continuous monitoringA risk management approach that involves real-time assessment and reporting of operational activities. It is an ongoing process of collecting, analyzing, and reporting operational data to identify anomalies or security incidents. Continuous monitoring provides transparency into organizational activities and enhances the ability to respond rapidly to potential threats or breaches.
- ControlIn the context of information security, a control is a safeguard or countermeasure designed to detect, prevent, or mitigate potential risks to a system or process. Controls can be administrative (e.g., policies and training), technical (e.g., encryption and access controls), or physical (e.g., locks and guards) and are implemented to ensure the confidentiality, integrity, and availability of data.
- Control AssessmentsProcesses for evaluating the effectiveness and compliance of controls implemented within an organization. They involve thorough testing and analysis of controls to verify they are functioning as intended, adequately mitigating risk, and compliant with relevant regulations and standards.
- Control CategoriesIn cybersecurity and risk management, classify controls into several types based on their purposes and effects within an organization’s security posture. They include Preventive Controls to stop incidents before they happen. Detective Controls for identifying and detecting issues when they occur. Corrective Controls to resolve issues after they’ve been detected. Deterrent Controls discourage potential security violations. Compensating Controls are alternative mechanisms when primary controls are not viable.
- Control CenterA central location where an organization’s security and operational controls are monitored and managed. Often equipped with software tools for real-time monitoring and analysis, a control center plays a critical role in identifying, assessing, and responding to potential security incidents. It enables swift actions, ensuring system stability and minimizing the impact of any disruptions.
- Control FrameworkA structured set of guidelines that details an organization’s processes for maintaining a certain level of risk management and control over its systems and data. It provides a standardized approach to identifying, managing, and reducing risks, often encompassing a blend of policies, procedures, and technology measures.
- Controlled Access AreaA designated region, either physical or digital, where access is strictly regulated and monitored to ensure only authorized personnel can enter. In a physical setting, this could be a room housing sensitive data storage devices, while in a digital scenario, it might refer to certain parts of a network or database.
- Controlled access protectionA policy or a system that provides a method of restricting access to resources based on the identification and authentication of users or systems. It uses a combination of access controls, user rights, and permissions to protect resources against unauthorized use and to prevent users from performing actions outside their permitted scope.
- Control objectiveA desired outcome or end result that is established to guide the design and implementation of controls. It is used in the development of a control framework to ensure that controls are aligned with the organization’s goals and objectives. For example, a control objective for an e-commerce website might be to ensure the confidentiality of customer data, or for a manufacturing company, it could be to prevent unauthorized access to production processes.
- Control PerimeterThe boundary within which security controls are enforced to protect assets. The perimeter can be physical or virtual and is often established through measures such as firewalls, access control lists, or even physical barriers like walls or locked doors. It is a critical concept in risk management, delineating areas of responsibility and defining where protective measures are implemented.
- Control PracticeThe implementation and execution of specific actions, activities, or procedures designed to meet control objectives. It serves as a concrete step in reducing risks, ensuring compliance, or improving operational efficiency. Examples can range from password policies to network monitoring procedures or regular security audits.
- Control RiskControl risk refers to the likelihood that the design or operational effectiveness of controls may fail to prevent or detect and correct errors or fraud. In information security, it is the risk of failure or inadequacy of the security measures in place, potentially leading to data breaches or other security incidents that compromise the CIA (Confidentiality, Integrity, and Availability) of the organization’s information.
- Control Risk Self-AssessmentAn organization’s personnel evaluate the potential threats and vulnerabilities in their area of responsibility. Employees and management participate in identifying and evaluating the effectiveness of controls designed to mitigate risks. This form of self-assessment enhances understanding of potential risks, promotes ownership, and encourages more active involvement in designing and implementing relevant controls.
- Controls GapThe difference between the current state of a system’s controls and the desired or necessary state. This gap can expose an organization to vulnerabilities if not properly addressed, so identifying and mitigating control gaps is a key part of risk management and maintaining secure operations.
- Control UnitA component of the central processing unit (CPU) in a computer that directs the operation of the processor. It controls the flow of data within the CPU and between the CPU and other components of the computer by coordinating and executing instruction sequences, managing the timing of operations, and interpreting the computer’s program instructions. Essentially, it acts as the ‘traffic cop’ for data and instructions within the computer system.
- Control WeaknessA deficiency in internal controls, which are processes and procedures intended to prevent or detect problems. It indicates a point where an organization’s controls are not strong or comprehensive enough to prevent or detect errors, fraud, or non-compliance with policies or regulations. Control weaknesses increase the risk of undesirable outcomes and can lead to financial loss, reputational damage, or regulatory action. Identifying and addressing control weaknesses is a critical part of risk management and corporate governance.
- ConvergenceThe process where different technologies, systems, or services come together and interoperate, leading to new forms or unified experiences. In IT, it often refers to the blending of telecommunications, computing, and broadcasting into integrated solutions. Convergence is also seen in devices like smartphones, which combine phone service, internet access, and multimedia capabilities.
- Convergence in routingIn the context of network routing protocols, convergence refers to the state where all routers within a network have a consistent view of the network topology. This uniform understanding enables routers to properly direct packets to their destination without routing loops or inconsistencies. Convergence time is crucial in dynamic networks where changes occur frequently, and it’s the period it takes for all routers to learn about the changes and reach a state of agreement. Protocols such as OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol) have mechanisms to achieve convergence efficiently and maintain an accurate and stable routing environment within and between networks. Converged networks can lead to more efficient resource utilization and improved communication performance.
- CookieA small piece of data sent from a website and stored on the user’s computer by the web browser while the user is browsing. Cookies are designed to be a reliable mechanism for websites to remember stateful information or to record the user’s browsing activity. They can also be used for remembering pieces of information that the user previously entered into form fields, such as names, addresses, passwords, and credit card numbers.
- CopyrightCopyright is a legal right granted to the creators of original works, including various types of creative, literary, and intellectual productions. It provides the creator with exclusive rights over the use of their work for a specific period, typically the life of the author plus a fixed number of years after their death, varying by country. For corporations or works made for hire, copyright may last 95 to 120 years from the date of creation or 70 years after the author’s death in the US. Upon expiration, the work becomes part of the public domain.
- Corporate GovernanceThe system of rules, practices, and processes by which a company is directed and controlled. It involves balancing the interests of a company’s many stakeholders, such as shareholders, management, customers, suppliers, financiers, government, and the community. Good corporate governance ensures accountability, fairness, and transparency in a company’s relationship with all its stakeholders. It provides the framework within which the objectives of the company are set, and the means of attaining those objectives and monitoring performance are determined.
- Corporate security officerAn executive role within an organization responsible for overseeing all aspects of security, including physical security, personal security, and digital security. This role often involves creating and implementing security strategies, managing security personnel, coordinating with other executives and stakeholders, and responding to security incidents.
- Corrective ControlA type of internal control mechanism designed to rectify and mitigate the impact of identified problems or incidents after they occur. Corrective controls include activities and procedures that are implemented to address and correct the undesirable outcomes of an event, such as restoring systems to their normal state after a security breach, repairing damages, and updating processes to prevent future occurrences. These controls are reactive by nature, focusing on response and recovery.
- CorrelationThe relationship between two or more variables, such as the relationship between a security incident and a potential vulnerability. It is used in security analysis to identify patterns and connections between different data sets. Examples include using correlation to link network traffic to a specific user or to identify a trend in phishing attacks.
- COSO (Committee of Sponsoring Organizations of the Treadway Commission)A widely accepted framework for designing and implementing internal controls in business organizations. The COSO framework addresses organizational governance, risk management, and business ethics and has become a globally recognized standard for managing and controlling risk in various domains.
- Cost/benefit analysisA decision-making process often used in business and organizational settings to determine the feasibility and value of a proposed action or solution. It involves a thorough evaluation of the expected costs and potential benefits of an initiative. In the context of risk management, a cost/benefit analysis might be used to weigh the investment in security measures against the potential losses from security incidents.
- Counter (CTR) ModeAn encryption mode that transforms a block cipher into a stream cipher. It operates by encrypting successive values of a “counter” and then XORing the output with the plaintext to produce the ciphertext. The counter value is incremented for each subsequent block, ensuring a unique sequence for each encryption. This mode allows for random access to encrypted data blocks and can provide high levels of security when implemented correctly.
- CountermeasureA tactic, procedure, or technique that is applied to prevent, mitigate, or eliminate vulnerabilities, threats, or attacks. This could be a wide range of actions, such as installing a firewall to block unauthorized access, implementing encryption algorithms to secure data, or deploying intrusion detection systems to identify potential security breaches. Countermeasures are crucial for maintaining the confidentiality, integrity, and availability of data and systems.
- Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)A security protocol used in wireless networks to encrypt data and ensure its authenticity. It is a combination of the AES encryption algorithm and the CCM mode of operation, which provides both confidentiality and integrity for data transmitted over a wireless network.
- CouplingIn the context of software design, coupling refers to the degree to which one module or component depends on another. High coupling indicates that a change in one module may require changes in other modules, while low coupling allows for a more modular and independent design.
- Covert ChannelA communication channel that enables information transfer in a way that violates security policies, typically by using mechanisms that were not originally intended for communication. This can include using system properties or resources (like processor usage or file modification times) to covertly transmit information, enabling entities to communicate surreptitiously without detection.
- Covert Channel AnalysisThe process of examining systems to identify and mitigate covert channels. This process involves reviewing system design and operations to uncover unintended communication paths that could be exploited for unauthorized information transfer. It’s a crucial component of comprehensive security audits and assessments, particularly in high-security environments.
- Covert storage channelA type of concealed pathway that facilitates unauthorized data transmission by modifying a system’s stored data. The subtle alterations in this data, such as changes in file sizes or timestamps, can be exploited to encode and transmit information in a manner that’s difficult to detect.
- Covert timing channelA surreptitious communication pathway that conveys information by manipulating the timing of events, such as process execution or network packet delivery. By varying these timing characteristics in a controlled manner, an entity can transmit data to a receiving entity that’s observing the same timings, all without arousing suspicion.
- CrackTo bypass or break through security measures of software or systems, often to gain unauthorized access, crack encrypted data, or illegally copy or use software. Cracking compromises the security and integrity of digital assets and is considered a cybercrime.
- Credentialed AnalysisIn cybersecurity, this refers to a scanning or analysis process where the security tools are provided with authorized access credentials to perform a more thorough examination of the system. By using credentials to log in, the tools can evaluate the system as an authenticated user, allowing for a deeper and more accurate assessment of configurations, software, permissions, and other security controls that may not be visible or accessible to non-credentialed scanning. This can provide a comprehensive picture of system vulnerabilities, compliance with policies, and potential security risks.
- Credential ManagementThe process of creating, storing, managing, and updating user credentials such as usernames, passwords, and personal identification numbers (PINs), as well as digital certificates and keys. Effective credential management is crucial in maintaining security and controlling access to sensitive systems and data. It encompasses practices such as enforcing password complexity requirements, implementing regular password rotations, and using multi-factor authentication to enhance security. Good credential management also involves monitoring for compromised credentials and ensuring that access rights are revoked when no longer required, such as when an employee leaves an organization.
- CredentialsInformation used to verify the identity of a user or system within a digital environment. Credentials, such as usernames and passwords or digital certificates, are essential for authentication processes to access computer systems or networks.
- Credential Service Provider (CSP)An entity that issues digital credentials for the purpose of authenticating users to a network or service. A CSP validates the identity of individuals or entities and then issues credentials such as usernames, passwords, tokens, certificates, or biometric data, enabling them to prove their identity electronically. CSPs play a key role in establishing trust within digital environments by ensuring that the parties in a transaction are who they claim to be.
- Crime Prevention Through Environmental Design (CPTED)A multi-disciplinary approach to deter criminal behavior through environmental design. It posits that the proper design and effective use of a physical environment can reduce the incidence and fear of crime, thereby improving the quality of life. This concept can be extended to digital environments as well, where careful design can prevent unauthorized access and deter cybercrimes.
- CriteriaIn the context of system evaluation, criteria refer to the benchmarks or standards used to assess the efficiency and effectiveness of security measures within a system. They serve as the basis for forming judgments and making decisions regarding the state of security controls and their ability to mitigate potential threats.
- Critical FunctionsThe fundamental tasks or processes of a system or organization that, if interrupted or failed, would significantly impact operational continuity, assets, and human safety. The protection and continual operation of critical functions is a primary focus of security strategies.
- Critical InfrastructuresThe physical and virtual systems and assets that are so vital to society that their incapacitation or destruction would have a debilitating impact on security, economic security, public health, or safety. This could include utilities like electricity and water, financial services, and communication networks, all of which need robust protection mechanisms to prevent interruption.
- CriticalityThe state or quality of being critical or essential to the success of an organization’s security program. It is used to identify the most important areas to focus on in order to prevent or mitigate potential security breaches. Examples of critical security areas include sensitive data storage and access, network security, and access control.
- Criticality AnalysisA method used to identify and evaluate the critical components, systems, or processes that could cause significant disruptions if they fail. It involves assessing the potential consequences of each failure and devising plans to mitigate these risks. Criticality analysis helps organizations prioritize their resources and protection strategies according to the potential impact of a security incident.
- Critical PathIn project management and planning, the critical path refers to the sequence of tasks that must be completed on time for a project to finish on schedule. Each task on the critical path is a critical task. Any delay in these tasks can potentially affect the overall project timeline, meaning these tasks require special attention and optimal allocation of resources.
- Critical Success Factor (CSF)The essential elements that an organization must achieve to fulfill its mission and reach its objectives. In terms of security, CSFs might include robust risk management, strong access controls, and an educated workforce, among others. A failure in any CSF could lead to serious implications for the security and integrity of systems or data.
- Cross-certificationA process where two or more certification authorities (CA) mutually exchange and recognize their certificates. This is used to establish trust between different certification authorities and to allow them to exchange encrypted information securely. Examples of this include a CA in the US recognizing a CA in Europe or a government CA recognizing a private CA.
- Cross Domain SolutionA technology that allows the transfer of data between networks with different security levels while ensuring that security policies for each network are not violated. It ensures the secure sharing of information across different security domains, preventing unauthorized access and data leakage, and is often used in organizations dealing with highly sensitive data across various clearance levels.
- Crossover Error Rate (CER)In biometrics, the Crossover Error Rate (CER) is a critical performance metric that represents the point at which the False Acceptance Rate (FAR), the measure of the likelihood that the system incorrectly grants access to an unauthorized user, equals the False Rejection Rate (FRR), the measure of the likelihood of the system incorrectly denying access to an authorized user. The CER is used to compare the accuracy of biometric systems; the lower the CER, the higher the system’s accuracy. It provides a balanced benchmark by showing how the tradeoff between security and convenience is managed by the system. A system with a high CER might be more user-friendly but less secure, and vice versa.
- Cross-Site Request Forgery (XSRF)A cyber-attack that tricks a web browser into executing an unwanted action in a web application to which a user is logged in. It exploits the trust that a site has for the user’s browser, potentially leading to actions like changing user settings, posting content without consent, or initiating transactions. Security measures against XSRF include anti-forgery tokens and same-origin policies.
- Cross-Site Scripting (XSS)A type of security vulnerability that targets web applications, XSS enables attackers to inject malicious scripts into webpages viewed by other users. By exploiting the trust a user has for a particular site, these scripts can access any cookies, session tokens, or other sensitive information retained by the user’s browser related to that site, potentially leading to unauthorized actions.
- CrosstalkAn electromagnetic interference phenomenon where a signal transmitted on one circuit or channel creates an unwanted effect on another circuit or channel. In telecommunications and networking, crosstalk can lead to degradation of signal quality, resulting in communication errors or loss of data. It is more prevalent in older or improperly shielded cables and is a significant consideration in the design of high-speed data communication systems. Measures such as using twisted pair cables or proper cable management practices are employed to minimize crosstalk.
- CryptanalysisThe study and practice of examining and breaking cryptographic systems, understanding how they work, and finding methods to defeat or weaken them. It involves analyzing the encrypted data (ciphertext) to discover the hidden structures and derive the original information (plaintext) without necessarily having access to the secret key used. Cryptanalysis is used both for academic research to test the strength of encryption algorithms and by adversaries to compromise security systems. It encompasses a variety of techniques, such as frequency analysis, pattern detection, brute force attacks, and more sophisticated mathematical approaches.
- Crypto-equipmentHardware or software designed specifically to perform cryptographic operations, such as encryption, decryption, digital signing, or key generation. Crypto-equipment safeguards sensitive information by transforming it into a secure form for transmission or storage, and it’s commonly used in secure communication systems, data protection solutions, and other security applications. Examples include hardware security modules (HSMs), encrypted hard drives, and secure mobile phones.
- Cryptographic AlgorithmA set of mathematical procedures or rules that are used in the processes of encryption and decryption. Algorithms like RSA, AES, and DES work by transforming data into an unreadable format, making it secure from unauthorized access and preserving data integrity and confidentiality during transmission or storage.
- Cryptographic ComponentAn integral part of a cryptographic system that performs a specific function related to encryption or decryption processes. These components can include algorithms, key generators, or hash functions. The secure functioning of a cryptographic system heavily depends on the reliability and robustness of these components.
- Cryptographic erasureA method of ensuring that information on a storage device is irretrievable. It involves using a cryptographic algorithm to overwrite data with a key that is subsequently destroyed. Since the key is required to decrypt the data, its destruction essentially renders the data permanently inaccessible. This is a particularly effective method of data sanitization when the physical destruction of storage devices isn’t possible or desirable.
- Cryptographic InitializationThe process of setting up a cryptographic system or component before it can be used securely. The process typically involves the generation and installation of cryptographic keys. Initialization ensures that the system has a secure starting state from which it can operate and often includes steps to ensure the secure generation, distribution, and storage of keys.
- Cryptographic lifecycleThe stages that cryptographic key materials go through during their existence, including creation, distribution, usage, storage, archival, and destruction. Managing this lifecycle is critical to maintaining the integrity and security of a cryptographic system. Each stage presents unique security challenges and requires appropriate controls to prevent unauthorized access or compromise.
- Cryptographic logicThe mathematical logic employed in the design and analysis of cryptographic algorithms and systems. It’s a field that focuses on providing formal proofs for the security properties of cryptographic protocols and mechanisms. Such formal proofs play a crucial role in validating the security of cryptographic systems against potential threats.
- Cryptographic RandomizationThe process of generating randomness that is used within cryptographic algorithms and protocols. It ensures unpredictability in keys, nonces, salts, and other values critical to secure encryption and other cryptographic operations. Good cryptographic randomization prevents attackers from guessing or reproducing the values, which would compromise security. It typically relies on sources of high entropy and algorithms known as cryptographic pseudo-random number generators (CSPRNGs).
- CryptographyThe science and practice of secure communication in the presence of third parties called adversaries. It involves creating written or generated codes that allow information to be kept secret. Cryptography encompasses various techniques such as encryption (scrambling data so it’s unreadable without a key), decryption (making the scrambled data readable again with the correct key), hash functions (transforming data into fixed-size strings of characters), and digital signatures (verifying the sender’s identity and the integrity of the data). It’s essential for securing transactions, communications, and data in many fields, including finance, telecommunications, and national security.
- CryptologyThe study of codes and ciphers, which encompasses both cryptography (creating codes and ciphers to keep information secure) and cryptanalysis (breaking them to access the information). Cryptology is a branch of mathematics and computer science that deals with the principles and techniques of translating readable data into secure forms and vice versa. It’s fundamental to various aspects of information security, from secure online transactions to confidential communications and beyond.
- CryptoprocessorA dedicated microprocessor designed specifically to handle cryptographic operations, such as creating digital signatures and managing keys securely. These processors are often embedded in hardware devices and provide an extra layer of security, protecting sensitive data even if the system’s main processor is compromised. They are often found in applications requiring high levels of information security, such as ATM cards and smart cards.
- CryptosystemA suite of cryptographic algorithms and protocols designed to secure communication and data by providing confidentiality, data integrity, authentication, and non-repudiation. A cryptosystem facilitates secure data storage and transmission in various IT applications.
- CSPs (Cloud Service Providers)Companies that offer a range of cloud computing services, including infrastructure, platforms, or software that are accessible to customers via the Internet. CSPs manage and operate these services, which can be scaled to user demands and typically work on a subscription or pay-per-use model. They offer the benefits of cost savings, scalability, and accessibility without the need for customers to own, manage, or maintain the physical infrastructure.
- CSR (Certificate Signing Request)A request for a certificate authority (CA) to issue a digital certificate for a specific entity or purpose. It is used in public key infrastructure (PKI) to authenticate the identity of a person or organization and establish trust for secure communication and transactions. Examples of CSRs include requesting an SSL/TLS certificate for a website or an email signing certificate for an individual.
- CustodianIn the context of information security, a custodian is an individual or organization responsible for safeguarding data or an asset, ensuring its confidentiality, integrity, and availability. They are typically tasked with implementing the policies and procedures established by the data owners and maintaining the technical environment to secure the information. They may handle tasks such as performing regular backups, applying necessary security patches, and managing access controls.
- Customer Relationship Management (CRM)A strategic approach that focuses on managing an organization’s interactions with its customers and potential customers. It uses data analysis about a customer’s history with a company to improve business relationships, primarily focusing on retaining customers and driving sales growth. CRM systems also maintain a robust layer of security to protect sensitive customer data from potential threats or breaches.
- CybercrimesIllegal activities conducted through the Internet or other forms of digital communication. These crimes include hacking, identity theft, phishing scams, online fraud, the distribution of child exploitation material, cyberstalking, and the unauthorized access to or manipulation of systems, networks, and data. Cybercrimes are a growing concern for individuals, corporations, and governments, as they can lead to significant financial losses, privacy violations, and threats to digital infrastructure. Efforts to combat cybercrimes involve legal, technical, and educational measures.
- CyberespionageThe practice of using covert techniques and technologies to illicitly access, steal, or destroy an adversary’s sensitive information or intellectual property for strategic, military, or competitive advantage. This activity is typically carried out by highly skilled individuals or groups and can target a range of entities, including governments, corporations, or individuals.
- CybersecurityThe practice of protecting computer systems, networks, devices, and data from unauthorized access, theft, damage, or other forms of cyber-attack. It encompasses a wide range of techniques, technologies, and processes designed to safeguard the integrity, confidentiality, and availability of information. Cybersecurity is critical in managing and mitigating risks related to the use and storage of digital information and is crucial for both individuals and organizations in our increasingly networked world.
- Cybersecurity ArchitectureThe design and framework that outlines the structure and behavior of an organization’s security processes, information security systems, personnel, and technologies. It provides a roadmap and strategic context for deploying the right technologies and processes to protect the organization’s digital assets and operations. Effective cybersecurity architecture ensures that security controls are integrated into every layer of the technology stack, from the network perimeter to end-user devices, helping to defend against threats and maintain regulatory compliance.
- Cybersecurity Maturity Model Certification (CMMC)A certification process established by the United States Department of Defense (DoD) to certify the cybersecurity readiness of defense contractors. CMMC was designed to protect sensitive, unclassified information that is shared by the DoD with its contractors and subcontractors. The model encompasses several maturity levels that reflect the extent to which cybersecurity practices and processes are established, institutionalized, and consistent within an organization. Contractors must meet the appropriate level of CMMC certification to be eligible for new DoD contracts. Examples of organizations that have obtained CMMC certification include Lockheed Martin and Raytheon.
- CyberwarfareThe use or targeting of computers and networks in warfare or conflict, where state actors and associated groups engage in cyber activities to attack, infiltrate, and sabotage the digital infrastructure of other nations, organizations, or individuals. It includes operations that can disrupt critical systems, steal classified information, interfere with decision-making processes, and affect the physical infrastructure through cyber means. Cyberwarfare presents a complex threat landscape, often blurring the lines between civilian and military targets and posing significant challenges to international law and security. It’s an integral part of modern military strategy, with nations actively developing defensive and offensive cyber capabilities.
- Cyclic Redundancy Check (CRC)A method used to detect errors in digital data. It involves applying a mathematical algorithm to the data to produce a CRC value, which acts as a checksum. When data is transmitted or stored and then retrieved, a new CRC value is calculated and compared to the original. If the two values do not match, it indicates that an error has occurred in the data. CRC is a common technique for ensuring the integrity of data in computer networks, storage devices, and error-checking protocols.
- Damage EvaluationA process used to assess the extent and impact of harm caused by an event, such as a cyber-attack, natural disaster, or accident. In a cybersecurity context, this involves analyzing the consequences of a breach or attack, determining which assets were compromised, and estimating the associated costs and operational impacts. It includes identifying data loss, service disruptions, financial implications, and reputational damage. A thorough damage evaluation is crucial for developing an effective recovery plan and mitigating future risks.
- DashboardIn a broad operational sense, a dashboard is a visual display that aggregates and simplifies key information and metrics about the system’s operation. In a security context, dashboards are often employed to provide a consolidated view of the organization’s security posture, presenting important metrics such as ongoing threats, vulnerabilities, incidents, and overall system health.
- Data AggregationThe process of collecting and summarizing information from multiple sources to achieve a consolidated view. Often used in data analytics, business intelligence, and reporting, it allows for more informed decision-making by presenting a comprehensive picture of collected data for analysis. Aggregation can involve compiling detailed data into summary form, computing sums, averages, counts, or other metrics that provide insight into trends, patterns, or performance across datasets.
- Data AnalysisThe process of inspecting, cleansing, transforming, and modeling data with the objective of discovering useful information, informing conclusions, and supporting decision-making. Data analysis has multiple facets and approaches, encompassing diverse techniques under various names in different business, science, and social science domains. It typically involves removing noise or inconsistencies from data to highlight meaningful trends and patterns, which can then be used to make informed predictions, decisions, and hypotheses in various areas such as market research, business intelligence, and operational efficiency.
- Data at RestRefers to inactive data that is stored physically in any digital form, such as databases, data warehouses, spreadsheets, archives, tapes, or off-site backups. It contrasts with data in transit or data in use. Protecting data at rest typically involves encryption and access controls to mitigate the risk of unauthorized access or data breaches.
- DatabaseA structured set of data. It’s a collection of schemas, tables, queries, reports, views, and other objects used to manage and organize information efficiently. Databases are essential in many environments as they provide an efficient way to store, retrieve and manipulate data, and can be protected by various security measures like encryption and access controls.
- Database Activity Monitoring (DAM)A security technology that continuously monitors, records, and analyzes database activity in real-time. DAM is used to detect and prevent unauthorized or malicious actions within databases, alerting security teams to potential threats or policy violations. This technology helps in ensuring database security, compliance with data protection regulations, and operational integrity of database environments. DAM solutions typically provide functionalities such as real-time monitoring, alert generation, transaction log analysis, and automated response mechanisms.
- Database Administrator (DBA)A professional responsible for the installation, configuration, upgrade, administration, monitoring, and maintenance of databases in an organization. The DBA ensures data availability, security, and integrity and is often involved in disaster recovery, performance analysis, and optimization, along with managing database access roles and permissions.
- Database Management System (DBMS)A software system that uses a standard method of cataloging, retrieving, and running queries on data. The DBMS manages incoming data, organizes it, and provides ways for the data to be modified or extracted by users or other programs. DBMSs are a crucial tool for handling large amounts of data across different industries and are central to the fields of databases and information systems. Examples include relational databases like MySQL, PostgreSQL, and Microsoft SQL Server, as well as NoSQL databases like MongoDB and Cassandra.
- Database ReplicationA technique that involves maintaining copies of the same database on multiple computer systems. This is done not only to ensure data availability and durability but also as a measure of resilience in the face of technical failures or data breaches. If one server or database is compromised, operations can continue unaffected using the replicated databases, minimizing disruption and data loss.
- Database System VulnerabilitiesThe weaknesses in a database system that can be exploited by malicious actors to gain unauthorized access, disrupt operations, or manipulate data. Such vulnerabilities could stem from a variety of factors, including but not limited to software bugs, improper configurations, weak security controls, or lack of timely updates and patches. Identifying and mitigating these vulnerabilities is crucial in protecting the data held within the database system.
- Data BreachesIncidents where information security is compromised, leading to the unauthorized access, disclosure, alteration, destruction, or loss of protected, sensitive, or confidential data. Breaches can affect personal data, intellectual property, and trade secrets and can result from cyberattacks like hacking, malware, and phishing due to negligence or insider threats. They often lead to significant financial, reputational, and legal consequences.
- Data BusA communication system within a computer or device consisting of various wires or traces on a circuit board, which transmits data between components. It allows the transfer of data and instructions from one part of the computer to another, and its width (in bits) determines how much information can be transmitted at once.
- Data Center Power RedundancyThe implementation of backup power sources and systems within a data center to ensure its continuous operation, even during power failures or disruptions. Power redundancy can include multiple power feeds, uninterruptible power supply (UPS) systems, and backup generators.
- Data Circuit Terminating Equipment (DCE)Devices that act as an interface between data terminal equipment (DTE) and a data transmission circuit. These devices could include modems, switches, and routers. DCE devices provide a point of connection for networking and facilitate the communication process. Securing these devices is crucial as they can be potential points of exploitation by threat actors.
- Data ClassificationThe process of organizing data into categories for its most effective and efficient use. Classification helps manage risk by applying appropriate controls based on the sensitivity and value of the data. It typically involves categorizing data as public, internal, confidential, or secret to guide users on how to handle and secure it. Proper classification is crucial for compliance, data security, and minimizing the risk of data breaches.
- Data Classification SchemeA structured framework used to categorize data based on its level of sensitivity, importance, and legal obligations. Such schemes allow organizations to effectively manage and protect their data by setting rules for access, storage, and transfer and ensuring that adequate protective measures are applied consistently throughout the organization’s data ecosystem.
- Data CommunicationsThe process of transmitting and receiving digital or analog data between two or more points. The data can be transferred through various mediums like wire, optical fiber, or airwaves and can be anything from simple text files to complex multimedia presentations. Secure data communications are pivotal for maintaining the integrity and confidentiality of transmitted data.
- Data ContaminationThe process by which data becomes corrupt or tainted due to the introduction of erroneous, misleading, or irrelevant information. This can happen through human error, data integration issues, or malicious activity, such as a cyber-attack. Contaminated data can lead to inaccurate analyses, misguided business decisions, or compromised machine learning models. In cybersecurity, it is essential to maintain the integrity of data by implementing controls that prevent contamination, such as input validation, data sanitation processes, and activity monitoring, to detect and mitigate any contamination incidents quickly.
- Data Control Language (DCL)A type of syntax used in SQL databases that manages permissions on different database objects. DCL commands such as GRANT and REVOKE allow specific roles or users to access or restrict certain actions on the database, ensuring that only authorized individuals have the right level of access to perform their duties.
- Data ControllerAn individual, organization, or entity that determines the purposes and means of processing personal data. In the context of privacy laws, such as the GDPR, data controllers have specific legal obligations regarding the handling of data, including ensuring its protection and privacy, responding to data subject’s rights requests, and reporting data breaches. They are differentiated from data processors, who process personal data on behalf of a data controller.
- Data CustodianAn individual or organization responsible for the maintenance and care of data or data sources. Their duties typically involve implementing technical controls, procedures, and systems that ensure the safety and quality of the data, such as performing regular backups, enforcing access controls, and ensuring data integrity.
- Data DestructionThe process of eliminating or erasing data from a storage medium, making it completely unreadable and non-recoverable. Methods include physical destruction, degaussing, and software-based overwriting or encryption, all aimed at preventing unauthorized individuals from retrieving and exploiting sensitive information.
- Data DictionaryA centralized repository of information about data, such as its meaning, relationships to other data, origin, usage, and format. It serves as a guide for understanding the structure, content, and context of data sources, thereby helping ensure consistency across different parts of an organization and facilitating effective data management.
- Data DiddlingA fraudulent act involving the deliberate alteration of data before or during its entry into a computer system and then changing it back after the processing is complete. This can be done to manipulate the output or results, typically for financial gain or other malicious intent. It’s considered a form of cybercrime and is a security risk that organizations need to guard against with appropriate controls and auditing measures.
- Data Discovery MethodsData Discovery Methods refer to a range of processes and tools used to identify, classify, and analyze an organization’s data assets. They are crucial for data governance, risk management, and compliance, ensuring that sensitive data is properly handled and protected. Techniques include automated discovery using software to scan storage systems and databases, as well as manual reviews and audits.
- Data EmanationThe unintentional radiation or transmission of electrical signals from electronic equipment, such as a computer or a network device, which can potentially disclose sensitive information. Adversaries can intercept and decode these signals, also known as compromising emanations, to gain unauthorized access to the information, making mitigation techniques such as shielding, signal jamming, or the use of secure communication protocols essential.
- Data Encryption Standard (DES)A symmetric-key algorithm for encrypting electronic data. Developed in the 1970s and once widely used, DES encrypts data in 64-bit blocks using a 56-bit key. It was eventually found to be vulnerable to brute-force attacks and has been largely replaced by more secure standards like the Advanced Encryption Standard (AES). However, DES was pivotal in the development and study of modern encryption techniques.
- Data Execution Prevention (DEP)A security feature included in most modern operating systems. Its primary function is to help prevent damage to your system from viruses and other security threats by monitoring programs to ensure they use system memory safely. When DEP detects a program using memory incorrectly, it closes the program and notifies the user, thus helping to limit the impact of both malicious and unintentionally harmful software.
- Data FarmA colloquial term that describes a large-scale data storage facility or a collection of servers that work together to store, manage, and process vast amounts of data. Similar to a server farm or data center, a data farm provides the infrastructure necessary to support big data applications, cloud computing services, and extensive databases. Data farms are designed for reliability, scalability, and high availability to ensure ongoing access to critical data resources. They play a foundational role in supporting the storage needs of modern enterprises and the processing requirements of complex analytical tasks.
- Data FlowThe movement or transfer of data through a system, from one component or process to another, often visualized in diagrams to represent the path that data takes through software, systems, or networks. Data flow analysis is crucial in designing systems for efficiency and understanding how data is processed and utilized.
- Data Flow ControlMechanisms that regulate the rate at which data is sent or received in a network to avoid overwhelming a recipient or communications channel. This ensures reliable data transfer and efficient use of network resources and can enhance overall system performance. Flow control can be implemented via software at the application, transport, or network layers and is integral to network protocols like TCP.
- Data Flow Diagrams (DFDs)Graphical representations that illustrate the flow of data through an information system. DFDs can map out the inputs, processes, storage, and outputs of data in a system. They are useful tools for visualizing system interactions, identifying potential bottlenecks or vulnerabilities, and for planning and improving system design.
- DatagramA self-contained, independent entity of data carrying sufficient information to be routed from the source to the destination computer without reliance on earlier exchanges between these source and destination machines and the transporting network. This means that each piece of data can take a different path to reach its intended destination, which can be useful for handling network congestion and ensuring data transmission even if parts of the network are compromised.
- Data HidingA software development technique specifically applied to object-oriented programming, where the internal object details (data members) are hidden from external users. Data hiding helps maintain object integrity by preventing users from setting object data into an invalid or inconsistent state, enhancing system security, and reducing the likelihood of unauthorized data manipulation.
- Data in MotionData that is actively moving through networks, either across the Internet or through private networks. It’s during this active transfer process that data is often considered most vulnerable to unauthorized interception or alteration, which necessitates the use of secure transport protocols and encryption measures to ensure its safe delivery.
- Data IntegrityA key principle in data security that ensures data is accurate, consistent, and reliable over its entire lifecycle. It involves maintaining the consistency, accuracy, and trustworthiness of data from the moment it is created until the point it is deleted. Measures to ensure data integrity include error checking and validation, backup, security access controls, and the implementation of specific rules and protocols.
- Data in UseRefers to data that is currently being processed or manipulated by a computer application or user. Unlike data at rest or data in transit, it’s in an active state, making it potentially more vulnerable to unauthorized access or attacks, like memory scraping. Security measures for data in use include encryption and access controls. Encrypting data in active use, also known as runtime encryption, involves protecting data being processed in a computer’s memory. Techniques include Trusted Execution Environments (TEEs) that create secure areas in a processor, Homomorphic Encryption that allows computations on encrypted data, and Secure Enclaves like Intel SGX, which safeguard data even if the system is compromised.
- Data LabelingThe process of categorizing or tagging data, like files or digital assets, with labels that add informative context or meaning. The labels can represent different levels of sensitivity, confidentiality, or business value, and they help to enforce appropriate handling and protection measures according to the specified labels.
- Data LakeA centralized repository that allows you to store all your structured and unstructured data at any scale. You can store your data as-is without having to first structure the data and run different types of analytics—from dashboards and visualizations to big data processing, real-time analytics, and machine learning to guide better decisions. Data lakes are typically implemented using a flat architecture where data is tagged with metadata and unique identifiers and can be efficiently queried and analyzed.
- Data LeakAn incident where sensitive, protected, or confidential data is unintentionally exposed, transmitted, or made accessible to unauthorized individuals. This could be the result of various actions, such as poor security configurations, vulnerabilities in software, or human error, and can lead to significant reputational and financial damage.
- Data LeakageAn event where information, either intentionally or accidentally, is moved outside of an organization’s security boundaries, possibly falling into the wrong hands. Data leakage could occur through various channels, such as email attachments, cloud storage, physical devices, or even through employee misconduct.
- Data LifecycleThe sequence of stages that a particular unit of data goes through from its initial generation or capture to its eventual archival and retirement or deletion. This lifecycle typically includes stages such as creation, processing, storage, usage, sharing, archiving, and disposal, with each stage necessitating specific handling and security measures.
- Data Link LayerThe second layer of the OSI model handles the transfer of data between adjacent network nodes within a wide area network (WAN) or between nodes on the same local area network (LAN) segment. It encompasses the protocols and methods used to ensure an error-free transmission through physical addressing, data framing, network topology, error detection, and handling retransmissions. The Data Link Layer is subdivided into two sublayers – the Logical Link Control (LLC) layer and the Media Access Control (MAC) layer.
- Data LocalizationLaws or regulations requiring data about a nation’s citizens or residents to be collected, processed, and/or stored inside the country before being transferred internationally, often as a condition for conducting business in a country. These measures are often enforced to protect data privacy, maintain data security, or enable law enforcement access to data.
- Data Loss Prevention (DLP)A set of tools or processes used to identify, monitor, and protect data in use, data at rest, and data in motion through deep content inspection and with a focus on sensitive data. The goal is to prevent sensitive data from being lost, misused, or accessed by unauthorized users, thereby maintaining the data’s confidentiality and integrity.
- Data Manipulation Language (DML)A subset of SQL used to retrieve, insert, modify, and delete data in databases. DML includes commands such as SELECT, INSERT, UPDATE, and DELETE, enabling users to manage and manipulate data in relational database management systems.
- Data MappingThe process of creating data element mappings between two distinct data models. Data mapping is used as a first step for a wide variety of data integration tasks, including data transformation or data mediation between a data source and a destination. It helps to define how individual data fields are matched from one database to another, ensuring that information is transferred accurately and correctly during system migrations, data consolidation, or ETL (Extract, Transform, Load) processes. It is fundamental in data management and integration activities.
- Data MiningThe analytical process designed to explore large amounts of data in search of consistent patterns and systematic relationships between variables and then validate the findings by applying the detected patterns to new subsets of data. It is a multidisciplinary approach to discovering useful information from large data sets and is used for various purposes, including market analysis, fraud detection, customer retention, and more.
- Data ModelingThe process of developing data structures and specifications. It involves creating a conceptual representation of data objects, the associations between different data objects, and the rules governing these associations. This is instrumental in managing data as a resource, promoting data sharing, increasing data consistency, and designing databases.
- Data NormalizationA systematic approach of decomposing tables to eliminate data redundancy and undesirable characteristics like insertion, update, and deletion anomalies. The goal of this technique is to reduce and even eliminate data redundancy, an issue that can lead to data anomalies and inconsistencies within databases or data storage systems.
- Data Origin AuthenticationA process or protocol ensuring that the content of an electronic message or document is provided by the claimed sender (the origin) and has not been altered in transit. It’s crucial for secure communications in networks, verifying that the data received has not been tampered with and actually comes from the purported source. This is typically achieved through cryptographic methods, such as digital signatures or message authentication codes (MACs).
- Data OwnerAn individual or a functional unit, usually within an organization, which is legally responsible for the data they create, capture, maintain, or use. They are responsible for classifying the data according to its sensitivity and for ensuring it is handled, stored, and accessed in compliance with relevant laws, policies, and guidelines.
- Data PacketA unit of data made into a single package that travels along a given network path. Packets are used to transport user data and control information in systems based on packet switching, such as the Internet. Each packet contains the source and destination addresses along with payload data. Packets are routed through networks to their destination, where they are reassembled into the original message.
- Data PortabilityThe ability to move data from one system, controller, or environment to another in a safe and secure manner without affecting its usability. Often a topic in discussions about personal data rights, it allows users to take their data from a service and transfer or ‘port’ it elsewhere, offering greater control over their own data.
- Data ProcessorsEntities that process personal data on behalf of data controllers. Under GDPR and similar regulations, processors are responsible for handling data as instructed by the controller and must adhere to strict standards of security and confidentiality. They play a key role in IT and data services, especially within cloud computing, data analytics, and outsourced service providers.
- Data Protection ActLegislation designed to protect personal data stored on computers or in an organized paper filing system. It requires respecting the privacy rights of individuals and ensuring their personal data is processed lawfully and transparently, used for specified purposes, is accurate, and is kept secure. Different countries may have their own versions of the Data Protection Act, such as the UK’s Data Protection Act of 2018, which aligns with the EU’s General Data Protection Regulation (GDPR).
- Data Recovery ToolsSoftware tools designed to recover or restore data that has been lost, deleted, corrupted, or made inaccessible. These tools can work on various storage media, such as hard drives, SSDs, memory cards, or even specific files or databases, and are often used after incidents like accidental deletion, hardware failures, or cyber-attacks.
- Data remanenceThe residual representation of data that remains even after attempts have been made to remove or erase it. It’s a significant concern because it can potentially allow unauthorized access and recovery of sensitive data and is especially relevant when disposing of recycling, or repurposing old hardware.
- Data RetentionThe practice of storing data for a predetermined period of time for compliance, regulatory, or business reasons. The period of time that data should be kept varies depending on the type of data, the industry, and the regulatory environment. After this period, the data is usually securely destroyed.
- Data retention monitoringThe process of regularly reviewing and managing stored data to ensure that it is being retained in accordance with relevant policies and regulations. The process involves managing the data lifecycle, ensuring data protection and privacy, verifying data accuracy and availability, and detecting potential unauthorized activities.
- Data RolesThe responsibilities assigned to individuals or entities in relation to data. Key roles often include data owners, who have control over and responsibility for data assets; data stewards, who oversee data quality and lifecycle; and data users, who access and use data in their roles.
- Data SecurityThe practice of protecting digital data from unauthorized access, corruption, or theft throughout its entire lifecycle. It includes a set of standards and technologies that protect data from intentional or accidental destruction, modification, or disclosure. Data security involves a range of tactics, such as encryption, tokenization, and key management practices that protect data across all applications and platforms. It also involves physical and administrative strategies to control access to hard-copy and electronically stored data. Data security is crucial for maintaining the integrity and privacy of information in both business and personal contexts.
- Data Security Lifecycle (CSUSAD)An acronym representing the stages through which data goes to maintain security from creation to destruction. Create, Store, Use, Share, Archive, and Destroy. The lifecycle ensures that data is protected at all times. Create – Data is produced or captured in various forms. Store – Data is saved in a secure location and protected from unauthorized access. Use – Data is accessed and utilized by authorized individuals for intended purposes. Share – Data is exchanged between users, systems, or organizations with appropriate security measures. Archive – Data that is no longer actively used is securely stored for long-term retention. Destroy – Data is securely and irreversibly destroyed when it is no longer needed or required to be retained by law. This lifecycle approach helps organizations implement comprehensive data protection strategies and manage risks associated with data handling.
- Data Seizure in VirtualizationThe process of capturing or taking control of data within a virtualized environment, often for forensic analysis or legal purposes. Data seizure in virtualization can be complex due to the dynamic and distributed nature of virtual machines (VMs) and their storage. Authorities or forensic experts must ensure the integrity and admissibility of the data by following established protocols and using specialized tools. This includes dealing with challenges such as capturing data without disrupting services, ensuring the consistency of snapshots, and maintaining the chain of custody for the data. Proper techniques ensure that the data seized can provide reliable evidence or insight into the state of the virtualized systems at the time of the seizure.
- Data StructureA specialized format for organizing and storing data in a computer so that it can be accessed and modified efficiently. Different kinds of data structures are suited to different kinds of applications, and some are highly specialized for specific tasks. Data structures can include arrays, linked lists, stacks, queues, trees, graphs, and various types of tables and databases, each with its own strengths and use cases in the realm of computer science and data processing.
- Data subjectsIndividuals or entities whose data is collected, processed, and stored by an organization. Used in data privacy regulations to ensure the protection of personal information. For example, a healthcare provider may collect data on patients for medical treatment but must ensure their personal information is kept confidential.
- Data TamperingThe unauthorized, deliberate alteration of data within a database, system, or network. This can involve modifying, deleting, creating, or damaging data to corrupt information, mislead decisions, or gain unauthorized benefits. Data tampering is a security threat that undermines the integrity and trustworthiness of data, and it can have legal, financial, and reputational consequences. Safeguards against tampering include access controls, encryption, hashing, and audit logs.
- Data Terminal Equipment (DTE)A device at the user end of a communication link that serves as a data source, destination, or both. This can include devices like computers, printers, and terminals. DTEs communicate with data circuit-terminating equipment to establish, maintain, and terminate communication sessions and to manage the data exchange between them.
- Data UsersIndividuals or entities that access, analyze, or utilize data as part of their business processes, research activities, or decision-making tasks. Data users can range from business analysts and data scientists to end-users inputting and retrieving data from an application. They are typically subject to data governance policies and responsible for adhering to data protection laws and best practices.
- Data WarehousingA system used for reporting and data analysis, widely considered as a core component of business intelligence. It involves the consolidation of data from various sources into one comprehensive database. Data warehousing enhances the ability to extract useful insights from the data, as it provides an organized, unified view of the data collected from various parts of an organization.
- DecentralizationThe distribution or dispersion of functions, powers, people, or things away from a central location or authority. In technology, decentralized systems distribute the network control across all participating nodes rather than relying on a centralized authority. This is often seen in blockchain technology and peer-to-peer networks, where no single entity has complete control, enhancing resilience and reducing single points of failure. Decentralization can also refer to organizational structures where decision-making is spread out to include more roles and divisions, often to increase the responsiveness and flexibility of an organization.
- DecertificationThe process of revoking or withdrawing the certification of a product, service, or professional qualification, often due to non-compliance with set standards or regulations or in the aftermath of discovering new vulnerabilities or defects that significantly impact performance or security. In the IT field, decertification can occur with security products, software, and professionals if they no longer meet industry or regulatory requirements.
- DecipherThe process of converting information or data that has been encrypted into a form that is readable and understandable. The act of deciphering typically requires a specific key or password, making it a central part of many processes that ensure confidentiality and secure access to information, especially sensitive or private data.
- Decision Support Systems (DSS)The interactive software applications used to help individuals or organizations make decisions by providing relevant data, models, or analytical tools. These systems are employed across various sectors and can help improve efficiency and accuracy in decision-making, ensuring the best possible outcomes based on the information available.
- DeclassificationThe process by which information that has previously been classified as confidential, secret, or top-secret is downgraded in secrecy level or made entirely public. This process is critical for ensuring that information which no longer requires protection is accessible for public scrutiny or for use in non-sensitive contexts. The procedure is typically controlled by strict protocols to maintain the overall integrity of an organization’s information management system.
- DecodeThis is the process of transforming encoded or scrambled data back into its original format. It’s an essential mechanism in communication systems that enables the safe transmission of data. The encoded data can only be interpreted correctly if the receiver has access to the appropriate decoding technique or key.
- DecryptionThe process of converting encrypted data (ciphertext) back into its original form (plaintext), making it understandable. This is achieved by using a cryptographic key and following the reverse process of the encryption algorithm applied to the data. Decryption is critical for secure communication, allowing only authorized parties with the correct key to access the sensitive information.
- Decryption KeyA type of cryptographic key used to reverse the encryption process, converting encrypted data (ciphertext) back into its original form (plaintext). In symmetric-key algorithms, the same key is used for both encryption and decryption, while in asymmetric-key algorithms, a paired private key is used for decryption that is different from the public key used for encryption. Proper handling and storage of decryption keys are crucial for maintaining the confidentiality and security of sensitive data.
- DeCSS ProgramA computer program designed to circumvent the Content Scramble System (CSS) used to encrypt and protect DVD content from unauthorized duplication and viewing. DeCSS program enabled users to bypass CSS and access the DVD content, leading to significant legal and ethical discussions about digital rights management and copyright infringement.
- DeencapsulationThe process of removing headers or top layers from a packet, frame, or other data transmission unit during its journey through a network’s layers in accordance with the layered architecture models such as OSI or TCP/IP. This action is taken by the receiving end of a data transmission to uncover the original data and interpret it correctly.
- Default classificationDefault classification refers to the security level automatically applied to data or information in the absence of a specific classification label. While it can be the most restrictive, this is not always the case; the default level is determined by an organization’s policy and could potentially be open or public if the data is not sensitive. The default classification serves as an initial safeguard until the proper classification can be reviewed and applied based on the data’s content and the need for confidentiality.
- Default deny policyA security strategy where all network traffic or access requests are automatically blocked unless they have been explicitly approved. This approach significantly reduces the risk of unauthorized access or data breaches as it requires explicit permission for any action, but it can also increase administrative overhead due to the necessity of frequent permissions adjustments.
- Default GatewayThe device that provides a connection point for devices on a network to communicate with other networks or the Internet. It serves as the routing path for network traffic that’s heading outside the local network and is typically a router or other networking device that has the capability to interface with larger networks.
- Default PasswordA pre-set password provided by the manufacturer of a hardware device or software application that is intended to be used during the initial setup process. Default passwords are often common and well-known, which can pose a significant security risk if not changed after installation or setup. It is considered a critical security practice to change all default passwords to strong, unique passwords to prevent unauthorized access that can result from default password exploitation. Cybersecurity best practices mandate the updating of default passwords as part of the initial configuration of any new system or device.
- Defense in DepthA security strategy that employs multiple layers of defense measures across an organization’s technical and procedural boundaries. It is designed to slow down an attack’s progress and provide redundant protective measures in case one system fails or is compromised. This includes not just technical controls like firewalls, antivirus software, and intrusion detection systems but also administrative controls like security policies, training, and physical controls like surveillance and secure locks. The concept is based on a military strategy with the same name, where a series of defensive mechanisms are layered to protect valuable assets. Multiple, complimentary, overlapping security measures.
- DegaussingA process by which magnetic fields are used to neutralize or erase data from a magnetic storage medium, such as hard drives or tapes. The process renders the data unreadable, thus ensuring the secure disposal of sensitive information, though it should be noted that once a device has been degaussed, it is typically no longer usable.
- DeidentificationA process where personally identifiable information (PII) is removed or anonymized from a dataset. The aim is to protect the privacy of individuals by ensuring that the data cannot be traced back to them. This technique is often used in data analytics and research, where large volumes of data are needed, but the identification of specific individuals is not.
- Delphi TechniqueA structured communication method originally developed as a systematic, interactive forecasting method that relies on a panel of experts. The experts answer questionnaires in two or more rounds. After each round, a facilitator provides an anonymous summary of the experts’ forecasts from the previous round, as well as the reasons they provided for their judgments. This process is intended to encourage convergence toward a correct answer over several rounds. The Delphi Technique is used for data collection and group problem-solving, particularly suitable for issues that do not have a precise analytical solution.
- Demilitarized Zone (DMZ)A physical or logical subnetwork that separates an organization’s internal network from an untrusted network, usually the Internet. By placing servers that interact directly with the external environment, such as web servers or email servers, in the DMZ, an additional layer of security is established that helps protect the more sensitive internal systems from unauthorized access or attacks.
- Deming CycleThe Deming Cycle, also known as PDCA, is a framework for continuous improvement in business processes. It consists of four iterative steps – Plan (identify and strategize change), Do (execute the change), Check (evaluate results), and act (implement or refine changes based on the evaluation). This model is essential for process optimization and quality management.
- DemodulationThe process of extracting the original information-bearing signal from a carrier wave. A demodulator takes a modulated carrier signal, which has specific characteristics set by a modulating signal, and converts it back into its original form or something close to it. It is the reverse process of modulation, which is used to encode information onto a carrier wave for transmission. Demodulation is a key function in radio receivers, televisions, and other telecommunications and data communication systems.
- DemographicStatistical data relating to the population and particular groups within it, often used for identifying trends. It typically includes factors such as age, gender, income level, education, occupation, and ethnicity. Businesses and governments use demographic information for market research, policy-making, and targeted advertising.
- Denial of ServiceAn attack on a network or service that aims to overwhelm its infrastructure and make it unavailable to its intended users. This can be achieved through various means, such as flooding the target with superfluous requests to overload the system or exploiting vulnerabilities that cause a crash. Common forms include Distributed Denial of Service (DDoS) attacks where multiple compromised systems are used to launch the attack, smurf attacks, and ping of death attacks.
- Dense-Wave Division Multiplexer (DWDM)An optical technology utilized in communications to multiply the number of wavelengths that can be sent over a single optical fiber, thereby increasing the overall data transmission capacity. DWDM systems have the potential to transmit up to 80 wavelengths on a single fiber, providing a high-bandwidth solution for networks and reducing the risk of data congestion and delay.
- Deny ListA security measure that specifies certain entities — such as software applications, email addresses, users, or IP addresses — that are blocked or denied access to a system. It’s a form of access control used to improve system security by explicitly refusing entry to potential threats and is the opposite of an allow list, which permits access only to entities that have been deemed safe.
- Department of Commerce (DOC)A cabinet-level agency of the United States government concerned with promoting economic growth. The DOC handles a variety of tasks, from conducting the national census to issuing patents and trademarks, fostering international trade, and supporting business development. It aims to create conditions for economic growth and opportunity by working with businesses, universities, communities, and the nation’s workers.
- Department of Health and Human Services (DHHS)A federal agency in the United States that administers programs dealing with health, welfare, and health information. In terms of data protection and confidentiality, DHHS plays a pivotal role in enforcing the Health Insurance Portability and Accountability Act (HIPAA), which includes rules to protect the privacy and security of certain health information.
- Deployment controlA critical phase in change management where changes are integrated into the live environment following rigorous testing and approval. This involves ensuring that changes are deployed accurately, efficiently, and safely and that they do not disrupt operations. Effective deployment control is essential to ensuring that vulnerabilities are not introduced during the deployment of changes and that the system remains secure and functional throughout the process.
- Deployment PlanningA phase in change management that entails designing a detailed strategy for how changes will be executed in the live environment. This involves determining the sequence and timing of changes, identifying required resources, outlining contingency plans for possible failure, and assessing potential impact on users and operations. Effective deployment planning ensures that changes are implemented methodically, minimizing the risk of introducing vulnerabilities or disrupting system operations.
- DepreciationThe accounting method of allocating the cost of a tangible asset over its useful life. It reflects the usage, wear and tear, or obsolescence of the asset. Depreciation helps companies earn revenue from an asset while expensing part of its cost each year the asset is in use. This process affects the value of the asset on the balance sheet and reduces taxable income on the income statement. Common methods include straight-line and accelerated depreciation.
- DeprovisioningThe process of removing an individual’s access rights or permissions from an organization’s systems and networks, often as a result of the individual leaving the company or changing roles. It is a critical part of identity and access management (IAM) to ensure security and compliance by preventing unauthorized access to sensitive information.
- Detection RiskIn auditing, detection risk is the chance that the auditor’s procedures will fail to detect a material misstatement in a company’s financial statements. From a cybersecurity perspective, detection risk involves the likelihood that an organization’s monitoring systems will not catch an ongoing security breach or malicious activity. Both concepts emphasize the importance of robust testing and monitoring systems to minimize the risk of oversight.
- Detective ControlsSecurity measures that are designed to identify and detect unwanted or unauthorized activity within systems and networks. Examples include intrusion detection systems (IDS), log monitoring, security audits, and surveillance cameras. These controls serve to alert an organization to security incidents as they occur or shortly thereafter, enabling a timely response to potential threats.
- Deterministic decryptionA type of decryption that involves using a specific set of rules or algorithms to decrypt data. This is different from probabilistic decryption, which involves using a combination of trial and error and probability to decrypt data. Deterministic decryption is often used in security applications where speed and efficiency are important, such as in password cracking or data recovery.
- DeterrentMeasures taken to discourage or dissuade unwanted actions or behaviors, especially related to malicious activities. By imposing severe consequences or risks, deterrents aim to make the cost of carrying out harmful actions, such as unauthorized access or data breaches, outweigh any potential benefits. Examples include security awareness training to deter internal staff from unsafe practices or legal penalties for external actors to discourage hacking activities.
- Deviations from BaselinesDeviations from Baselines refer to any variances observed from the expected or established standards (baselines) within IT and cybersecurity practices. These deviations might signal a range of issues, from system performance degradation to a potential security incident. Constant monitoring for such deviations is essential for timely identification and remediation to ensure system stability and security.
- DevOpsA methodology that combines software development (Dev) and operations (Ops) with the aim of reducing the system development life cycle while delivering high-quality software and improving operational performance. DevOps fosters continuous integration, continuous deployment, and continuous monitoring in software development and operations, enabling quicker responses to changes and problems.
- DevSecOpsAn extension of the DevOps methodology, this approach integrates security into the development and operation processes. It advocates for security considerations and controls to be included from the initial stages of software development rather than being an afterthought or standalone phase. It underscores a “security as code” culture with ongoing, flexible collaboration between release engineers and security teams.
- DFDs (Data Flow Diagrams)Graphical representations of the flow of data through an information system. They map out the data inputs, processing steps, data storage, and output processes involved in handling data. DFDs are used for system analysis and design and can help in understanding the complexities of systems, ensuring that all components are well-integrated and that the system functions as intended. They are particularly useful in visualizing data exchange within and between systems, aiding in error detection, and enhancing communication among stakeholders.
- Dial BackA security mechanism often used in remote authentication systems where the system disconnects a user after initial identification and then reconnects by dialing a pre-configured number. This process ensures that the connection is being established with a trusted source, thus reducing the risk of unauthorized access. It can be used in both telecommunications and networking environments to enhance security during remote access.
- DiameterDiameter is an authentication, authorization, and accounting (AAA) protocol designed as an upgrade to RADIUS. While it offers advancements like better security, scalability, and flexibility, Diameter is predominantly employed in mobile IP-based networks rather than replacing RADIUS in all contexts. RADIUS remains widely used, particularly in traditional network environments.
- Dictionary AttackAn attack that uses a list of predefined values (often common or predictable passwords) in an attempt to gain unauthorized access to a system. Attackers systematically try all the words or phrases from this ‘dictionary’ against a user account or encrypted file. While the method can be time-consuming, its success rate is considerably high against weak passwords, emphasizing the need for users to create complex and unique passwords.
- Differential backupA type of data backup method that only saves the changes made to data since the last full backup. This approach provides a balance between a full backup (which copies all data) and an incremental backup (which only backs up data changed since the last backup of any type), offering an efficient way to save storage space while still allowing for easier data recovery compared to incremental backups.
- Differential CryptanalysisA method of analyzing and potentially breaking cryptographic systems, especially symmetric key schemes. It involves the study of how differences in an input can affect the resultant difference in the output. By observing these differences, an attacker might be able to infer the secret key used for encryption, thereby decrypting the contents without the need for brute force.
- Diffie-Hellman (DH or D-H)Named after its inventors, Whitfield Diffie, and Martin Hellman, Diffie-Hellman is a method of securely exchanging cryptographic keys over a public channel. The strength of Diffie-Hellman lies in its ability to facilitate the sharing of a secret key between two parties, each starting with their own private key, without the need to share any secret information directly.
- DiffusionIn cryptography, diffusion refers to the way that the relationship between the plaintext (the original, readable data) and the ciphertext (the encrypted data) is made as complex as possible. The principle of diffusion is to disperse the influence of a single plaintext character over many ciphertext characters so that changing one character in the plaintext results in multiple character changes in the ciphertext. This ensures that the statistical structure of the plaintext is dissipated in the ciphertext, making it more resistant to statistical analysis and, thereby, more secure. Diffusion is typically achieved through techniques like confusion, which is the practice of making the relationship between the encryption key and the ciphertext as complex as possible.
- Digital Code SigningThe process of using a digital certificate to sign a piece of software or code. This signature verifies the identity of the software author and assures the recipient that the code has not been altered or corrupted since it was signed. This helps protect users from installing malicious software disguised as legitimate applications.
- Digital ForensicsA specialized field focusing on uncovering and interpreting electronic data for use in investigations or legal proceedings. The goal is to preserve any evidence in its original state while performing a structured analysis to understand the full details of a digital crime or unauthorized event.
- Digital Forensics and Incident Response (DFIR)A discipline that combines traditional digital forensics (the recovery and investigation of material found in digital devices) with incident response (the process of handling and responding to security incidents or attacks). The goal is to uncover the details of an incident, remediate it, and determine how to prevent similar events in the future.
- Digital Millennium Copyright Act (DMCA)A US law enacted in 1998 to address the challenges of copyright management in the digital age. The DMCA implements two 1996 World Intellectual Property Organization (WIPO) treaties and provides a legal framework for copyright holders to control how their content is distributed online. It also limits the liability of online service providers for copyright infringement by their users, provided they respond to notices of alleged infringement appropriately. Furthermore, the DMCA prohibits the circumvention of digital rights management (DRM) technologies and outlines a notice-and-takedown process for removing infringing material from the Internet.
- Digital Rights Management (DRM)A set of access control technologies used by publishers, copyright holders, and individuals to restrict the ways in which proprietary content can be utilized and distributed. DRM systems are designed to prevent unauthorized copying and sharing of digital media and manage the rights of users to access eBooks, music, films, software, and other digital content. These technologies can enforce limitations such as the duration of access, the devices on which content can be viewed, and the number of times content can be accessed or copied. While DRM helps protect intellectual property rights, it also raises concerns about user rights, fair use, and interoperability.
- Digital signalsA type of signal that is represented by discrete, separate values typically in binary format (0s and 1s). These signals are less susceptible to noise and distortion compared to their analog counterparts, ensuring a higher quality and more secure transmission of information in applications like telecommunications, computing, and data storage.
- Digital SignatureA cryptographic tool used to confirm the authenticity and integrity of a message, software, or digital document. It works by associating a signature with a document using a unique private key, and anyone can verify the signature with the corresponding public key. Digital signatures are commonly used to implement electronic signatures, which can have legal significance.
- Digital Signature Algorithm (DSA)A federal Information Processing Standard for digital signatures, which was introduced by the US National Institute of Standards and Technology (NIST) in 1991. DSA is used for the creation of a digital signature, which can be used to authenticate the identity of the sender of a message or the signer of a document and to ensure that the original content of the message or document has not been altered. Signatures generated by DSA are unique not only to the document but also to the signer, ensuring both authenticity and non-repudiation.
- Digital Subscriber Line (DSL)A type of communication medium used for transmitting digital data over telephone lines. It allows for fast data transfer speeds, providing an internet service that is significantly faster than traditional dial-up. This technology makes use of standard copper phone lines and is widely used in homes and businesses around the world.
- Direct EvidenceIn legal terms, direct evidence is any material or information that directly proves a fact. It is evidence that, if believed, immediately establishes the truth of a fact without inference or presumption and does not require further support or corroboration. Examples of direct evidence include eyewitness testimony, a confession, or a video recording of the event in question. Direct evidence can be contrasted with circumstantial evidence, which suggests the truth of a fact indirectly through inference.
- Directional AntennaA type of antenna that is designed to focus the radio signal in a particular direction. Unlike omnidirectional antennas that transmit and receive signals in all directions, directional antennas concentrate the signal in a specific area, which can significantly extend the range and improve the quality of the transmission. They are commonly used for point-to-point communication, including radio and television broadcasting, cellular communications, satellite communication, and wireless bridges. The focused signal also adds the benefit of reduced interference from unwanted sources outside of the target path.
- DirectiveA formal instruction, order, or policy issued by an authority. It sets a course of action, procedure, or standard to be followed. Directives can be used to implement and enforce compliance with laws and regulations, and in an organizational context, they might outline specific requirements related to information protection, user behavior, or the use of systems and networks.
- DirectoryIn the context of computing, a directory is a file system cataloging structure that contains references to other computer files and possibly other directories. On many computers, directories are known as folders. In operating systems, directories are used to organize files in a hierarchical structure, providing a convenient means to access data stored within the system. Additionally, in networking, a directory refers to a service that stores, organizes, and provides access to information about network resources and users, such as a Lightweight Directory Access Protocol (LDAP) directory.
- Directory ServiceA system or software that stores and manages directories of information, such as user accounts or network resources. It is often used in the context of computer networks to provide centralized access and management of directory information. For example, a directory service may be used to manage user accounts in an Active Directory environment or to provide access to shared resources in a network.
- Directory TraversalA kind of security vulnerability that allows unauthorized access to directories and files on a system. It works by exploiting insufficient security validation or sanitization of user-supplied input file names, enabling attackers to step out of the intended directory tree and access other parts of the file system. Such attacks could potentially allow unauthorized viewing, copying, or modifying of sensitive information.
- Direct Reporting EngagementDirect Reporting Engagement is a specific type of assessment where an auditor or reviewer directly communicates the results of their evaluation to interested parties without intermediation. The engagement results in a report or statement detailing the auditor’s findings regarding the subject matter under review, which could pertain to financial, operational, or security-related concerns.
- DisasterAn unforeseen event that causes significant disruption to the normal functioning of systems, operations, or services. This could range from natural catastrophes like floods, earthquakes, and fires to human-induced incidents like system failures, cyber-attacks, or data breaches. These events necessitate the activation of contingency or disaster recovery plans to restore functionality and minimize operational and financial impact. If our main facility is unusable for 24 hours or more, it is a disaster.
- Disaster DeclarationA formal statement made by an organization’s management acknowledging the occurrence of a disaster. It triggers the implementation of a disaster recovery plan and mobilizes resources to respond to and recover from the disaster. Such a declaration is typically based on predefined criteria related to the severity and impact of the incident, and only certain people are allowed to declare a disaster.
- Disaster RecoveryAn area of security planning that aims to protect an organization from the effects of significant negative events. It involves policies, tools, and procedures to enable the recovery or continuation of vital technology infrastructure and systems following a natural or human-induced disaster. Disaster recovery focuses on the IT or technology systems supporting critical business functions, as opposed to business continuity, which involves keeping all essential aspects of a business functioning despite significant disruptive events. Disaster recovery strategies typically include data backup and recovery, systems fail-over, and site redundancy.
- Disaster Recovery PlanA documented, structured approach with instructions for responding to unplanned incidents such as natural disasters, power outages, cyberattacks, and other disruptive events. This plan outlines measures to minimize the effects of a disaster so an organization can continue to operate or quickly resume mission-critical functions. The disaster recovery plan typically covers data backup and recovery, maintenance of critical systems, chain of command, and testing and drills to ensure readiness. It is an essential part of an organization’s business continuity planning.
- Disaster Recovery Plan (DRP) desk checkingA validation process where the disaster recovery plan is reviewed in a non-disruptive environment to identify any issues, omissions, or areas of improvement. It includes going through the plan in detail to understand the procedures, responsibilities, and resources necessary for successful disaster recovery. The aim is to ensure that the plan is accurate, comprehensive, and effective before an actual disaster situation occurs.
- Disaster Recovery Plan (DRP) Walk-throughA role-playing exercise that simulates a disaster situation to test the effectiveness of a disaster recovery plan. This involves all stakeholders going through the plan step-by-step to ensure that all roles, responsibilities, and actions are understood and feasible. The objective is to identify any gaps or issues in the plan that need to be addressed, thereby enhancing the readiness of the organization in the face of a real disaster.
- Disaster toleranceThe ability of an organization to maintain its operations and continue to provide services in the face of a disaster or disruptive event. It often involves measures such as redundant systems, fail-over mechanisms, and geographically dispersed resources that can ensure continued operation even when some parts of the infrastructure are affected.
- DisclosureThe action of making new or secret information known. In a legal context, disclosure can involve the release of evidence or information during the discovery phase of a trial. In the business and financial world, it refers to the act of providing important information to the public, such as a company revealing financial statements or a data breach being reported to customers. Disclosure is a critical concept in regulatory compliance, where laws often require the release of information to protect the public interest and maintain transparency.
- Disclosure Controls and ProceduresPolicies and procedures implemented by an organization to ensure that important information, particularly financial information, is accurately and timely reported to those who need to know this information. These controls are established to ensure that data is appropriately processed and disclosed to maintain its integrity and confidentiality and to meet compliance and governance requirements.
- Discovery samplingThe process of selecting a subset of data for analysis in order to estimate the characteristics of a larger population. It involves selecting a representative sample from a larger population and using it to draw conclusions about the population as a whole. It is used in various fields, such as statistics, auditing, and research. Examples include selecting a sample of transactions for testing, selecting a sample of records for review, or selecting a sample of customers for survey.
- Discretionary Access Control (DAC)A type of access control where the owner or administrator of the protected system, data, or resource sets the policies defining who or what is authorized to access the resource. In DAC models, access is based on the discretion of the owner. Users can be granted permission by an owner to read, write, or execute a file or program. This model is contrasted with mandatory access control (MAC), where access rights are regulated by a central authority based on multiple levels of security. DAC is known for its flexibility but can be less secure than MAC, as it allows users to control access to their own data, which they may not always do securely.
- Diskless WorkstationsComputers that do not have internal storage. Instead, they rely on a network connection to a server from which they access operating systems, applications, and data. This approach can reduce the risk of local data theft or loss and makes system maintenance easier, as updates and changes can be performed centrally on the server.
- Disk MirroringA technique used to protect data by duplicating it onto two or more disks. By writing the same data to a pair of storage devices, an exact copy, or mirror, is created. This strategy allows for data consistency and instant data recovery in case of a single disk failure, thereby ensuring high availability and resilience against data loss.
- Disk StripingSplitting data across multiple physical disk drives can improve performance by allowing multiple drives to read and write data concurrently. Each piece of data is broken down into blocks, and each block is written to a separate disk. Disk striping does not provide data redundancy, meaning that if a single drive fails, all data in the stripe is lost.
- Disk Striping With ParityA technique that combines the performance benefits of disk striping with added redundancy for data protection. In addition to splitting data across multiple drives, it also writes parity information. Parity information is a kind of checksum that can be used to reconstruct data if a single drive fails. This approach provides a balance between performance and data safety.
- Distance-Vector Routing ProtocolA network routing protocol that uses metrics or distances to determine the best path for data delivery. Each router using this protocol communicates with its neighbors to exchange information about the entire network topology. If changes are detected, updates are sent to all routers in the network, which helps prevent routing loops and provides a reliable delivery path.
- Distributed Data Processing NetworkA computational network structure in which data processing tasks are divided and managed across multiple geographically dispersed computers or nodes. Each node in the network works on a portion of the overall task, and the nodes may communicate with each other to share resources, balance load, and provide redundancy. This type of network is designed to improve data processing efficiency and reliability, as it can continue to function even if some of its components fail. Distributed data processing networks are integral to the functioning of large-scale, high-availability systems and are commonly used in cloud services, content delivery networks, and large-scale computing platforms.
- Distributed Denial-of-Service (DDoS) AttackA malicious attempt to disrupt normal traffic to a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. DDoS attacks are performed using multiple compromised computer systems as sources of attack traffic, which could include computers and other networked resources such as IoT devices. The influx of incoming messages, connection requests, and malformed packets can cause the target system to slow down or crash, denying service to legitimate users. DDoS attacks are a powerful weapon on the Internet and can be difficult to defend against, requiring sophisticated countermeasures.
- Distributed Network Protocol (DNP3)Distributed Network Protocol 3 (DNP3) is an open, standards-based protocol used primarily for communications between various types of data acquisition and control equipment. It is widely used in utilities and industrial automation systems to support the management of smart grids, SCADA systems, and other telemetry and control applications. DNP3 facilitates reliable and secure communication for monitoring and controlling networked devices.
- Distributed SystemA networked computational model in which software and data components residing on multiple machines work in harmony to accomplish tasks or processes. This model optimizes the use of resources, enhances reliability and scalability, and enables the simultaneous processing of tasks, leading to faster completion times and efficient system utilization.
- Diverse RoutingA technique implemented in networking to ensure that data can follow multiple distinct paths between sender and receiver. Having multiple possible routes mitigates the risk of network failure or congestion due to a single point of failure, increasing the reliability and availability of data transmission and reducing potential downtimes.
- DivestituresThe process of selling or otherwise disposing of an asset, subsidiary, or investment. In the context of data management, this involves the secure and proper disposal or transfer of digital assets, such as data and software, ensuring that no sensitive data is exposed or lost during the process and that compliance with relevant laws and regulations is maintained.
- DNSSECA security extension for the DNS protocol, which uses digital signatures and encryption to protect DNS records from tampering and spoofing. It is commonly used to secure DNS transactions and prevent attacks such as DNS poisoning. For example, a company may implement DNSSEC on their DNS servers to protect against attackers altering their DNS records and redirecting users to fake websites.
- Documentary EvidenceThe recorded, tangible, or digital information that can be used as evidence in an investigation or audit. This could include written contracts, emails, log files, or transaction records. In the context of digital systems, this often means logs, system messages, and other digitally recorded actions that could serve as proof of an event or activity.
- DomainIn the context of networking and the Internet, a domain refers to a sphere of knowledge identified by a name. Specifically, in terms of domain names, it’s part of a network address that identifies it as belonging to a particular domain. This is used to control internet addresses under the DNS (Domain Name System), which translates domain names to IP addresses. Domains also refer to specific areas of control or influence, such as a security domain in information security or a collision domain in networking.
- Domain Name System (DNS)A hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It translates more readily memorized domain names to the numerical IP addresses needed for the purpose of locating and identifying computer services and devices with the underlying network protocols.
- Domain Name System (DNS) ExfiltrationDNS exfiltration is a cyberattack method where attackers use the DNS protocol to stealthily move data from a compromised network to their own systems. Because DNS requests are common in network traffic and often allowed out of networks, attackers can covertly encode data within these requests, bypassing many security measures that do not scrutinize DNS traffic for such anomalies.
- Domain Name System (DNS) PoisoningA type of security exploit where an attacker redirects a DNS query to a different destination, typically a malicious website, by contaminating the DNS cache data of a DNS resolver with incorrect IP address entries. The attacker’s goal is to control the mapping of domain names to IP addresses to lead users astray, often for phishing or other malicious purposes.
- Double-Blind Test in Penetration TestingThis form of assessment simulates a real-world attack on a system, network, or application, where the defenders are unaware of the simulated attack just as they would be in an actual attack. It provides an organization with the most realistic indication of its security posture and readiness without providing prior knowledge of the testing scenario to its security personnel.
- DREADAn acronym for Damage, Reproducibility, Exploitability, Affected Users, and Discoverability, DREAD is a risk assessment model used to quantify, compare, and prioritize the risk levels of security vulnerabilities in a system. It helps stakeholders to understand the potential risk of a vulnerability and to make informed decisions about mitigations.
- Dry Pipe Fire Extinguisher SystemA type of fire suppression system where the pipes are filled with pressurized air or nitrogen rather than water. This system is typically used in environments where temperatures can fall below freezing, such as in unheated buildings or outdoor locations. The dry pipe valve prevents water from entering the pipe until a fire causes the system to activate. Once activated, the air escapes, and the water pressure opens the valve, releasing water through the sprinkler heads to extinguish the fire. This delay ensures that pipes don’t freeze and burst, which would render a wet pipe system ineffective in these conditions.
- DSaaS (Data Science as a Service)A cloud-based service that offers data science capabilities, including analytics, machine learning, and big data processing, without the need for organizations to maintain their own data science infrastructure. DSaaS enables access to advanced tools, algorithms, and expertise, facilitating data-driven decision-making and insights.
- Dual controlA security principle that requires two or more authorized individuals to perform a specific task. It reduces the risk of fraudulent or unauthorized activity as it necessitates the collaboration of two separate entities to execute the action. It is commonly used in high-risk operations or when handling sensitive information.
- Dual CustodyDual custody requires two or more individuals to access sensitive resources. This practice enhances security by ensuring that no single individual can access, manipulate, or transport sensitive data or assets. It’s often applied to financial transactions, system administrative tasks, or secure facilities access.
- Dual-Homed Host/FirewallA security component that serves as a bridge between two networks, typically a secure internal network and an unsecured external network like the Internet. The dual-homed host has two network interfaces, with each connected to a separate network. It manages and controls the flow of traffic between these networks, mitigating the risk of unauthorized access or data breaches.
- Dual-Technology SensorsThese are security devices that utilize two different detection methods to increase accuracy and reduce the likelihood of false alarms. By requiring both detection methods to trigger before raising an alarm, the system can more accurately discern real threats from environmental factors or equipment malfunction.
- Due CareIn the context of cybersecurity and business, due care refers to the level of judgment, attention, and prudence reasonably expected of a person in a particular position when taking actions to protect the interests of an organization and mitigate risks. It is essentially taking reasonable steps to protect a company and its assets from harm, which includes implementing and maintaining a comprehensive security program, regularly updating systems, and following best practices and compliance standards. Failure to exercise due care can lead to liability issues for an organization.
- Due DiligenceIn cybersecurity, due diligence refers to the careful investigation and evaluation of an organization’s information security posture and practices. It involves assessing the effectiveness of security policies, procedures, and controls to identify risks, vulnerabilities, and threats to the organization’s digital assets. This process is crucial when entering into business agreements or transactions to ensure that potential partners maintain adequate cybersecurity measures and comply with relevant regulations. Due diligence in cybersecurity aims to prevent data breaches, maintain privacy, protect intellectual property, and ensure business continuity.
- Due ProcessThe legal requirement that an entity, especially a government, must respect all legal rights owed to a person, ensuring fairness and justice. This principle applies in a cybersecurity context when an entity, such as a corporation or an individual, is suspected of conducting illegal activities like hacking or other malicious activities.
- Dumpster DivingA practice where individuals sift through trash (physical or digital) in an attempt to uncover valuable information that could be used for unscrupulous purposes. While traditionally associated with searching through physical refuse for discarded documents, in a more modern sense, it can also refer to searching through discarded digital data.
- DuressA condition in which a person performs an act as a result of violence, threat, or other pressure against the individual. In the legal context, duress can make a contract voidable if one party involuntarily agrees due to the wrongful threat of the other party. In security terms, a duress code is a covert signal used by an individual to indicate they are in danger without alerting the potential aggressor, commonly used in security systems and protocols where silent alarms or emergency signals are necessary.
- Dynamic AnalysisA method used in software testing where programs are executed in real-time to identify potential defects or errors. Unlike static analysis, which is performed without running the code, dynamic analysis tests the software’s behavior under various conditions and inputs to find issues such as memory leaks, race conditions, or security vulnerabilities. It is an essential part of the quality assurance process, being able to simulate actual operating conditions and user interactions.
- Dynamic Application Security Testing (DAST)A type of security testing method that inspects a running application from the outside in the testing environment, attempting to exploit potential vulnerabilities much like an external attacker might do. It focuses on identifying security vulnerabilities related to incorrect configurations, software flaws, and other weaknesses that can be exploited by malicious entities.
- Dynamic Host Configuration Protocol (DHCP)A network management protocol used on IP networks where a DHCP server dynamically assigns an IP address and other network configuration parameters to each device on the network so they can communicate with other IP networks. DHCP eliminates the need for manually assigning IP addresses to all network devices, simplifying the process of connecting devices to the network and managing the allocation of IP addresses within a network.
- Dynamic Link Libraries (DLLs)Modular files containing code and data that can be used by multiple applications simultaneously. DLLs allow for code reuse, modularization, and memory efficiency as the same library can serve multiple applications, reducing the need for redundant code. Their misuse or manipulation could lead to potential security vulnerabilities such as DLL hijacking or injection.
- Dynamic Packet FilteringA security measure used in network firewalls to manage the flow of network traffic in real-time. Unlike static packet filtering, which only examines a packet based on predefined rules, dynamic packet filtering evaluates packet information within the context of the packet’s state or connection, providing a more adaptive and sophisticated approach to network security.
- Dynamic PartitioningIn computing, it’s a method of dividing a hard drive or a database into segments that can be easily modified in size. This allows for the efficient use of space and resources by allocating and deallocating partitions as needed, without the need for a static predefined partition size. Dynamic partitioning can improve performance and flexibility for both storage and memory management in operating systems and database management systems. It enables the system to adapt to changing workloads and data requirements dynamically.
- Dynamic PortsAlso known as private or ephemeral ports, these are network ports assigned on an as-needed basis by a host’s operating system for client-side TCP or UDP communications. They are typically used for short-term communication sessions when a client initiates a communication session with a server, after which the port is released for reuse. Dynamic ports range from 49152 to 65535 according to IANA (Internet Assigned Numbers Authority) standards.
- Eastbound Interface APIIn the context of networking, an Eastbound Interface API refers to the application programming interface that enables communication and data flow from a network controller toward higher-level management systems or applications. This type of interface facilitates the upward propagation of network information, such as topology details or traffic statistics, which can be used for analytics, policy decision-making, network optimization, or orchestrating services across the network. In Software-Defined Networking (SDN) environments, for example, the Eastbound API allows the SDN controller to interact with more abstract layers like service management platforms or business logic applications.
- East-West APIsThese APIs facilitate internal communications and data exchange between services and applications within an organization’s IT infrastructure. Focused on optimizing the flow of information within the data center, East-West APIs are crucial for microservices architectures and containerized applications, where a high volume of internal traffic is common.
- EavesdroppingA method where unauthorized individuals listen to, monitor, or intercept others’ private conversations, data transmissions, or communications without consent. Eavesdropping can happen in various forms, such as wiretapping telephone lines, accessing email communications, or sniffing network packets. It’s a primary concern in the world of communication and data transmission as it could lead to the leakage of confidential or sensitive information.
- Echo checksA simple error detection technique used in data communication to verify the integrity of transmitted data. In echo checks, a copy of the transmitted data is sent back to the sender for comparison with the original data. It’s a common method for mitigating communication errors, ensuring that the data received at the other end is exactly what was sent, hence maintaining the reliability and integrity of data transmissions.
- E-commerceThe buying and selling of goods or services using the Internet and the transfer of money and data to execute these transactions. E-commerce can be conducted over computers, tablets, smartphones, and other smart devices. It encompasses a wide range of data, systems, and tools for online buyers and sellers, including mobile shopping and online payment encryption. E-commerce platforms can be focused on business-to-business (B2B), business-to-consumer (B2C), consumer-to-consumer (C2C), or consumer-to-business (C2B) transactions. It has transformed retail through online marketplaces, electronic payment systems, online shopping, and digital marketing.
- Economic Espionage Act (EEA)A US federal law that makes it a crime to steal or misappropriate trade secrets for the benefit of a foreign government, instrumentality, or agent. It is used to prosecute individuals or organizations that engage in industrial espionage or other forms of economic espionage. Examples include a company insider selling proprietary information to a foreign competitor or a nation-state hacking into a US company’s computer systems to steal trade secrets.
- Edge Computing SystemsComputing infrastructures that process data geographically closer to where it is generated rather than in a centralized data-processing warehouse. Edge computing brings computation and data storage to the proximity of data sources to lessen response times and save bandwidth. This concept is particularly relevant in the context of the Internet of Things (IoT), where edge devices, such as sensors or smart devices, produce vast amounts of data that can be processed locally to provide real-time analysis and insights. Edge computing supports a variety of applications, from mobile computing to autonomous vehicles, and is instrumental in distributed networks that require rapid processing without significant transmission delays.
- EDI (Electronic Data Interchange)A computer-to-computer exchange of business documents in a standard electronic format between business partners. EDI replaces postal mail, fax, and email, enabling stakeholders to transfer documents like purchase orders, invoices, shipping notices, and many other types of business documents quickly and accurately. This standardized communication method allows different companies, possibly with different business systems, to connect and share data efficiently, leading to streamlined processes, reduced costs, and minimal human errors. EDI is commonly used in supply chain management, manufacturing, healthcare, and retail.
- eDiscoveryThe process of identifying, collecting, and producing electronic data for use in legal proceedings. It is used in legal cases where electronic information is relevant to the case. For example, in a lawsuit involving a company’s email communications, eDiscovery would be used to collect and produce emails for review by attorneys.
- Edit ControlA mechanism used to validate the input data in a system. Edit control ensures that the data entered into a system adheres to predefined formats, ranges, or conditions before it is processed. This is important in maintaining the accuracy and consistency of the data and preventing the introduction of errors or anomalies that could lead to security vulnerabilities or incorrect system operation.
- EEPROM (Electrically Erasable Programmable Read-Only Memory)A type of non-volatile memory used in computers and other electronic devices to store small amounts of data that must be saved when power is removed. The data stored in EEPROM can be electrically erased and reprogrammed, which provides flexibility but also requires careful management to prevent unauthorized data alteration or disclosure.
- EFTA (European Free Trade Association)The European Free Trade Association (EFTA) is a regional trade organization and free trade area consisting of four European states – Iceland, Liechtenstein, Norway, and Switzerland. It operates in parallel with the European Union (EU) and participates in the European Single Market while remaining outside of the EU. EFTA facilitates free trade and economic cooperation between its members and also manages a network of trade relations around the world through its own international trade agreements.
- EFT (Electronic Funds Transfer)Refers to the digital transfer of money from one bank account to another, either within the same financial institution or across different institutions, via computer-based systems. EFTs include a variety of financial transactions, such as direct deposits, wire transfers, direct debits, online bill payments, and transactions initiated through credit or debit cards. EFTs enable quick and secure movement of funds, reducing the need for paper checks and cash handling. They are widely used for both personal and business financial transactions.
- EgressIn networking, egress refers specifically to traffic that is exiting a network. When data packets leave a network boundary en route to their destination, such as traffic departing from a private local area network (LAN) to the Internet, it is referred to as egress traffic. Egress control, including egress filtering and monitoring, is essential for network security to prevent unauthorized data transmission and ensure compliance with network policies.
- Egress FilterA network security measure that monitors and restricts the flow of outbound traffic from one network to another. Typically implemented in firewalls or routers, egress filtering rules ensure that only authorized data leaves the network, helping to prevent data exfiltration and stop the spread of malware. It’s essential for enforcing network security policies and ensuring that only legitimate, necessary traffic is allowed out.
- Egress MonitoringThe process of continuously checking data leaving an organization’s network for the purpose of detecting and preventing unauthorized data transfer. Through egress monitoring, organizations aim to protect sensitive information from leakage, theft, or misuse by insiders or compromised systems. This practice is a critical component of a comprehensive data loss prevention (DLP) strategy.
- EKMS (Electronic Key Management System)A system designed to handle the generation, distribution, accounting, and destruction of cryptographic keys. As part of a robust encryption strategy, the EKMS ensures that the necessary cryptographic keys are available when needed and are kept secure at all times to prevent unauthorized access to encrypted data.
- Electromagnetic fields (EMF)Invisible areas of energy, often referred to as radiation, are associated with the use of electrical power and various forms of natural and man-made lighting. In the context of security, EMFs can be a concern as they may be used in side-channel attacks where an adversary could potentially capture information from the radiation emitted by a device. Measures such as shielding and maintaining a secure physical distance can be used to mitigate this risk.
- Electronic Code Book (ECB) ModeElectronic Code Book (ECB) Mode is the simplest form of block cipher encryption where each block of plaintext is encrypted independently. Its main weakness lies in not hiding data patterns well, as identical plaintext blocks produce identical ciphertext blocks. This predictability can lead to security vulnerabilities, making ECBs unsuitable for the encryption of large amounts of data, especially if they contain repetitive information.
- Electronic vaulting (e-vaulting)The transfer of backup data to an off-site storage system using network connections. This method is usually automated and occurs at pre-scheduled times to ensure data availability in case of unexpected events. Its purpose is to protect critical data from site-specific disasters and improve recovery time while maintaining the confidentiality, integrity, and availability of the data.
- Elevation of privilegeA scenario where a user or process gains higher access rights or permissions than they’re intended to have, typically resulting in unauthorized control over system resources. It often constitutes a serious security flaw, as it allows the individual or process to bypass restrictions, potentially leading to information theft, data corruption, or additional harmful activities.
- El Gamal AlgorithmA public key cryptosystem based on the Diffie-Hellman key exchange. It was developed by Taher ElGamal in 1985 and is used for digital signatures, key agreements, and encryption. The El Gamal encryption system is an alternative to the RSA algorithm and relies on the difficulty of calculating discrete logarithms for providing security. It has the property that each plaintext message is encrypted to a different ciphertext message using a randomly chosen parameter, even if the same plaintext message is encrypted multiple times.
- Elliptic Curve Cryptography (ECC)A public key encryption technique based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of the traditional method of generation as the product of very large prime numbers, offering equivalent security with lower computing power and battery resource usage.
- Elliptic Curve Digital Signature Algorithm (ECDSA)A cryptographic algorithm that uses elliptic curves for the creation of digital signatures. It’s widely recognized for its strength despite using shorter key lengths, which results in more efficient processing. ECDSA provides assurance of data integrity, sender authenticity, and non-repudiation, meaning the signer cannot credibly deny having signed the data.
- ELSEC (Electronic Security)A term encompassing the various methods and practices aimed at safeguarding electronic systems from unauthorized access, use, disclosure, disruption, modification, or destruction. ELSEC includes the protection of information and assets related to computing, telecommunications, and any other forms of electronic data storage and transmission. The goal of electronic security is to ensure the confidentiality, integrity, and availability of electronic information and to preserve the functionality of electronic services and infrastructure. ELSEC is a critical aspect of overall cybersecurity strategies in both private and public sectors.
- Email spoofingA malicious practice where the headers of an email are manipulated to make it appear as though the message originated from a different sender. This is often used in phishing and spam campaigns, where the attacker aims to trick the recipient into trusting the false sender, potentially leading to data breaches, financial loss, or other forms of harm.
- Embedded SystemA dedicated computer system with a specific function within a larger mechanical or electrical system, often with real-time computing constraints. It is embedded as part of a complete device, often including hardware and mechanical parts. Embedded systems control many devices in common use today and are typically designed for specific control tasks with varying degrees of complexity. They range from simple microcontroller-based systems to complex systems-on-chips (SoCs) and are found in numerous applications, including consumer electronics, automobiles, medical devices, industrial controls, and aerospace.
- Emerging Cloud TechnologiesThe new and advanced developments in cloud-based services and infrastructure. It covers technologies such as serverless computing, artificial intelligence (AI) and machine learning (ML) platforms, edge computing, and advanced security solutions in the cloud. As these technologies evolve and gain adoption, they bring along new potential vulnerabilities and attack vectors, making their secure implementation and management critical.
- EMI (Electromagnetic Interference)The disruption of an electrical circuit’s performance due to external electromagnetic radiation or other electrical devices. EMI can interfere with the normal operation of electronic devices, including computers and networking equipment, which can lead to data loss, system errors, or even equipment failure, creating potential risks for data integrity and system availability.
- Encapsulating Security Payload (ESP)A component of the Internet Protocol Security (IPSec) suite used for ensuring secure communication by providing confidentiality, data origin authentication, connectionless integrity, and anti-replay. ESP achieves this by encapsulating the data to be protected, thus hiding the original data and safeguarding the integrity of the transmitted data.
- EncapsulationIn computer networking, encapsulation refers to the process of wrapping data with necessary protocol information before network transmission. Similar to an envelope for a letter, it involves adding headers (and sometimes trailers) around data for proper delivery and processing. In object-oriented programming, encapsulation is a fundamental concept that binds together the data and functions that manipulate the data and keeps both safe from outside interference and misuse. Data encapsulation led to the important OOP concept of data hiding.
- EncodeThe process of converting information from one format or code to another for the purposes of standardization, speed, secrecy, or compressions. In computer systems, encoding can refer to transforming data into a form that can be easily used by different types of systems. For example, encoding is commonly used for transforming raw data into a binary format that is understandable by computers. It also refers to the conversion of data for transmission, storage, or encryption, often using schemes such as Base64 and UTF-8 for text or more complex schemes like encoding video for digital formats.
- EncryptionThe process of converting information or data into a secure format that cannot be read without proper authorization, typically using a key. It protects data privacy by ensuring that only those who have the encryption key can access the original data, making it essential for secure communication over potentially vulnerable networks like the Internet. Encryption is used in various applications, including online transactions, confidential communications, and safeguarding sensitive information.
- Encryption AlgorithmA mathematical process used to convert plaintext into ciphertext. Encryption algorithms are designed to encode data in such a way that it can only be decrypted by authorized parties. Common encryption algorithms include AES (Advanced Encryption Standard), DES (Data Encryption Standard), and RSA (Rivest-Shamir-Adleman). They use a variety of techniques, such as substitution, transposition, and mathematical transformations, to ensure data security.
- Encryption KeyA string of characters used in conjunction with an encryption algorithm to encode or decode data. In symmetric encryption, the same key is used for both encryption and decryption, while in asymmetric encryption, two related keys are used – a public key for encryption and a private key for decryption. The security of encrypted data is highly dependent on the strength and secrecy of the encryption key.
- End-to-End EncryptionA method of secure communication that prevents third-parties from accessing data while it’s transferred from one end system to another. In this system, data is encrypted on the sender’s system or device, and only the recipient is able to decrypt it. No intermediary, including internet service providers, application service providers, and hackers, can read it or tamper with it. End-to-end encryption is widely used in messaging services, email communication, and secure file sharing to ensure that only the communicating users can read the messages.
- End userThe individual who directly interacts with a product, application, or system. This person does not participate in the development of the system but uses it for its intended purpose. In the data protection context, the end user is often the target of security protocols and training to minimize risks, such as phishing attacks or malware intrusion, which arise from human error or negligence.
- End-user computingEnd-user computing (EUC) refers to systems and platforms that allow users who are not programming experts to create and use software applications. It includes tools like spreadsheet programs, databases, and graphical interfaces that simplify the development and execution of business programs and processing. EUC empowers users to manage and control their own computing needs but also requires governance to ensure that data integrity and security are maintained, as the widespread creation of disparate applications can lead to data silos and security gaps.
- ENISA (European Union Agency for Network and Information Security)Established in 2004, it’s a center of expertise for cyber security in Europe. ENISA helps the EU and its Member States to be better equipped and prepared to prevent, detect, and respond to information security problems. The agency also assists in the development of a high level of network and information security (NIS) to enhance Europe’s capability to prevent and react to cyber-attacks and disruptions.
- Enterprise Architecture (EA)A strategic planning framework that defines the structure and operation of an organization. It seeks to align an organization’s structure with its objectives, facilitating systematic analyses, design, planning, and implementation of an organization’s strategies. EA involves the detailed modeling of business processes, information flows, IT systems, and technological infrastructure. By providing a holistic view of an organization’s assets, processes, and policies, EA supports informed decision-making, promotes efficiency, and guides the effective integration of IT with business goals.
- Enterprise governanceA holistic and integrated approach to corporate governance, business management, and assurance. It ensures that an organization’s strategies are set effectively, that they are implemented proficiently, and that risk is managed appropriately. This approach is designed to help an organization achieve its goals while maintaining a balance between risk and reward.
- Enterprise Risk Management (ERM)A strategic business discipline that supports the achievement of an organization’s objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an interrelated risk portfolio. It involves the methods and processes used by organizations to manage risks and seize opportunities related to the achievement of their objectives.
- EnticementIn a security context, enticement involves the creation of an attractive scenario to lure attackers into engaging in illicit activity that is already part of their intent. Unlike entrapment, it does not induce someone to commit a crime they were not predisposed to commit. Instead, it provides an opportunity for the attacker to act on preexisting criminal intent, allowing law enforcement or security professionals to monitor and potentially apprehend the attacker.
- EntrapmentIn a security context, entrapment refers to the strategy of tempting an attacker to commit a crime in order to catch them in the act. Unlike enticement, which involves luring an already-intent attacker, entrapment can involve creating conditions that provoke an attack that might not otherwise have occurred. This strategy can be controversial and is carefully regulated in many jurisdictions to prevent abuse and maintain fairness. We convince them to commit the crime if they have not already decided to commit it.
- EnumerationA process used in the reconnaissance or pre-attack phase where a potential attacker interacts with a system to gather information that could be useful for exploiting it. This may involve determining a user’s valid email address, network resources, shared directories, IP addresses in use, or even detailed user account information in certain circumstances.
- EnvironmentIn general terms, an environment refers to the surrounding conditions or context in which an organism, system, or object operates. In computing, an environment is the setting in which a computer program or software application runs – it’s about the hardware, operating system, software libraries, and data that exist outside the program itself. The term is also used to describe the configuration of software or hardware tools to create a specific type of runtime environment, such as a development, test, or production environment. Each environment serves a particular purpose in the software development lifecycle and operates under different parameters.
- Environmental MonitoringThe process of continuously observing and analyzing the conditions of a specific setting to ensure optimal performance and detect any potential issues that could affect system operations or data integrity. This includes tracking parameters like temperature, humidity, power supply, water leaks, or even unauthorized access, which can be crucial for maintaining the proper functioning of sensitive equipment like servers in a data center.
- Ephemeral KeyA cryptographic key that is used only once or for a brief period of time before being discarded. It is typically employed in secure communications to ensure the confidentiality and integrity of each individual session. The use of ephemeral keys enhances security by ensuring that even if a key is compromised, it can’t be used to decrypt other sessions or gain long-term access to sensitive information.
- Ephemeral StorageTemporary data storage that is not persistent across reboots or termination of the instance. It is often used in cloud computing environments for temporary storage of information such as swap files, buffers, or session data. Data stored in ephemeral storage is typically lost once the instance is stopped, terminated, or crashes, making it unsuitable for long-term data retention but useful for transient data and applications that do not require durable storage.
- ePHI (Electronic Protected Health Information)Any Protected Health Information (PHI) that is created, stored, transmitted, or received in an electronic form. Under laws such as the Health Insurance Portability and Accountability Act (HIPAA), ePHI must be kept confidential and secure to protect patients’ privacy. This often involves the use of encryption, secure networks, and robust access controls.
- EradicationIn the context of cybersecurity, eradication refers to the process of completely removing a security threat, such as a virus or malware, from an information system after it has been identified and contained. This is an integral step in incident response and involves steps to eliminate components of the threat, such as deleting malicious files, disabling breached user accounts, or fixing exploited vulnerabilities. The goal of eradication is to prevent the threat from causing further damage or re-emerging at a later time.
- ErasureThe process of permanently removing data from a storage medium, making it irrecoverable. This is an important measure in safeguarding sensitive information from unauthorized access, particularly when decommissioning devices or when data is no longer needed. Erasure methods may include overwriting, degaussing, or physical destruction, depending on the sensitivity of the data and the security requirements.
- Erasure CodingA method of data protection in which data is broken into fragments, expanded and encoded with redundant data pieces, and stored across a set of different locations or storage media. The objective is to enable the reconstruction of data by using information about the data that’s stored elsewhere in the network, thus providing high fault-tolerance.
- ERM (Enterprise Risk Management)A comprehensive, systematic approach to managing all the risks that an organization faces. The aim is to maximize the firm’s value by managing the potential impact of uncertainty on objectives. This approach includes identifying potential risks, assessing their likelihood and impact, developing response strategies, and monitoring progress.
- ERP System (Enterprise Resource Planning System)A suite of integrated applications that a company uses to collect, store, manage, and interpret data from numerous business activities, including product planning, manufacturing, marketing and sales, inventory management, and shipping and payment. By automating and integrating core business processes, an ERP system enhances efficiency and supports informed decision-making within an organization.
- ErrorAn unexpected or incorrect result produced by a piece of software or hardware due to faulty code, incorrect data, or unforeseen conditions. Errors can lead to system crashes, incorrect outputs, or data corruption, all of which can undermine the accuracy, reliability, and integrity of a system’s operations.
- Error and exception handlingThe mechanisms and processes put in place in software systems to manage errors and exceptions. These mechanisms aim to gracefully handle unexpected or abnormal conditions (exceptions) that arise during a program’s execution, thereby preserving system stability and data integrity. This could involve logging errors for further analysis, displaying user-friendly error messages, or recovering from an error state.
- Escrow AgentA trusted third-party entity that holds encryption keys in a secure environment. These keys can be released if certain conditions are met, such as the loss of original keys by the owner or a lawful request by authorities. The escrow agent’s role is critical in maintaining the balance between security and lawful access.
- EthernetA family of computer networking technologies commonly used in local area networks (LANs), metropolitan area networks (MANs), and wide area networks (WANs). Developed originally by Xerox in the 1970s and standardized by IEEE as IEEE 802.3, Ethernet has evolved to include various data rate standards and now serves as the backbone for most wired data networks. It uses both physical cables and switches to enable devices to communicate, offering a reliable and standardized way for computers, printers, and other network devices to exchange data packets.
- Ethical DisclosureThe practice of reporting vulnerabilities found in software or systems to the party responsible for the software or the broader community rather than exploiting them or making them public immediately. This gives the responsible party an opportunity to address and fix the vulnerability before potential malicious actors can exploit it.
- EU-US Privacy ShieldThe EU-US Privacy Shield was a framework designed to ensure compliance with EU data protection requirements when transferring personal data from the European Union to the United States. However, it’s important to note that the Privacy Shield was invalidated by the Court of Justice of the European Union (CJEU) in July 2020. Organizations previously relying on this framework now have to find alternative mechanisms, such as Standard Contractual Clauses (SCCs), for transatlantic data transfers that meet EU data protection standards.
- Evaluation Assurance Level (EAL)A numerical grade assigned to an information system product or system for the certification of its security. Defined by the Common Criteria certification standards, the EAL represents a third-party assessment of the design, implementation, and testing of security functions, with levels ranging from EAL1 (functionally tested) to EAL7 (formally verified, designed, and tested).
- EventIn a general context, an event is something that happens or takes place, particularly something of importance. In computing and IT, an event often refers to an action or occurrence recognized by software that may be handled by the system or by user code. Events can include user inputs, system signals, or messages from other programs. In terms of cybersecurity, an event can be any observable occurrence in a system or network, including potential security incidents. Event management is a key part of system monitoring, and cybersecurity event logs are critical for incident response and forensic analysis. It is just a change to a system or data, it is not positive or negative, just an observable change.
- Event TypeThe categorization of security events based on their nature or characteristics. Event types might include login events, file change events, network traffic events, and more. These categories assist in the analysis of events, helping security professionals to identify trends, spot anomalies, and understand the broader context of security events within a system or network.
- EvidenceInformation presented to support the truth or existence of an assertion. In legal contexts, evidence includes testimony, documents, and objects admissible in court to prove or disprove allegations. In science, evidence consists of collected data and observations that support or refute hypotheses. In cybersecurity, it comprises digital records and activities that indicate the security posture of systems or that a security incident has occurred.
- Evil TwinA rogue Wi-Fi access point that appears legitimate to users but is actually set up by an attacker to intercept wireless communications. The evil twin may mimic the name and settings of a legitimate access point to trick users into connecting to it, allowing the attacker to eavesdrop or manipulate their network traffic.
- Exception reportsDocuments generated when a process or operation deviates from its predefined norm or standard. In the security realm, these are vital in identifying anomalies such as unauthorized access attempts, failed login attempts, or other forms of unusual system activities that could indicate a security threat.
- Executable CodeThis refers to a set of instructions in a computer program that is currently being executed or is ready to be run by a computer’s processor. Executable code can come in various forms, such as binary executable files, scripts, or sequences of instructions interpreted by an interpreter. It typically resides within an executable file, which can be a standalone program or part of a larger application, and is responsible for performing specific tasks or operating various functions within a software environment.
- Executive stateThe operating status of a system when it’s performing its primary, user-oriented functions, as opposed to its administrative or maintenance-oriented tasks. In terms of security, ensuring the protection of the system and the data it handles during its executive state is of utmost importance.
- Exercise KeyAn exercise key is a temporary cryptographic key used in communications systems during exercises or system testing. This key is employed to protect sensitive data but is not intended for operational use. The purpose is to validate the operational readiness of a system without impacting real-world operations or revealing actual operational keys.
- ExfiltrationThe unauthorized transfer of data from a computer or other device to an external location or party. In cybersecurity, it often refers to data being illicitly copied or transmitted out of a network by an attacker or malware. Exfiltration can result in significant privacy breaches, intellectual property theft, and security incidents. Preventing exfiltration is a key focus of data loss prevention (DLP) strategies and security controls.
- Expert SystemA branch of artificial intelligence that uses a knowledge-based system to emulate the decision-making ability of a human expert. Expert systems are designed to solve complex problems by reasoning through bodies of knowledge, represented mainly as if-then rules rather than through conventional procedural code. They are often used to provide answers to questions, solve problems, or give advice in specialized fields like medicine, engineering, or finance. Expert systems use a ‘knowledge base’ and an ‘inference engine’ to simulate human expertise and derive conclusions.
- ExploitIn cybersecurity, an exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug, glitch, or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic. It often includes gaining control over a computer system, allowing privilege escalation, or a denial-of-service attack. Exploits are a fundamental component of many cyberattacks, using vulnerabilities in applications, operating systems, or networks to gain access or control.
- Exploitable ChannelAn exploitable channel is a term that generally refers to any means through which an attacker can exploit vulnerabilities to compromise a system or network. It can include software bugs, configuration weaknesses, or insecure network protocols. Identifying and securing these channels is crucial to protecting systems from potential breaches.
- Export Administration Regulations (EAR)United States regulatory laws that govern the export and re-export of most commercial items, including “dual-use” items that can serve both commercial and military or proliferation applications. EAR is administered by the Bureau of Industry and Security under the US Department of Commerce and covers technologies such as computers, software, and certain types of data. Companies must comply with EAR when exporting goods and services that could have implications on national security, foreign policy, and anti-terrorism.
- ExposureIn the context of finance and investments, exposure refers to the degree to which an investor or business is open to risk from market fluctuations, which could potentially lead to loss. In cybersecurity, exposure denotes the vulnerability of an organization or individual to potential threats that could lead to unauthorized access or damage to information systems and data. It is often used to measure the risk associated with network interfaces, code, or practices that make a system susceptible to cyberattacks. Reducing exposure is key to strengthening the security posture.
- Exposure Factor (EF)A metric that represents the magnitude of loss or impact that a threat could have on a system or data. It’s quantified as a percentage of loss that a realized threat would have on a specific asset. For example, an EF of 0.2 (or 20%) for a specific threat would indicate that a realization of that threat would result in a loss of 20% of the asset’s value.
- Extended EnterpriseA network of associated entities that a central organization interacts with directly or indirectly, including suppliers, vendors, partners, contractors, and customers. These entities have access to certain data or systems of the central organization, thereby extending the risk landscape and necessitating the use of additional controls to safeguard assets and data.
- Extended User Interface (NetBEUI)NetBEUI (NetBIOS Extended User Interface) is a non-routable networking protocol best suited for small to medium-sized local area networks. It’s known for being simple to configure and efficient in LAN environments due to its lack of scalability features necessary for larger, segmented networks. Its name is derived from NetBIOS, a program that allows applications for different computers to communicate over a local area network. However, with the evolution of networking infrastructure and the dominance of TCP/IP, NetBEUI has become largely obsolete and is rarely used in modern network designs.
- eXtensible Access Control Markup Language (XACML)A declarative access control policy language implemented in XML and a processing model that defines how access control decisions are evaluated from the policy. It enables fine-grained control of authorized activities, providing the ability to manage more detailed restrictions than traditional access control lists (ACLs).
- Extensible Authentication Protocol (EAP)A framework widely used in wireless networks and point-to-point connections that provides multiple authentication methods, such as smart cards, token cards, certificates, public key encryption, and one-time passwords (OTP). EAP is designed to support various authentication mechanisms without requiring the use of a specific one, allowing both the client and server to negotiate the desired method of authentication. It is often used in conjunction with other protocols, such as RADIUS and Diameter, and is an essential component of network access control in both wired and wireless networks.
- eXtensible Markup Language (XML)A flexible text-based format derived from SGML (Standard Generalized Markup Language) that is used to store and transport data. XML provides a way to structure data so that it can be both human and machine-readable. It is widely used for the representation of arbitrary data structures, such as those used in web services. XML is extensible because it allows users to define their own elements. Its purposes include but are not limited to, describing data, encoding documents, and serializing complex data structures across network connections.
- External Audit – Audit ExecutionThe audit execution stage of an external audit involves the systematic investigation of processes, procedures, and systems by independent auditors. The goal is to determine whether they comply with relevant laws, regulations, standards, and policies. This stage involves data collection, interviewing staff, observing operations, and performing tests to verify information and identify any areas of risk or non-compliance.
- External Audit – Audit ReportingThe audit reporting stage of an external audit involves presenting these findings, which may include identified issues, recommendations for improvements, and an overall assessment of the entity’s compliance status. This report is typically presented to senior management or a governance body such as a board of directors.
- External Audit – CharteringThe chartering stage of an external audit involves the establishment of the scope, objectives, and protocols for the audit. It often includes defining what areas or processes will be audited, what standards or regulations will be used as a basis for the audit, and what the expected deliverables are (such as an audit report). The charter is agreed upon by both the auditors and the organization being audited.
- External Audit – Pre-audit PlanningPre-audit planning is the initial phase of an external audit, where the audit’s scope and objectives are established, and a detailed audit plan is developed. This phase involves identifying the key processes, systems, or areas to be audited, gathering information about them, and deciding on the methodologies to be used during the audit.
- External AuditsIndependent assessments conducted by third-party auditors to verify the accuracy of an organization’s financial records, compliance with regulatory standards, or the effectiveness of its internal controls. External audits serve to provide assurance to stakeholders, such as investors, creditors, and regulators, that an organization’s financial statements present a true and fair view of its financial performance and position. They can also assess an organization’s adherence to industry standards, laws, and regulations, particularly in specialized areas like cybersecurity, environmental compliance, and quality management.
- External Border Gateway Protocol (EBGP)A variant of the Border Gateway Protocol (BGP) used for routing data between autonomous systems (AS) on the Internet. EBGP enables separate and distinct networks, each managed by a different organization (such as an internet service provider or a large enterprise), to exchange routing information. This protocol ensures that networks can communicate and determine the best paths for data packets to travel across the complex fabric of the global Internet. EBGP plays a crucial role in the scalability and operation of the Internet by handling routing between different organizations efficiently and dynamically.
- External routerA device that connects networks together and facilitates data transfer between them. Primarily used for connecting to networks outside an organization’s primary network, it serves as a gateway for data packets traveling between these disparate networks, controlling and directing traffic based on routing tables and protocols.
- External storageAny storage medium that is not directly integrated into the main device. This can include hard drives, solid-state drives, USB flash drives, memory cards, or network-attached storage devices. External storage allows for increased data storage capacity portability and often serves as a method for data backup.
- ExtranetA private network that uses internet technology and the public telecommunication system to securely share part of a business’s information or operations with suppliers, vendors, partners, customers, or other businesses. It can be viewed as part of a company’s intranet that is extended to users outside the company, offering controlled access while maintaining privacy and security.
- Extreme Programming (XP)A software development methodology that is intended to improve software quality and responsiveness to changing customer requirements. As a type of agile software development, XP advocates frequent “releases” in short development cycles, which are intended to improve productivity and introduce checkpoints where new customer requirements can be adopted. Key practices include pair programming, extensive code review, unit testing of all code, and a flat management structure. The aim of XP is to enhance software project adaptability and reduce risks associated with client requirements changing during the software development process.
- Facilitated Risk Analysis Process (FRAP)A methodology for performing risk analysis and assessment within an organization. It is a qualitative risk management approach that involves identifying threats and vulnerabilities and then discussing potential impacts and countermeasures with the aim of prioritizing risks. FRAP is designed to be less time-consuming than quantitative risk analysis by focusing on the most critical assets and their most likely threats, facilitating the involvement of multiple stakeholders to reach a consensus on risk priorities and mitigation strategies. It provides a streamlined process that organizations can use to quickly identify and address their most significant risks.
- Fail-openA fail-open design refers to a security system’s configuration that, in the event of a system failure, defaults to an “open” state, allowing all traffic or access. This approach prioritizes availability and continuity of operations over strict access control, often used in scenarios where service disruption is unacceptable despite the potential security risks it could introduce. This could also be doors that fail-open in case of an emergency, to allow for safe egress from a building.
- Fail-Over (Fail-over)A backup operational mode in which the functions of a system component (such as a processor, server, network, or database) are assumed by secondary system components when the primary component becomes unavailable through either failure or scheduled downtime. Fail-over helps maintain high availability and reliability by ensuring that services continue to operate in the event of a component failure. This process can occur automatically without human intervention or can be manually triggered.
- FailsafeA fail-safe design ensures that in the event of a system failure or malfunction, the system will default to a safe or minimal risk condition to prevent or minimize harm or damage. Failsafe mechanisms are critical in various industries and technologies, such as in aviation, automotive safety systems, and nuclear power plants, where a failure could have severe consequences. In computing, a failsafe may involve switching to a backup system or mode of operation that maintains service continuity at a reduced capacity.
- Fail secureA security term describing a feature or state where, upon failure, a system remains secure. In a fail-secure setup, if a component or system fails, it defaults to a locked or protected state rather than an open or unsecured one. This concept is commonly applied to access control systems, such as locked doors that remain locked during a power outage, ensuring that security is maintained even when the system’s primary operation is compromised.
- Fail-softA type of fail-over system that is designed to provide a reduced level of service in the event of a failure or interruption. It is used to ensure the availability of services in case of failure but at a lower level than the primary system. For example, a fail-soft system may provide a limited number of services in case of a failure rather than all services.
- Fallback ProceduresPredetermined plans designed to help an organization maintain or quickly resume mission-critical functions in the event of an interruption or failure. The fallback procedures come into play when normal processes cannot continue and often involve the use of redundant systems, backups, or alternative methods to continue operations until normal conditions are restored.
- Fall-through LogicIn programming, fall-through logic occurs in switch-case statements where the absence of a break statement causes the execution to continue from one case into the subsequent case. It’s intentional in certain programming scenarios but should be used cautiously to prevent logic errors. In security, careful design is required to avoid unintended actions from fall-through behavior, especially in authentication or access control decisions.
- False Acceptance Rate (FAR)A measure used in biometric security systems to indicate the probability that the system will incorrectly accept an unauthorized user. It is one of the key metrics, along with the False Rejection Rate (FRR), used to assess the performance of a biometric system. A low FAR is desired as it reflects a higher level of security, indicating that the system is less likely to permit access to an unauthorized individual. However, system designers must balance FAR with FRR to ensure the system is both secure and user-friendly.
- False NegativeAn instance in system monitoring or threat detection where a genuine problem, such as a security breach, system failure, or malicious activity, goes unnoticed. A false negative essentially means the system failed to recognize and alert a real issue, which is highly concerning as it can lead to significant damage or security compromises without immediate detection or resolution.
- False PositiveA system mistakenly flags benign or normal activity as suspicious or malicious. While this doesn’t pose a direct threat, a high number of false positives can lead to alert fatigue, which is when genuine alerts are ignored due to a large number of false alarms, potentially leading to overlooked real threats.
- False Rejection Rate (FRR)Also known as Type I error rate, FRR measures the likelihood that a biometric security system will incorrectly reject an access attempt by an authorized user. It’s one of the two primary metrics used to evaluate the accuracy of biometric systems, the other being the False Acceptance Rate (FAR). A lower FRR means that legitimate users are less likely to be inconvenienced by being denied access. However, reducing FRR typically increases FAR, so system designers must balance security with usability.
- Faraday CageAn enclosure used to block electromagnetic fields. It is typically formed by a conductive material or a mesh of such material. Named after the English scientist Michael Faraday, who invented them in 1836, Faraday cages work by distributing charge or radiation around the cage’s exterior, thus canceling out electric charges or radiation fields inside the enclosure. Faraday cages are used to protect electronic equipment from lightning strikes and electromagnetic interference (EMI) as well as to prevent EMI from emanating from electronic devices. They are also used in secure environments to prevent eavesdropping or data theft via electronic means.
- Fault InjectionThe deliberate introduction of faults or errors into a system to test its resilience and to validate its error detection and recovery capabilities. It can simulate various failure conditions and helps in understanding how a system behaves under abnormal conditions.
- Fault-Resistant NetworkA fault-resistant network, often synonymous with fault-tolerant networking, incorporates design principles and technologies aimed at achieving continuous network operations despite failures of individual components. Such networks utilize redundancy, diverse routing paths, and self-healing mechanisms to prevent single points of failure and ensure service availability.
- Fault ToleranceThe ability of a system to continue functioning properly in the event of a hardware or software failure. This is achieved through the incorporation of redundancy in the system’s components or through techniques like replication of tasks so that in the event of a component failure, the system’s operation continues without disruption.
- Fault tree analysisA method used to systematically analyze the causes of a failure or undesirable event in a system. Using a tree-like diagram, it represents the relationships between the system’s components, highlighting potential problems or threats that could lead to a failure.
- FCoE (Fiber Channel over Ethernet)A protocol that allows Fiber Channel communications to run directly over high-speed Ethernet networks, combining the robust and established world of Fiber Channel with the versatility and ubiquity of Ethernet. This provides a unified fabric that carries both storage and network traffic, thus simplifying data center infrastructure and reducing costs.
- Feasibility StudyA critical analysis and evaluation of a proposed project or system to determine if it is technically feasible, if it is feasible within the estimated cost, and if it will be profitable or not. This process typically involves evaluating different solutions and recommending the most effective option based on factors such as cost efficiency, technical capabilities, and regulatory compliance.
- Federal Information Processing Standards (FIPS)Publicly announced standards developed by the United States federal government for use in computer systems by non-military government agencies and government contractors. FIPS standards are issued to establish requirements for various purposes, such as ensuring computer security and interoperability, and are intended to be adhered to both by the agencies themselves and any companies doing business with them. Among the well-known FIPS standards is FIPS 140, which specifies the security requirements for cryptographic modules used within a security system protecting sensitive but unclassified information.
- Federal Privacy Act of 1974 (US)A United States federal law that establishes a code of fair information practices governing the collection, maintenance, use, and dissemination of personally identifiable information about individuals that is maintained in systems of records by federal agencies. It was enacted in response to concerns about how the creation and use of computerized databases might impact individuals’ privacy rights. The Privacy Act requires federal agencies to share information about their records with individuals upon request and to follow various principles, known as “Fair Information Practices,” about information collection, use, and disclosure. It also restricts the disclosure of personal data without the consent of the individual.
- Federated identityThe means of linking a person’s electronic identity and attributes stored across multiple distinct identity management systems. This method allows for users to use the same credentials across various systems and enterprises, improving the user experience, reducing administrative costs, and maintaining a high level of security for confidential information.
- FenceIn a physical security context, a fence is a barrier used to enclose or secure an area, typically made from posts connected by boards, wire, or rails, and is designed to prevent intrusion or escape. In computing, fencing can refer to a network security measure that isolates a node or system to protect the rest of the network when a security issue is detected. It also refers to a method of multiprocessing to prevent data corruption by coordinating exclusive access to shared resources.
- FERPA (Family Educational Rights and Privacy Act)A United States federal law that protects the privacy of student education records. This law applies to all schools that receive funds through an applicable program of the US Department of Education, ensuring that parents have certain rights with respect to their children’s education records, and these rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level.
- FHSS (Frequency Hopping Spread Spectrum)A method of transmitting radio signals by shifting a carrier across numerous frequency channels in a pseudorandom sequence, known as the hopping pattern. This technique is used to avoid interference, prevent eavesdropping, and enable code-division multiple access (CDMA) communications. The recipient must be aware of the exact sequence to successfully receive the signal.
- Fiber ChannelA high-speed network technology primarily used for storage networking. It’s often used in data centers to connect servers to shared storage devices and for interconnecting storage controllers and drives. The technology provides one of the fastest transport mediums available for the SCSI protocol, which is widely used for storage area networks (SANs).
- Fiber Channel over Ethernet (FCoE)Fiber Channel over Ethernet (FCoE) is a storage networking protocol that encapsulates Fiber Channel frames over Ethernet networks. This convergence allows for the consolidation of network and storage infrastructure in data centers, reducing complexity and costs. FCoE operates on Ethernet networks that support a lossless transmission environment, necessary for handling Fiber Channel traffic.
- Fiber Distributed Data Interface (FDDI)Fiber Distributed Data Interface (FDDI) is a set of ISO and ANSI standards for data transmission on fiber optic lines in a local area network (LAN). However, FDDI technology is considered obsolete and has been largely replaced by Ethernet and other faster networking standards that support higher bandwidths and longer distances with more cost-effectiveness.
- Fiber Optic CableA cable containing one or more optical fibers that are used to transmit data. Fiber optic cables have a core made from glass or plastic fibers that carry light to transmit data, enabling high-speed data transmission over longer distances with higher bandwidths than electrical cables. They are less susceptible to electromagnetic interference and signal loss, making them ideal for network backbones, telecommunications, and high-speed data connections in various environments.
- FICAM (Federal Identity, Credential, and Access Management)A US federal government initiative aimed at reducing cybersecurity risks and improving identity management. FICAM provides a comprehensive identity management framework to enable trusted digital interactions between individuals, devices, and government entities. It outlines best practices for issuing secure credentials and managing access to federal IT systems and resources aligned with federal regulations and standards. FICAM’s goal is to enhance security, increase efficiency, and promote better privacy protections in the digital government landscape.
- File Allocation Table (FAT)An older type of file system that was widely used for simple storage devices due to its simplicity and compatibility. It maintains a table (FAT) that acts as an index to manage disk space, keeping track of where files are stored. FAT file systems include FAT12, FAT16, and FAT32, differing in disk and partition size support. Despite its limitations in file size and disk capacity, FAT is still used in many situations for its cross-platform compatibility, especially on flash drives and other removable media.
- File LayoutThe structure and organization of data within a file. The layout can dictate how data is read, interpreted, and processed, and it often depends on the file format. Managing file layouts properly can have implications for data integrity and accuracy. For example, changing a file layout without adjusting the related processes can lead to misinterpretation of the data and potentially severe consequences.
- File-Level EncryptionA method of data protection where individual files or directories are encrypted by the file system itself. This form of encryption is highly flexible, allowing users to select exactly which data to encrypt and to manage access on a file-by-file basis. As a result, even if the physical media on which the files are stored is compromised, the data remains inaccessible without the appropriate decryption key.
- File ServerA server within a network that provides a centralized location for shared file storage, allowing users connected to the network to access and store files. It manages and controls file access to enhance security and ensure data integrity. File servers are commonly used in organizational environments to facilitate collaboration and data management.
- File Transfer Protocol (FTP)A standard network protocol used for the transfer of computer files between a client and server on a computer network. FTP is built on a client-server model architecture using separate control and data connections between the client and the server. It allows users to upload, delete, access, and transfer files easily. Despite its widespread use, FTP lacks secure transfer features, which have led to the development and adoption of more secure transfer protocols like SFTP and FTPS.
- File Transfer Protocol Secure (FTPS)An extension of the File Transfer Protocol (FTP) that adds support for the Transport Layer Security (TLS) and the Secure Sockets Layer (SSL) cryptographic protocols. FTPS should not be confused with SFTP, which is an FTP-like protocol that is part of the SSH protocol suite. FTPS provides secure communication for file transfers by enabling encryption of the data transmitted, which helps prevent interception or eavesdropping. It is utilized to protect the transmission of data over insecure networks, such as the Internet, particularly when transferring sensitive or confidential information.
- Final Omnibus RuleRefers to a set of regulations that significantly amends the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, Enforcement, and Breach Notification Rules. Published in January 2013 by the US Department of Health and Human Services, the rule strengthens the privacy and security protection for individuals’ health information, modifies the breach notification requirements under the HITECH Act, provides increased flexibility, and strengthens the government’s ability to enforce the law. It also extends the requirements to cover business associates of healthcare entities.
- Financial AuditA systematic examination and verification of an organization’s financial and accounting records and supporting documents by a professional, such as a Certified Public Accountant. This process involves checking financial statements, accounting books, and banking information to confirm that they are accurate, complete, and in accordance with established laws, regulations, and industry standards.
- FIN (Final)In the context of network communications, “FIN” refers to a flag that is used in the TCP (Transmission Control Protocol) to indicate that a particular communication session has ended or should be closed. When a FIN flag is sent from one device to another, it means that the device sending the FIN flag has no more data to transmit. This flag is a crucial part of maintaining and closing network connections in an orderly manner.
- FIPS 199A mandatory standard developed by the National Institute of Standards and Technology (NIST) in the United States for defining security requirements for information systems. FIPS 199 categorizes information and information systems, which helps to identify the appropriate level of security controls. The standard assists federal agencies in providing an appropriate level of information security based on a range of risk levels.
- FIPS 200A legally mandated standard that stipulates minimum security requirements for federal information and information systems. It defines a practical and flexible framework that federal agencies must follow to document and implement controls from the NIST Special Publication 800-53, which provides guidelines for selecting security controls for information systems supporting the executive agencies of the federal government. The controls are intended to safeguard all information systems except those related to national security.
- FIPS 202FIPS 202, titled “SHA-3 Standard – Permutation-Based Hash and Extendable-Output Functions,” specifies the Secure Hash Algorithm-3 (SHA-3) family of cryptographic hash functions. SHA-3 is a subset of cryptographic hash functions, including SHA3-224, SHA3-256, SHA3-384, and SHA3-512, as well as SHAKE128 and SHAKE256, which are extendable-output functions (XOFs). It is designed to provide integrity and security for digital data and is utilized as part of various security applications and protocols.
- FIPS 140-2A US government computer security standard used to accredit cryptographic modules. The title is “Security Requirements for Cryptographic Modules”, and it provides four increasing, qualitative levels of security – Level 1 to Level 4. It specifies the requirements for physically securing and role-based authentication of cryptographic modules used within security systems protecting sensitive but unclassified information. The standard is applicable to all federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems).
- Fire suppressionThe various methods and systems designed to extinguish or prevent the spread of fire in a building or facility. These methods can be manual, like fire extinguishers and fire blankets, or automatic, like sprinkler systems or gas-based systems. These systems are particularly important in data centers or server rooms where high temperatures or fires can cause catastrophic damage.
- FirewallA network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted internal network and an untrusted external network, such as the Internet. Firewalls are designed to prevent unauthorized access to or from private networks and can come in the form of hardware, software, or a combination of both. They are a fundamental part of network security and can perform various functions, including packet filtering, stateful inspection, proxy service, and network address translation (NAT).
- Firewall as a Service (FWaaS)A cloud-based solution that delivers firewall and other network security capabilities as a cloud service. It enables organizations to simplify their network security management by moving their security perimeter to the cloud, which can offer more flexibility, scalability, and cost-effectiveness compared to traditional on-premises firewall hardware. FWaaS typically includes features like intrusion prevention, URL filtering, and malware protection, and it is designed to protect both on-site and remote users in an increasingly decentralized IT landscape.
- Firewall PolicyA set of instructions or rules that dictate how a firewall should handle inbound or outbound network traffic. The policy is often based on IP addresses, domain names, protocols, programs, ports, or specific network interfaces. The policies dictate which types of traffic are permitted and which are not, enhancing security by blocking potentially harmful traffic or specific services that should not be publicly available.
- FirmwareA specialized form of software that provides low-level control for a device’s specific hardware. Firmware can be found in embedded systems such as traffic lights, consumer appliances, wireless routers, and digital watches. It can also provide essential instructions for how a device communicates with other computer hardware. Unlike typical software, firmware is usually designed for a specific hardware device and is stored on non-volatile memory chips, making it persistent through reboots and power off/on cycles. Firmware updates can fix bugs, add features, and patch security vulnerabilities.
- Fiscal YearA one-year period that companies and governments use for accounting and preparing financial statements. A fiscal year is often different from a calendar year and can vary between organizations. It is used for budgeting, keeping accounts, and taxation purposes and is designed to end during a period when the operations of the company are at a low point, making it easier to compile financial and operational results.
- FlawA weakness or a defect in a system, be it in a software, hardware component, network design, or business process. This could be a result of coding errors in software, design oversights, or configuration errors. When a flaw is discovered, it often needs to be rectified quickly to prevent exploitation that could compromise system integrity, confidentiality, or availability.
- FloodingA type of security attack where the network or system is overwhelmed with traffic or data, resulting in overconsumption of available resources. It could lead to system slowdowns or, in extreme cases, cause the system to crash entirely. Common types of flooding include Distributed Denial of Service (DDoS) attacks, where an attacker inundates a network with unwanted traffic, often from a botnet.
- FootprintingThe initial step where information gatherers collect as much data as possible about a target, such as an individual, a group, or an organization. This can be performed through various methods, including search engines, social media platforms, WHOIS databases, network tools, and more. This is a commonly used technique in ethical hacking to understand the security posture of a target system and find potential vulnerabilities that can be exploited.