3DES Triple DES encryption—three rounds of DES encryption used to improve security.
802.11 A family of standards that describe network protocols for wireless devices.
802.1X An IEEE standard for performing authentication over networks.
AAA See authentication, authorization, and accounting.
ABAC See attribute-based access control.
acceptable use policy (AUP) A policy that communicates to users what specific uses of computer resources are permitted.
access A subject’s ability to perform specific operations on an object, such as a file. Typical access levels include read, write, execute, and delete.
access control Mechanisms or methods used to determine what access permissions subjects (such as users) have for specific objects (such as files).
access control list (ACL) A list associated with an object (such as a file) that identifies what level of access each subject (such as a user) has—what they can do to the object (such as read, write, or execute).
access point (AP) Shorthand for wireless access point, the device that allows devices to connect to a wireless network.
Active Directory The directory service portion of the Windows operating system that stores information about network-based entities (such as applications, files, printers, and people) and provides a structured, consistent way to name, describe, locate, access, and manage these resources.
ActiveX A Microsoft technology that facilitates rich Internet applications, and therefore extends and enhances the functionality of Microsoft Internet Explorer. Like Java, ActiveX enables the development of interactive content. When an ActiveX-aware browser encounters a web page that includes an unsupported feature, it can automatically install the appropriate application so the feature can be used.
Address Resolution Protocol (ARP) A protocol in the TCP/IP suite specification used to map an IP address to a Media Access Control (MAC) address.
Address Space Layout Randomization (ASLR) A memory-protection process employed by operating systems where the memory space is block randomized to guard against targeted injections from buffer-overflow attacks.
Advanced Encryption Standard (AES) The current U.S. government standard for symmetric encryption, widely used in all sectors.
Advanced Encryption Standard 256-bit An implementation of AES using a 256-bit key.
advanced persistent threat (APT) A threat vector whose main objective is to remain on the system stealthily, with data exfiltration as a secondary task.
adware Advertising-supported software that automatically plays, displays, or downloads advertisements after the software is installed or while the application is being used.
AES See Advanced Encryption Standard.
AES256 See Advanced Encryption Standard 256-bit.
air gap The forced separation of networks, resulting in an air gap between systems. Communications across an air gap require a manual effort to move data from one network to another, as no network connection exists between the two networks.
algorithm A step-by-step procedure—typically an established computation for solving a problem within a set number of steps.
amplification An act of leveraging technology to increase the volume of an attack, such as pinging a network address to get all attached devices to respond.
annualized loss expectancy (ALE) How much an event is expected to cost the business per year, given the dollar cost of the loss and how often it is likely to occur. ALE = single loss expectancy × annualized rate of occurrence.
annualized rate of occurrence (ARO) The frequency with which an event is expected to occur on an annualized basis.
anomaly Something that does not fit into an expected pattern.
antivirus (AV) A software program designed to detect, mitigate, or remove malware and viruses from a system or network.
application A program or group of programs designed to provide specific user functions, such as a word processor or web server.
application programming interface (API) A set of instructions as to how to interface with a computer program so that developers can access defined interfaces in a program.
application service provider (ASP) A company that offers entities access over the Internet to applications and services.
APT See advanced persistent threat.
ARP See Address Resolution Protocol.
ARP poisoning An attack on the ARP table where values are changed to result in misdirected traffic.
asset A resource or information that an organization needs to conduct its business.
asset value (AV) The value of an asset that is at risk.
asymmetric encryption Also called public key cryptography, a data encryption system that uses two mathematically derived keys to encrypt and decrypt a message—a public key, available to everyone, and a private key, available only to the owner of the key.
attribute-based access control (ABAC) An access control mechanism that grants access based on attributes of a user.
audit trail A set of records or events, generally organized chronologically, that records what activity has occurred on a system. These records (often computer files) are often used in an attempt to re-create what took place when a security incident occurred, and they can also be used to detect possible intruders.
auditing Actions or processes used to verify the assigned privileges and rights of a user, or any capabilities used to create and maintain a record showing who accessed a particular system and what actions they performed.
authentication The process by which a subject’s (such as a user’s) identity is verified.
authentication, authorization, and accounting (AAA) Three common functions performed upon system login. Authentication and authorization almost always occur, with accounting being somewhat less common. Authentication and authorization are parts of the access control system.
Authentication Header (AH) A portion of the IPsec security protocol that provides authentication services and replay-detection ability. AH can be used either by itself or with Encapsulating Security Payload (ESP). Refer to RFC 2402.
availability Part of the “CIA” of security, applies to hardware, software, and data, specifically meaning that each of these should be present and accessible when the subject (the user) wants to access or use them.
backdoor A hidden method used to gain access to a computer system, network, or application. Often used by software developers to ensure unrestricted access to the systems they create. Synonymous with trapdoor.
backup Refers to copying and storing data in a secondary location, separate from the original, to preserve the data in the event that the original is lost, corrupted, or destroyed.
baseline A system or software as it is built and functioning at a specific point in time. Serves as a foundation for comparison or measurement, providing the necessary visibility to control change.
Basic Input/Output System (BIOS) A firmware element of a computer system that provides the interface between hardware and system software with respect to devices and peripherals. BIOS is being replaced by Unified Extensible Firmware Interface (UEFI), a more complex and capable system.
BGP See Border Gateway Protocol.
biometrics Used to verify an individual’s identity to the system or network using something unique about the individual, such as a fingerprint, for the verification process. Examples include fingerprints, retinal scans, hand and facial geometry, and voice analysis.
BIOS See Basic Input/Output System.
birthday attack An attack methodology based on combinations rather than linear probability. In a room of thirty people, one doesn’t have to match a specific birthday, rather match any two birthdays in the room match, making the problem a combinatorial match, which is much more likely.
Blowfish A free implementation of a symmetric block cipher developed by Bruce Schneier as a drop-in replacement for DES and IDEA. It has a variable-bit-length scheme from 32 to 448 bits, resulting in varying levels of security.
bluebugging The use of a Bluetooth-enabled device to eavesdrop on another person’s conversation using that person’s Bluetooth phone as a transmitter. The bluebug application silently causes a Bluetooth device to make a phone call to another device, causing the phone to act as a transmitter and allowing the listener to eavesdrop on the victim’s conversation in real life.
bluejacking The sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, tablets, or laptop computers.
bluesnarfing The unauthorized access of information from a Bluetooth-enabled device through a Bluetooth connection, often between mobile phones, desktops, laptops, and tablets.
Border Gateway Protocol (BGP) The interdomain routing protocol implemented in Internet Protocol (IP) networks to enable routing between autonomous systems.
botnet A collection of software robots, or bots, that run autonomously and automatically and, commonly, invisibly in the background. The term is most often associated with malicious software, but it can also refer to the network of computers using distributed computing software.
bridge protocol data unit (BPDU) BPDUs are a type of data messages that are exchanged across the switches within an extended LAN that uses a Spanning Tree Protocol (STP) topology.
bring your own device (BYOD) A term used to describe an environment where users bring their personally owned devices into the enterprise and integrate them into business systems.
buffer overflow A specific type of software coding error that enables user input to overflow the allocated storage area and corrupt a running program.
business availability center (BAC) A software platform that allows the enterprise to optimize the availability, performance, and effectiveness of business services and applications.
business continuity plan (BCP) The plan a business develops to continue critical operations in the event of a major disruption.
business impact analysis (BIA) An analysis of the impact to the business of a specific event.
business partnership agreement (BPA) A written agreement defining the terms and conditions of a business partnership.
BYOD See bring your own device.
cache The temporary storage of information before use, typically used to speed up systems. In an Internet context, refers to the storage of commonly accessed web pages, graphic files, and other content locally on a user’s PC or a web server. The cache helps to minimize download time and preserve bandwidth for frequently accessed websites, and it helps reduce the load on a web server.
Capability Maturity Model (CMM) A structured methodology helping organizations improve the maturity of their software processes by providing an evolutionary path from ad hoc processes to disciplined software management processes. Developed at Carnegie Mellon University’s Software Engineering Institute.
CAPTCHA Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA), software that is designed to pose tests that require human ability to resolve, preventing robots from filling in and submitting web pages.
centralized management A type of privilege management that brings the authority and responsibility for managing and maintaining rights and privileges into a single group, location, or area.
CERT See Computer Emergency Response Team.
certificate A cryptographically signed object that contains an identity and a public key associated with this identity. The certificate can be used to establish identity, analogous to a notarized written document.
certificate authority (CA) An entity responsible for issuing and revoking certificates. CAs are typically not associated with the company requiring the certificate, although they exist for internal company use as well (such as Microsoft). This term is also applied to server software that provides these services. The term certificate authority is used interchangeably with certification authority.
Certificate Enrollment Protocol (CEP) Originally developed by VeriSign for Cisco Systems to support certificate issuance, distribution, and revocation using existing technologies.
certificate revocation list (CRL) A digitally signed object that lists all of the current but revoked certificates issued by a given certification authority. This allows users to verify whether a certificate is currently valid even if it has not expired. A CRL is analogous to a list of stolen charge card numbers that allows stores to reject bad credit cards.
certificate signing request (CSR) A message sent from an applicant to a certificate authority in order to apply for a digital identity certificate.
chain of custody Rules for documenting, handling, and safeguarding evidence to ensure no unanticipated changes are made to the evidence.
Challenge Handshake Authentication Protocol (CHAP) Used to provide authentication across point-to-point links using the Point-to-Point Protocol (PPP).
change (configuration) management A standard methodology for performing and recording changes during software development and operation.
change control board (CCB) A body that oversees the change management process and enables management to oversee and coordinate projects.
Channel Service Unit (CSU) A device used to link local area networks (LANs) into a wide area network (WAN) using telecommunications carrier services.
CHAP See Challenge Handshake Authentication Protocol.
choose your own device (CYOD) A mobile device deployment methodology where each person chooses their own device type.
CIA of security Refers to confidentiality, integrity, and availability, the basic functions of any security system.
cipher A cryptographic system that accepts plaintext input and then outputs ciphertext according to its internal algorithm and key.
Cipher Block Chaining (CBC) A method of adding randomization to blocks, each block of plaintext is XORed with the previous ciphertext block before being encrypted.
cipher feedback A method to make a block cipher into a self-synchronizing stream cipher.
ciphertext The output of an encryption algorithm—the encrypted data.
CIRT See Computer Emergency Response Team.
clickjacking An attack against a user interface where the user clicks on something without knowing it, triggering a browser action unbeknownst to the user at the time.
closed circuit television (CCTV) A private television system, usually hardwired in security applications to record visual information.
cloud computing The automatic provisioning of computational resources on demand across a network.
cloud service provider (CSP) A company that offers cloud-based network services, infrastructure, or business applications.
cold site An inexpensive form of backup site that does not include a current set of data at all times. A cold site takes longer to get your operational system back up, but it is considerably less expensive than a warm or hot site.
collisions Used in the analysis of hashing cryptography, it is the outcome situation that occurs when a hash algorithm will produce the same hash value from two different sets of data.
Common Access Card (CAC) A smart card used to access U.S. federal computer systems, and to also act as an ID card.
Computer Emergency Response Team (CERT) Also known as a Computer Incident Response Team (CIRT), the group responsible for investigating and responding to security breaches, viruses, and other potentially catastrophic incidents.
computer security In general terms, the methods, techniques, and tools used to ensure that a computer system is secure.
computer software configuration item See configuration item.
confidentiality Part of the CIA of security, refers to the security principle that states that information should not be disclosed to unauthorized individuals.
configuration auditing The process of verifying that configuration items are built and maintained according to requirements, standards, or contractual agreements.
configuration control The process of controlling changes to items that have been baselined.
configuration identification The process of identifying which assets need to be managed and controlled.
configuration item Data and software (or other assets) that are identified and managed as part of the software change management process. Also known as computer software configuration items.
configuration status accounting Procedures for tracking and maintaining data relative to each configuration item in the baseline.
content management system (CMS) A management system to manage the content for a specific system, such as a website.
contingency planning (CP) The act of creating processes and procedures that are used under special conditions (contingencies).
continuity of operations planning (COOP) The creation of plans related to continuing essential business operations after any major disruption.
Controller Area Network (CAN) A bus standard for use in vehicles to connect microcontrollers.
cookie Information stored on a user’s computer by a web server to maintain the state of the connection to the web server. Used primarily so preferences or previously used information can be recalled on future requests to the server.
COOP See continuity of operations planning.
corporate owned, personally enabled (COPE) A form of mobile device ownership/management.
corrective action report (CAR) A report used to document the corrective actions taken on a system.
Counter Mode (CTM) Turns a block cipher into a stream cipher.
Counter Mode with Cipher Block Chaining–Message Authentication Code Protocol (CCMP) An enhanced data cryptographic encapsulation mechanism based upon the Counter Mode with CBC-MAC from AES, designed for use over wireless LANs.
countermeasure See security control.
cracking A term used by some to refer to malicious hacking, in which an individual attempts to gain unauthorized access to computer systems or networks. See also hacking.
CRC See cyclic redundancy check.
CRL See Certificate Revocation List.
cross-site request forgery (CSRF or XSRF) A method of attacking a system by sending malicious input to the system and relying upon the parsers and execution elements to perform the requested actions, thus instantiating the attack. XSRF exploits the trust a site has in the user’s browser.
cross-site scripting (XSS) A method of attacking a system by sending script commands to the system input and relying upon the parsers and execution elements to perform the requested scripted actions, thus instantiating the attack. XSS exploits the trust a user has for the site.
cryptanalysis The process of attempting to break a cryptographic system.
cryptography The art of secret writing that enables an individual to hide the contents of a message or file from all but the intended recipient.
crypto-malware Malware that uses cryptography to encrypt files for ransom.
CTR See Counter Mode (CTM)—an alternative abbreviation.
cyclic redundancy check (CRC) An error detection technique that uses a series of two 8-bit block check characters to represent an entire block of data. These block check characters are incorporated into the transmission frame and then checked at the receiving end.
DAC See discretionary access control.
data encryption key (DEK) An encryption key whose function it is to encrypt and decrypt data.
Data Encryption Standard (DES) A private key encryption algorithm adopted by the U.S. government as a standard for the protection of sensitive but unclassified information. Commonly used in 3DES, where three rounds are applied to provide greater security.
data execution prevention (DEP) A security feature of an OS that can be driven by software, hardware, or both, designed to prevent the execution of code from blocks of data in memory.
data loss prevention (DLP) Technology, processes, and procedures designed to detect when unauthorized removal of data from a system occurs. DLP is typically active, preventing the loss either by blocking the transfer or dropping the connection.
data service unit See channel service unit.
datagram A packet of data that can be transmitted over a packet-switched system in a connectionless mode.
decision tree A data structure in which each element is attached to one or more structures directly beneath it.
demilitarized zone (DMZ) A network segment that exists in a semi-protected zone between the Internet and the inner, secure trusted network.
denial-of-service (DoS) attack An attack in which actions are taken to deprive authorized individuals from accessing a system, its resources, the data it stores or processes, or the network to which it is connected.
Destination Network Address Translation (DNAT) A one-to-one static translation from a public destination address to a private address.
DES See Data Encryption Standard.
DHCP See Dynamic Host Configuration Protocol.
Diffie-Hellman A cryptographic method of establishing a shared key over an insecure medium in a secure fashion.
Diffie-Hellman Ephemeral (DHE) A cryptographic method of establishing a shared key over an insecure medium in a secure fashion using a temporary key to enable perfect forward secrecy.
digital forensics and investigation response (DFIR) Another name for the incident response process.
digital signature A cryptography-based artifact that is a key component of a public key infrastructure (PKI) implementation. A digital signature can be used to prove identity because it is created with the private key portion of a public/private key pair. A recipient can decrypt the signature and, by doing so, receive the assurance that the data must have come from the sender and that the data has not changed.
digital signature algorithm (DSA) A U.S. government standard for implementing digital signatures.
direct-sequence spread spectrum (DSSS) A method of distributing a communication over multiple frequencies to avoid interference and detection.
disassociation An attack on a wireless network whereby the attacker sends a deauthentication frame in a wireless connection, to break an existing connection.
disaster recovery plan (DRP) A written plan developed to address how an organization will react to a natural or manmade disaster in order to ensure business continuity. Related to the concept of a business continuity plan (BCP).
discretionary access control (DAC) An access control mechanism in which the owner of an object (such as a file) can decide which other subjects (such as other users) may have access to the object, and what access (read, write, execute) these objects can have.
Distinguished Encoding Rules (DER) A method of providing exactly one way to represent any ASN.1 value as an octet string.
distributed denial-of-service (DDoS) attack A special type of DoS attack in which the attacker elicits the generally unwilling support of other systems to launch a many-against-one attack.
diversity of defense The approach of creating dissimilar security layers so that an intruder who is able to breach one layer will be faced with an entirely different set of defenses at the next layer.
dll injection An attack that uses the injection of a dll onto a system, altering the processing of a program by in essence recoding it.
DNS poisoning The changing of data in a DNS table to cause misaddressing of packets.
Domain Hijacking The act of changing the registration of a domain name without the permission of its original registrant.
Domain Name Service/Server (DNS) The service that translates an Internet domain name (such as www.mhprofessional.com) into IP addresses.
DRP See disaster recovery plan.
DSSS See direct-sequence spread spectrum.
dumpster diving The practice of searching through trash to discover material that has been thrown away that is sensitive, yet not destroyed or shredded.
Dynamic Host Configuration Protocol (DHCP) An Internet Engineering Task Force (IETF) Internet Protocol (IP) specification for automatically allocating IP addresses and other configuration information based on network adapter addresses. It enables address pooling and allocation and simplifies TCP/IP installation and administration.
dynamic link library (DLL) A shared library function used in the Microsoft Windows environment.
EAP See Extensible Authentication Protocol.
electromagnetic interference (EMI) The disruption or interference of electronics due to an electromagnetic field.
electromagnetic pulse (EMP) The disruption or interference of electronics due to a sudden, intense electromagnetic field in the form of a spike or pulse.
Electronic Code Book (ECB) A block cipher mode where the message is divided into blocks, and each block is encrypted separately.
electronic serial number (ESN) A unique identification number embedded by manufacturers on a microchip in wireless phones.
elliptic curve cryptography (ECC) A method of public key cryptography based on the algebraic structure of elliptic curves over finite fields.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) A cryptographic method using ECC to establish a shared key over an insecure medium in a secure fashion using a temporary key to enable perfect forward secrecy.
Elliptic Curve Digital Signature Algorithm (ECDSA) A cryptographic method using ECC to create a digital signature.
Encapsulating Security Payload (ESP) A portion of the IPsec implementation that provides for data confidentiality with optional authentication and replay-detection services. ESP completely encapsulates user data in the datagram and can be used either by itself or in conjunction with Authentication Headers for varying degrees of IPsec services.
Encrypted File System (EFS) A security feature of Windows, from Windows 2000 onward, that enables the transparent encryption/decryption of files on the system.
escalation auditing The process of looking for an increase in privileges, such as when an ordinary user obtains administrator-level privileges.
evidence The documents, verbal statements, and material objects admissible in a court of law.
evil twin An attack involving an attacker-owned router in a wireless system, configured to match a legitimate router.
exposure factor (EF) A measure of the magnitude of loss of an asset. Used in the calculation of single loss expectancy (SLE).
Extensible Authentication Protocol (EAP) A universal authentication framework used in wireless networks and point-to-point connections. It is defined in RFC 3748 and has been updated by RFC 5247.
Extensible Markup Language (XML) A text-based, human-readable data markup language.
false acceptance rate (FAR) The rate of false positives acceptable to the system.
false positive Term used when a security system makes an error and incorrectly reports the existence of a searched-for object. Examples include an intrusion detection system that misidentifies benign traffic as hostile, an antivirus program that reports the existence of a virus in software that actually is not infected, or a biometric system that allows system access to an unauthorized individual.
false rejection rate (FRR) The acceptable level of legitimate users rejected by the system.
FHSS See frequency-hopping spread spectrum.
file system access control list (FACL) The implementation of access controls as part of a file system.
File Transfer Protocol (FTP) An application layer protocol used to transfer files over a network connection.
File Transfer Protocol Secure (FTPS) An application layer protocol used to transfer files over a network connection, which uses FTP over an SSL or TLS connection.
firewall A network device used to segregate traffic based on rules.
flood guard A network device that blocks flooding-type DoS/DDoS attacks, frequently part of an IDS/IPS.
forensics (or computer forensics) The preservation, identification, documentation, and interpretation of computer data for use in legal proceedings.
free space Sectors on a storage medium that are available for the operating system to use.
frequency-hopping spread spectrum (FHSS) A method of distributing a communication over multiple frequencies over time to avoid interference and detection.
full disk encryption (FDE) The application of encryption to an entire disk, protecting all of the contents in one container.
Galois Counter Mode (GCM) A mode of operation for symmetric key cryptographic block ciphers that has been widely adopted because it can be parallelized to increase efficiency and performance.
Generic Routing Encapsulation (GRE) A tunneling protocol designed to encapsulate a wide variety of network layer packets inside IP tunneling packets.
Global Positioning System (GPS) A satellite-based form of location services and time standardization.
Gnu Privacy Guard (GPG) An application program that follows the OpenPGP standard for encryption.
GPG See Gnu Privacy Guard.
GPO See Group Policy object.
graphic processing unit (GPU) A chip designed to manage graphics functions in a system.
Group Policy object (GPO) A method used by Windows for the application of OS settings enterprise-wide.
hacking The term used by the media to refer to the process of gaining unauthorized access to computer systems and networks. The term has also been used to refer to the process of delving deep into the code and protocols used in computer systems and networks. See also cracking.
hard disk drive (HDD) A mechanical device used for the storing of digital data in magnetic form.
hardware security module (HSM) A physical device used to protect but still allow use of cryptographic keys. It is separate from the host machine.
hash A form of encryption that creates a digest of the data put into the algorithm. These algorithms are referred to as one-way algorithms because there is no feasible way to decrypt what has been encrypted.
hash value See message digest.
hashed message authentication code (HMAC) The use of a cryptographic hash function and a message authentication code to ensure the integrity and authenticity of a message.
HDD See hard disk drive.
heating, ventilation, air conditioning (HVAC) The systems used to heat and cool air in a building or structure.
HIDS See host-based intrusion detection system.
high availability A system design to provide assured availability.
HIPS See host-based intrusion prevention system.
HMAC-based one time password (HOTP) A method of producing one-time passwords using HMAC functions.
honeypot A computer system or portion of a network that has been set up to attract potential intruders, in the hope that they will leave the other systems alone. Since there are no legitimate users of this system, any attempt to access it is an indication of unauthorized activity and provides an easy mechanism to spot attacks.
host-based intrusion detection system (HIDS) A system that looks for computer intrusions by monitoring activity on one or more individual PCs or servers.
host-based intrusion prevention system (HIPS) A system that automatically responds to computer intrusions by monitoring activity on one or more individual PCs or servers and responding based on a rule set.
hot site A backup site that is fully configured with equipment and data and is ready to immediately accept transfer of operational processing in the event of failure on the operational system.
HSM See hardware security module.
Hypertext Markup Language (HTML) A protocol used to mark up text for use across HTTP.
Hypertext Transfer Protocol (HTTP) A protocol for transfer of material across the Internet that contains links to additional material.
Hypertext Transfer Protocol over SSL/TLS (HTTPS) A protocol for transfer of material across the Internet that contains links to additional material that is carried over a secure tunnel via SSL or TLS.
ICMP See Internet Control Message Protocol.
identification (ID) The first step in the authentication process where the user establishes a secret with the authentication system and is bound to a userid.
identity provider (IdP) A system that creates, maintains, and manages identity information, including authentication services.
IEEE See Institute for Electrical and Electronics Engineers.
IETF See Internet Engineering Task Force.
impact The result of a vulnerability being exploited by a threat, resulting in a loss.
impersonation A social engineering technique that can occur in person, over a phone, or online, where the attacker assumes a role that is recognized by the person being attacked, and in assuming that role, the attacker uses the potential victim’s biases against their better judgment to follow procedures.
incident response The process of responding to, containing, analyzing, and recovering from a computer-related incident.
incident response plan (IRP) The plan used in responding to, containing, analyzing, and recovering from a computer-related incident.
industrial control system (ICS) Term used to describe the hardware and software that controls cyber-physical systems.
information security Often used synonymously with computer security, but places the emphasis on the protection of the information that the system processes and stores, instead of on the hardware and software that constitute the system.
infrared (IR) A set of wavelengths past the red end of the visible spectrum used as a communication medium.
Infrastructure as a Service (IaaS) The automatic, on-demand provisioning of infrastructure elements, operating as a service; a common element of cloud computing.
initialization vector (IV) A data value used to seed a cryptographic algorithm, providing for a measure of randomness.
instant messaging (IM) A text-based method of communicating over the Internet.
Institute for Electrical and Electronics Engineers (IEEE) A nonprofit, technical, professional institute associated with computer research, standards, and conferences.
intangible asset An asset for which a monetary equivalent is difficult or impossible to determine. Examples are brand recognition and goodwill.
integrity Part of the CIA of security, the security principle that requires that information is not modified except by individuals authorized to do so.
interconnection security agreement (ISA) An agreement between parties to establish procedures for mutual cooperation and coordination between them with respect to security requirements associated with their joint project.
intermediate distribution frame (IDF) A system for managing and interconnecting the telecommunications cable between end-user devices, typically workstations.
International Data Encryption Algorithm (IDEA) A symmetric encryption algorithm used in a variety of systems for bulk encryption services.
Internet Assigned Numbers Authority (IANA) The central coordinator for the assignment of unique parameter values for Internet protocols. The IANA is chartered by the Internet Society (ISOC) to act as the clearinghouse to assign and coordinate the use of numerous Internet protocol parameters.
Internet Control Message Protocol (ICMP) One of the core protocols of the TCP/IP protocol suite, used for error reporting and status messages.
Internet Engineering Task Force (IETF) A large international community of network designers, operators, vendors, and researchers, open to any interested individual concerned with the evolution of Internet architecture and the smooth operation of the Internet. The actual technical work of the IETF is done in its working groups, which are organized by topic into several areas (such as routing, transport, and security). Much of the work is handled via mailing lists, with meetings held three times per year.
Internet Key Exchange (IKE) A standard key exchange protocol used on the Internet, an implementation of Diffie-Hellmann algorithm.
Internet Message Access Protocol version 4 (IMAP4) One of two common Internet standard protocols for e-mail retrieval, the other being POP.
Internet of Things (IoT) The networking of large numbers of devices via the Internet to achieve a business purpose.
Internet Protocol (IP) The network layer protocol used by the Internet for routing packets across a network.
Internet Protocol Security (IPsec) A protocol used to secure IP packets during transmission across a network. IPsec offers authentication, integrity, and confidentiality services and uses Authentication Headers (AH) and Encapsulating Security Payload (ESP) to accomplish this functionality.
Internet Relay Chat (IRC) An application layer protocol that facilitates communication in the form of text across the Internet.
Internet Security Association and Key Management Protocol (ISAKMP) A protocol framework that defines the mechanics of implementing a key exchange protocol and negotiation of a security policy.
Internet service provider (ISP) A telecommunications firm that provides access to the Internet.
intrusion detection system (IDS) A system to identify suspicious, malicious, or undesirable activity that indicates a breach in computer security.
IPsec See Internet Protocol Security.
ISA See interconnection security agreement.
IT contingency plan (ITCP) The plan used to manage contingency operations in an IT environment.
Kerberos A network authentication protocol designed by MIT for use in client/server environments.
key In cryptography, a sequence of characters or bits used by an algorithm to encrypt or decrypt a message.
key distribution center (KDC) A component of the Kerberos system for authentication that manages the secure distribution of keys.
key encrypting key (KEK) An encryption key whose function it is to encrypt and decrypt the DEK.
keyspace The entire set of all possible keys for a specific encryption algorithm.
Layer 2 Tunneling Protocol (L2TP) A Cisco switching protocol that operates at the data link layer.
LDAP See Lightweight Directory Access Protocol.
least privilege A security principle in which a user is provided with the minimum set of rights and privileges that he or she needs to perform required functions. The goal is to limit the potential damage that any user can cause.
Lightweight Directory Access Protocol (LDAP) An application protocol used to access directory services across a TCP/IP network.
Lightweight Extensible Authentication Protocol (LEAP) A version of EAP developed by Cisco prior to 802.11i to push 802.1X and WEP adoption.
load balancer A network device that distributes computing across multiple computers.
local area network (LAN) A grouping of computers in a network structure confined to a limited area and using specific protocols, such as Ethernet for OSI Layer 2 traffic addressing.
logic bomb A form of malicious code or software that is triggered by a specific event or condition. See also time bomb.
loop protection The requirement to prevent bridge loops at the Layer 2 level, which is typically resolved using the Spanning Tree algorithm on switch devices.
MAC See mandatory access control, Media Access Control, or Message Authentication Code.
Main Distribution Frame (MDF) Telephony equipment that connects customer equipment to subscriber carrier equipment.
man-in-the-browser attack A man-in-the-middle attack involving browser helper objects and browsers to conduct the attack.
man-in-the-middle attack (MITM) Any attack that attempts to use a network node as the intermediary between two other nodes. Each of the endpoint nodes thinks it is talking directly to the other, but each is actually talking to the intermediary.
managed service provider (MSP) A third party that manages aspects of a system under some form of service agreement.
mandatory access control (MAC) An access control mechanism in which the security mechanism controls access to all objects (files), and individual subjects (processes or users) cannot change that access.
master boot record (MBR) A strip of data on a hard drive in Windows systems meant to result in specific initial functions or identification.
maximum transmission unit (MTU) A measure of the largest payload that a particular protocol can carry in a single packet in a specific instance.
MD5 Message Digest 5, a hashing algorithm and a specific method of producing a message digest.
mean time between failures (MTBF) The statistically determined period of time between failures of the system.
mean time to failure (MTTF) The statistically determined time to the next failure.
mean time to repair/recover (MTTR) A common measure of how long it takes to repair a given failure. This is the average time, and may or may not include the time needed to obtain parts.
Media Access Control (MAC) A protocol used in the data link layer for local network addressing.
memorandum of agreement (MOA) A document executed between two parties that defines some form of agreement.
memorandum of understanding (MOU) A document executed between two parties that defines some form of agreement.
message authentication code (MAC) A short piece of data used to authenticate a message. See hashed message authentication code.
message digest The result of applying a hash function to data. Sometimes also called a hash value. See hash.
metropolitan area network (MAN) A collection of networks interconnected in a metropolitan area and usually connected to the Internet.
Microsoft Challenge Handshake Authentication Protocol (MSCHAP) A Microsoft-developed variant of the Challenge Handshake Authentication Protocol (CHAP).
mitigation Action taken to reduce the likelihood of a threat occurring.
mobile device management (MDM) An application designed to bring enterprise-level functionality onto a mobile device, including security functionality and data segregation.
Monitoring as a Service (MaaS) The use of a third party to provide security monitoring services.
MSCHAP See Microsoft Challenge Handshake Authentication Protocol.
MTBF See mean time between failures.
MTTF See mean time to failure.
MTTR See mean time to repair.
multifactor authentication (MFA) The use of more than one different factor for authenticating a user to a system.
multifunction device (MFD) A device, such as a printer, with multiple functions, such as printing and scanning.
Multimedia Message Service (MMS) A standard way to send multimedia messages to and from mobile phones over a cellular network.
NAC See network access control.
NAP See Network Access Protection.
NAT See Network Address Translation.
National Institute of Standards and Technology (NIST) A U.S. government agency responsible for standards and technology.
NDA See non-disclosure agreement.
Near Field Communication (NFC) A set of standards and protocols for establishing a communication link over very short distances. Used in mobile devices.
network access control (NAC) An approach to endpoint security that involves monitoring and remediating endpoint security issues before allowing an object to connect to a network.
Network Access Protection (NAP) A Microsoft approach to network access control.
Network Address Translation (NAT) A method of readdressing packets in a network at a gateway point to enable the use of local, nonroutable IP addresses over a public network such as the Internet.
network-based intrusion detection system (NIDS) A system for examining network traffic to identify suspicious, malicious, or undesirable behavior.
network-based intrusion prevention system (NIPS) A system that examines network traffic and automatically responds to computer intrusions.
Network Basic Input/Output System (NetBIOS) A system that provides communication services across a local area network.
network operating system (NOS) An operating system that includes additional functions and capabilities to assist in connecting computers and devices, such as printers, to a local area network.
Network Time Protocol (NTP) A protocol for the transmission of time synchronization packets over a network.
New Technology File System (NTFS) A proprietary file system developed by Microsoft, introduced in 1993, that supports a wide variety of file operations on servers, PCs, and media.
New Technology LANMAN (NTLM) A deprecated security suite from Microsoft that provides authentication, integrity, and confidentiality for users. Because it does not support current cryptographic methods, it is no longer recommended for use.
Next Generation Access Control (NGAC) One of the primary methods of implementing attribute-based access control (ABAC). The other method is XACML.
NFC See Near Field Communication.
NIST See National Institute of Standards and Technology.
non-disclosure agreement (NDA) A legal contract between parties detailing the restrictions and requirements borne by each party with respect to confidentiality issues pertaining to information to be shared.
non-repudiation The ability to verify that an operation has been performed by a particular person or account. This is a system property that prevents the parties to a transaction from subsequently denying involvement in the transaction.
Oakley protocol A key exchange protocol that defines how to acquire authenticated keying material based on the Diffie-Hellman key exchange algorithm.
object identifier (OID) A standardized identifier mechanism for naming any object.
object reuse Assignment of a previously used medium to a subject. The security implication is that before it is provided to the subject, any data present from a previous user must be cleared.
one-time pad (OTP) An unbreakable encryption scheme in which a series of nonrepeating, random bits is used once as a key to encrypt a message. Since each pad is used only once, no pattern can be established and traditional cryptanalysis techniques are not effective.
Online Certificate Status Protocol (OCSP) A protocol used to request the revocation status of a digital certificate. This is an alternative to certificate revocation lists.
Open Authorization (OAUTH) An open standard for token-based authentication and authorization on the Internet.
Open Vulnerability and Assessment Language (OVAL) An XML-based standard for the communication of security information between tools and services.
operating system (OS) The basic software that handles input, output, display, memory management, and all the other highly detailed tasks required to support the user environment and associated applications.
OVAL See Open Vulnerability and Assessment Language.
Over the Air (OTA) Refers to performing an action wirelessly.
P12 See PKCS #12
PAC See Proxy Auto Configuration.
Packet Capture (PCAP) The methods and files associated with the capture of network traffic in the form of text files.
Padding Oracle on Downgraded Legacy Encryption (POODLE) A vulnerability in SSL 3.0 that can be exploited.
PAM See Pluggable Authentication Modules.
pan-tilt-zoom (PTZ) A term used to describe a video camera that supports remote directional and zoom control.
pass the hash attack An attack where the credentials are passed in hashed form to convince an object that permission has been granted.
password A string of characters used to prove an individual’s identity to a system or object. Used in conjunction with a user ID, it is the most common method of authentication. The password should be kept secret by the individual who owns it.
Password Authentication Protocol (PAP) A simple protocol used to authenticate a user to a network access server.
Password-Based Key Derivation Function 2 (PBKDF2) A key derivation function that is part of the RSA Laboratories Public Key Cryptography Standards, published as IETF RFC 2898.
patch A replacement set of code designed to correct problems or vulnerabilities in existing software.
PBX See private branch exchange.
peer-to-peer (P2P) A network connection methodology involving direct connection from peer to peer.
penetration testing A security test in which an attempt is made to circumvent security controls in order to discover vulnerabilities and weaknesses. Also called a pen test.
perfect forward security (PFS) A property of a cryptographic system whereby the loss of one key does not compromise material encrypted before or after its use.
permissions Authorized actions a subject can perform on an object. See also access controls.
personal electronic device (PED) A term used to describe an electronic device, owned by the user and brought into the enterprise, that uses enterprise data. This includes laptops, tablets, and mobile phones, to name a few.
personal exchange format (PFX) A file format used when exporting certificates.
personal health information (PHI) Information related to a person’s medical records, including financial, identification, and medical data.
Personal Identity Verification (PIV) Policies, procedures, hardware, and software used to securely identify federal workers.
personally identifiable information (PII) Information that can be used to identify a single person.
phreaking Used in the media to refer to the hacking of computer systems and networks associated with the phone company. See also cracking.
PKCS #12 A commonly used member of the family of standards called Public-Key Cryptography Standards (PKCS) published by RSA Laboratories.
Plain Old Telephone Service (POTS) The term used to describe the old analog phone service and later the “land-line” digital phone service.
plaintext In cryptography, a piece of data that is not encrypted. It can also mean the data input into an encryption algorithm that would output ciphertext.
Platform as a Service (PaaS) A third-party offering that allows customers to build, operate, and manage applications without having to manage the underlying infrastructure.
Pluggable Authentication Modules (PAM) A mechanism used in Linux systems to integrate low-level authentication methods into an API.
Point-to-Point Protocol (PPP) The Internet standard for transmission of IP packets over a serial line, as in a dial-up connection to an ISP.
Point-to-Point Protocol Extensible Authentication Protocol (PPP EAP) A PPP extension that provides support for additional authentication methods within PPP.
Point-to-Point Protocol Password Authentication Protocol (PPP PAP) A PPP extension that provides support for password authentication methods over PPP.
Point-to-Point Tunneling Protocol (PPTP) The use of generic routing encapsulation over PPP to create a methodology used for virtual private networking.
Port Address Translation (PAT) The manipulation of port information in an IP datagram at a point in the network to map ports in a fashion similar to Network Address Translation’s change of network address.
Post Office Protocol (POP) A standardized format for the exchange of e-mail.
pre-shared key (PSK) A shared secret that has been previously shared between parties and is used to establish a secure channel.
Pretty Good Privacy (PGP) A popular encryption program that has the ability to encrypt and digitally sign e-mail and files.
preventative intrusion detection A system that detects hostile actions or network activity and prevents them from impacting information systems.
privacy Protecting an individual’s personal information from those not authorized to see it.
Privacy-enhanced Electronic Mail (PEM) Internet standard that provides for secure exchange of e-mail using cryptographic functions.
private branch exchange (PBX) A telephone exchange that serves a specific business or entity.
privilege auditing The process of checking the rights and privileges assigned to a specific account or group of accounts.
privilege escalation The step in an attack where an attacker increases their privilege, preferably to administrator or root level.
privilege management The process of restricting a user’s ability to interact with the computer system.
Protected Extensible Authentication Protocol (PEAP) A protected version of EAP developed by Cisco, Microsoft, and RSA Security that functions by encapsulating the EAP frames in a TLS tunnel.
Proxy Auto Configuration (PAC) A method of automating the connection of web browsers to appropriate proxy services to retrieve a specific URL.
PSK See pre-shared key.
PTZ See pan-tilt-zoom.
public key cryptography See asymmetric encryption.
public key infrastructure (PKI) Infrastructure for binding a public key to a known user through a trusted intermediary, typically a certificate authority.
qualitative risk assessment The process of subjectively determining the impact of an event that affects a project, program, or business. It involves the use of expert judgment, experience, or group consensus to complete the assessment.
quantitative risk assessment The process of objectively determining the impact of an event that affects a project, program, or business. It usually involves the use of metrics and models to complete the assessment.
RADIUS Remote Authentication Dial-In User Service, a standard protocol for providing authentication services. It is commonly used in dial-up, wireless, and PPP environments.
RAID See Redundant Array of Inexpensive Disks.
rainbow tables A precomputed set of hash tables for matching passwords by searching rather than computing each on the fly.
rapid application development (RAD) A software development methodology that favors the use of rapid prototypes and changes as opposed to extensive advanced planning.
RAS See Remote Access Service/Server.
RBAC See rule-based access control or role-based access control.
RC4 A stream cipher used in TLS and WEP.
real-time operating system (RTOS) An operating system designed to work in a real-time environment.
Real-time Transport Protocol (RTP) A protocol for a standardized packet format used to carry audio and video traffic over IP networks.
Recovery Agent (RA) In Microsoft Windows environments, the entity authorized by the system to use a public key recovery certificate to decrypt other users’ files using a special private key function associated with the Encrypted File System (EFS).
recovery point objective (RPO) The amount of data that a business is willing to place at risk. It is determined by the amount of time a business has to restore a process before an unacceptable amount of data loss results from a disruption.
recovery time objective (RTO) The amount of time a business has to restore a process before unacceptable outcomes result from a disruption.
Redundant Array of Inexpensive Disks (RAID) The use of an array of disks arranged in a single unit of storage for increasing storage capacity, redundancy, and performance characteristics.
refactoring The process of restructuring existing computer code without changing its external behavior to improve nonfunctional attributes of the software, such as improving code readability and/or reducing complexity.
registration authority (RA) Part of the PKI system responsible for establishing registration parameters during the creation of a certificate.
Remote Access Service/Server (RAS) A combination of hardware and software used to enable remote access to a network.
remote-access Trojan (RAT) A set of malware designed to exploit a system providing remote access.
remotely triggered black hole (RTBH) A popular and effective filtering technique for the mitigation of denial-of-service attacks.
replay attack The reusing of data during an attack to cause a system to respond based on previous acts.
repudiation The act of denying that a message was either sent or received.
residual risk Risks remaining after an iteration of risk management.
return on investment (ROI) A measure of the effectiveness of the use of capital.
RFID Radio frequency identification, a technology used for remote identification via radio waves.
RIPEMD A hash function developed in Belgium. The acronym expands to RACE Integrity Primitives Evaluation Message Digest, but this name is rarely used. The current version is RIPEMD-160.
risk The possibility of suffering a loss.
risk assessment or risk analysis The process of analyzing an environment to identify the threats, vulnerabilities, and mitigating actions to determine (either quantitatively or qualitatively) the impact of an event affecting a project, program, or business.
risk management Overall decision-making process of identifying threats and vulnerabilities and their potential impacts, determining the costs to mitigate such events, and deciding what cost-effective actions can be taken to control these risks.
Rivest, Shamir, Adleman (RSA) The names of the three men who developed a public key cryptographic system and the company they founded to commercialize the system.
role-based access control (RBAC) An access control mechanism in which, instead of the users being assigned specific access permissions for the objects associated with the computer system or network, a set of roles that the user may perform is assigned to each user.
RTP See Real-time Transport Protocol.
rule-based access control (RBAC) An access control mechanism based on rules.
safeguard See security controls.
SAN See storage area network.
SCADA See supervisory control and data acquisition.
SCEP See Simple Certificate Enrollment Protocol.
Secure Copy Protocol (SCP) A network protocol that supports secure file transfers.
Secure FTP A method of secure file transfer that involves the tunneling of FTP through an SSH connection. This is different than SFTP, which is the Secure Shell File Transfer Protocol.
Secure Hash Algorithm (SHA) A hash algorithm used to hash block data. The first version is SHA-1, with subsequent versions detailing hash digest length: SHA-256, SHA-384, and SHA-512.
Secure Hypertext Transfer Protocol (SHTTP) An alternative to HTTPS, in which only the transmitted pages and POST fields are encrypted. Rendered moot, by and large, by widespread adoption of HTTPS.
Secure/Multipurpose Internet Mail Extensions (S/MIME) An encrypted implementation of the MIME protocol specification.
Secure Real-time Transport Protocol (SRTP) A secure version of the standard protocol for a standardized packet format used to carry audio and video traffic over IP networks.
Secure Shell (SSH) A set of protocols for establishing a secure remote connection to a computer. This protocol requires a client on each end of the connection and can use a variety of encryption protocols.
Secure Shell File Transfer Protocol (SFTP) A secure file transfer subsystem associated with Secure Shell (SSH).
Secure Sockets Layer (SSL) An encrypting layer between the session and transport layers of the OSI model designed to encrypt above the transport layer, enabling secure sessions between hosts. SSL has been replaced by TLS.
Security Assertion Markup Language (SAML) An XML-based standard for exchanging authentication and authorization data.
security association (SA) An instance of security policy and keying material applied to a specific data flow. Both IKE and IPsec use SAs, although these SAs are independent of one another. IPsec SAs are unidirectional and are unique in each security protocol, whereas IKE SAs are bidirectional. A set of SAs is needed for a protected data pipe, one per direction per protocol. SAs are uniquely identified by destination (IPsec endpoint) address, security protocol (AH or ESP), and security parameter index (SPI).
security baseline The end result of the process of establishing an information system’s security state. It is a known good configuration resistant to attacks and information theft.
security content automation protocol (SCAP) A method of using specific protocols and data exchanges to automate the determination of vulnerability management, measurement, and policy compliance across a system or set of systems.
security controls A group of technical, management, or operational policies and procedures designed to implement specific security functionality. Access controls are an example of a security control.
security information and event management (SIEM) The name used for a broad range of technological solutions to the collection and analysis of security-related information across the enterprise.
segregation or separation of duties A basic control that prevents or detects errors and irregularities by assigning job responsibilities for increased risk tasks to different individuals so that no single individual can commit fraudulent or malicious actions.
self-encrypting drive (SED) A data drive that has built-in encryption capability on the drive control itself.
Sender Policy Framework (SPF) An e-mail validation system designed to detect e-mail spoofing by verifying that incoming mail comes from a host authorized by that domain’s administrators.
service level agreement (SLA) An agreement between parties concerning the expected or contracted uptime associated with a system.
service set identifier (SSID) Identifies a specific 802.11 wireless network. It transmits information about the access point to which the wireless client is connecting.
session hijacking An attack against a communication session by injecting packets into the middle of the communication session.
shielded twisted pair (STP) A physical network connection consisting of two wires twisted and covered with a shield to prevent interference.
shimming The process of putting a layer of code between the driver and the OS to allow flexibility and portability.
Short Message Service (SMS) A form of text messaging over phone and mobile phone circuits that allows up to 160-character messages to be carried over signaling channels.
shoulder surfing Stealing of credentials by looking over someone’s shoulder while they type them into a system.
signature database A collection of activity patterns that have already been identified and categorized and that typically indicate suspicious or malicious activity.
Simple Certificate Enrollment Protocol (SCEP) A protocol used in PKI for enrollment and other services.
Simple Mail Transfer Protocol (SMTP) The standard Internet protocol used to transfer e-mail between hosts.
Simple Mail Transfer Protocol Secure (SMTPS) The secure version of the standard Internet protocol used to transfer e-mail between hosts.
Simple Network Management Protocol (SNMP) A standard protocol used to remotely manage network devices across a network.
Simple Object Access Protocol (SOAP) An XML-based specification for exchanging information associated with web services.
single loss expectancy (SLE) Monetary loss or impact of each occurrence of a threat. SLE = asset value × exposure factor.
single point of failure (SPoF) A single system component whose failure can result in system failure.
single sign-on (SSO) An authentication process by which the user can enter a single user ID and password and then move from application to application or resource to resource without having to supply further authentication information.
slack space Unused space on a disk drive created when a file is smaller than the allocated unit of storage (such as a sector).
small computer system interface (SCSI) A protocol for data transfer to and from a machine.
SMS See Short Message Service.
sniffer A software or hardware device used to observe network traffic as it passes through a network on a shared broadcast media.
social engineering The art of deceiving another person so that he or she reveals confidential information. This is often accomplished by posing as an individual who should be entitled to have access to the information.
Software as a Service (SaaS) The provisioning of software as a service, commonly known as on-demand software.
software-defined networking (SDN) The use of software to act as a control layer separate from the data layer in a network to manage traffic.
software development kit (SDK) A set of tools and processes used to interface with a larger system element when programming changes to an environment.
software development lifecycle (SDLC) The processes and procedures employed to develop software.
software development lifecycle methodology (SDLM) The processes and procedures employed to develop software. Sometimes also called secure development lifecycle model when security is part of the development process.
solid-state drive (SSD) A mass storage device, such as a hard drive, that is composed of electronic memory as opposed to a physical device of spinning platters.
SONET See Synchronous Optical Network Technologies.
spam E-mail that is not requested by the recipient and is typically of a commercial nature. Also known as unsolicited commercial e-mail (UCE).
spam filter A security appliance designed to remove spam at the network layer before it enters e-mail servers.
spear phishing A phishing attack aimed at a specific individual.
spim Spam sent over an instant messaging channel.
spoofing Making data appear to have originated from another source so as to hide the true origin from the recipient.
SSD See solid-state drive.
storage area network (SAN) A dedicated network that provides access to data storage.
STP See shielded twisted pair.
Structured Exception Handler (SEH) The process used to handle exceptions in the Windows OS core functions.
Structured Query Language (SQL) A language used in relational database queries.
Subject Alternative Name (SAN) A field on a certificate that identifies alternative names for the entity to which the certificate applies.
Subscriber Identity Module (SIM) An integrated circuit or hardware element that securely stores the International Mobile Subscriber Identity (IMSI) and the related key used to identify and authenticate subscribers on mobile telephones.
supervisory control and data acquisition (SCADA) A generic term used to describe the industrial control system networks used to interconnect infrastructure elements (such as manufacturing plants, oil and gas pipelines, power generation and distribution systems, and so on) and computer systems.
symmetric encryption Encryption that needs all parties to have a copy of the key, sometimes called a shared secret. The single key is used for both encryption and decryption.
Synchronous Optical Network Technologies (SONET) A set of standards used for data transfers over optical networks.
system on a chip (SoC) The integration of complete system functions on a single chip, simplifying construction of devices.
tailgating The act of following an authorized person through a doorway without using your own credentials.
tangible asset An asset for which a monetary equivalent can be determined. Examples are inventory, buildings, cash, hardware, software, and so on.
Telnet A network protocol used to provide cleartext bidirectional communication over TCP.
Temporal Key Integrity Protocol (TKIP) A security protocol used in 802.11 wireless networks.
Terminal Access Controller Access Control System Plus (TACACS+) A remote authentication system that uses the TACACS+ protocol, defined in RFC 1492, and TCP port 49.
threat Any circumstance or event with the potential to cause harm to an asset.
ticket-granting ticket (TGT) A part of the Kerberos authentication system that is used to prove identity when requesting service tickets.
Time-based One-Time Password (TOTP) A password that is used once and is only valid during a specific time period.
time bomb A form of logic bomb in which the triggering event is a date or specific time. See also logic bomb.
TKIP See Temporal Key Integrity Protocol.
token A hardware device that can be used in a challenge-response authentication process.
Transaction Signature (TSIG) A protocol used as a means of authenticating dynamic DNS records during DNS updates.
Transmission Control Protocol/Internet Protocol (TCP/IP) A connection-oriented protocol for communication over IP networks.
Transport Layer Security (TLS) A replacement for SSL that is currently being used to secure communications between servers and browsers.
trapdoor See backdoor.
Trivial File Transfer Protocol (TFTP) A simplified version of FTP used for low-overhead file transfers using UDP port 69.
Trojan horse A form of malicious code that appears to provide one service (and may indeed provide that service) but that also hides another purpose. This hidden purpose often has a malicious intent. This code may also be simply referred to as a Trojan.
Trusted Platform Module (TPM) A hardware chip to enable trusted computing platform operations.
typo squatting An attack form that involves capitalizing upon common typo errors at the URL level, hoping the browser user will not notice they end up on a different site.
Unified Extensible Firmware Interface (UEFI) A specification that defines the interface between an OS and the hardware firmware. This is a replacement to BIOS.
unified threat management (UTM) The aggregation of multiple network security products into a single appliance for efficiency purposes.
Uniform Resource Identifier (URI) A set of characters used to identify the name of a resource in a computer system. A URL is a form of URI.
uninterruptible power supply (UPS) A source of power (generally a battery) designed to provide uninterrupted power to a computer system in the event of a temporary loss of power.
Universal Resource Locator (URL) A specific character string used to point to a specific item across the Internet.
Universal Serial Bus (USB) An industry-standard protocol for communication over a cable to peripherals via a standard set of connectors.
Universal Serial Bus On the Go (USB OTG) A USB standard that enables mobile devices to talk to one another without an intervening PC
unmanned aerial vehicle (UAV) A remotely piloted flying vehicle.
unshielded twisted pair (UTP) A physical connection consisting of a pair of twisted wires forming a circuit.
usage auditing The process of recording who did what and when on an information system.
user acceptance testing (UAT) The application of acceptance-testing criteria to determine fitness for use according to end-user requirements.
User Datagram Protocol (UDP) A protocol in the TCP/IP protocol suite for the transport layer that does not sequence packets—it is “fire and forget” in nature.
user ID A unique alphanumeric identifier that identifies individuals who are logging in or accessing a system.
vampire tap A tap that connects to a network line without cutting the connection.
Variable Length Subnet Masking (VLSM) The process of using variable length subnets, creating subnets in subnets.
video teleconferencing (VTC) A business process of using video signals to carry audio and visual signals between separate locations, thus allowing participants to meet via a virtual meeting instead of traveling to a physical location. Modern videoconferencing equipment can provide very realistic connectivity when lighting and backgrounds are controlled.
Virtual Desktop Environment (VDE) The use of virtualization technology to host desktop systems on a centralized server.
virtual desktop infrastructure (VDI) The use of servers to host virtual desktops by moving the processing to the server and using the desktop machine as merely a display terminal. VDI offers operating efficiencies as well as cost and security benefits.
virtual local area network (VLAN) A broadcast domain inside a switched system.
virtual machine (VM) A form of a containerized operating system that allows a system to be run on top of another OS.
virtual private network (VPN) An encrypted network connection across another network, offering a private communication channel across a public medium.
virus A form of malicious code or software that attaches itself to other pieces of code in order to replicate. Viruses may contain a payload, which is a portion of the code that is designed to execute when a certain condition is met (such as on a certain date). This payload is often malicious in nature.
vishing A form of social engineering attack over voice lines (VoIP).
Voice over IP (VoIP) The packetized transmission of voice signals (telephony) over Internet Protocol.
vulnerability A weakness in an asset that can be exploited by a threat to cause harm.
watering hole attack The infecting of a specific target website, one that users trust and go to on a regular basis, with malware.
whaling A phishing attack targeted against a high value target like a corporate officer or system administrator.
wireless access point (WAP) A network access device that facilitates the connection of wireless devices to a network.
war dialing An attacker’s attempt to gain unauthorized access to a computer system or network by discovering unprotected connections to the system through the telephone system and modems.
war driving The attempt by an attacker to discover unprotected wireless networks by wandering (or driving) around with a wireless device, looking for available wireless access points.
web application firewall (WAF) A firewall that operates at the application level, specifically designed to protect web applications by examining requests at the application stack level.
WEP See Wired Equivalent Privacy.
wide area network (WAN) A network that spans a large geographic region.
Wi-Fi Protected Access/Wi-Fi Protected Access 2 (WPA/WPA2) A protocol to secure wireless communications using a subset of the 802.11i standard.
Wi-Fi Protected Setup (WPS) A network security standard that allows easy setup of a wireless home network.
Wired Equivalent Privacy (WEP) The encryption scheme used to attempt to provide confidentiality and data integrity on 802.11 networks.
Wireless Application Protocol (WAP) A protocol for transmitting data to small handheld devices such as cellular phones.
wireless intrusion detection system (WIDS) An intrusion detection system established to cover a wireless network.
wireless intrusion prevention system (WIPS) An intrusion prevention system established to cover a wireless network.
Wireless Transport Layer Security (WTLS) The encryption protocol used on WAP networks.
worm An independent piece of malicious code or software that self-replicates. Unlike a virus, it does not need to be attached to another piece of code. A worm replicates by breaking into another system and making a copy of itself on this new system. A worm can contain a destructive payload but does not have to.
write once read many (WORM) A data storage technology where things are written once (permanent) and then can be read many times, as in optical disks.
X.509 The standard format for digital certificates.
XML See Extensible Markup Language.
XOR Bitwise exclusive OR, an operation commonly used in cryptography.
XSRF See cross-site request forgery.
XSS See cross-site scripting.
zero day A vulnerability for which there is no previous knowledge.