├── Contributing.md ├── Getting Started with AWS.java ├── README.md └── Security Glossary.md /Contributing.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | **Make sure your pull request follows these guidelines:** 4 | 5 | - Search through the previous pull requests before making a new one! 6 | - Adding new categories, or improving existing categories is welcome! 7 | - Make sure you've personally used or benefited from the suggested resource. 8 | - Make an individual pull request for each suggestion. 9 | - Use the following format: `[Resource Title](url link) — description.` 10 | - Expand on why the resource is useful in your pull request if needed. 11 | - Keep descriptions short and simple, but descriptive. 12 | - Please double check your spelling and grammar. 13 | 14 | **Thanks for contributing to this Project!** 15 | -------------------------------------------------------------------------------- /Getting Started with AWS.java: -------------------------------------------------------------------------------- 1 | Code samples & snippets coming soon! 2 | 3 | //Setting up your Amazon EC2 Linux instances. 4 | 5 | 6 | 7 | //Setting up your Amazon EC2 Windows instances. 8 | -------------------------------------------------------------------------------- /Security Glossary.md: -------------------------------------------------------------------------------- 1 | A list of Key Information Security Terms for Software and Hardware. **Sources:** [NIST Federal Information Processing Standards (FIPS)](https://csrc.nist.gov/publications/fips), the [Special Publication (SP) 800 series](https://csrc.nist.gov/publications/sp), [NIST Interagency Reports (NISTIRs)](https://csrc.nist.gov/publications/nistir), and from the [Committee for National Security Systems Instruction 4009 (CNSSI-4009)](https://www.cnss.gov/CNSS/issuances/Instructions.cfm). 2 | 3 | 4 | A 5 | 6 | Access – Ability and means to communicate with or otherwise interact with a system, to use system resources to handle information, to gain knowledge of the information the system contains, or to control system components and functions. 7 | SOURCE: CNSSI-4009 8 | 9 | Access Authority – An entity responsible for monitoring and granting access privileges for other authorized entities. 10 | SOURCE: CNSSI-4009 11 | 12 | Access Control – The process of granting or denying specific requests to: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., federal buildings, military establishments, border crossing entrances). 13 | SOURCE: FIPS 201; CNSSI-4009 14 | 15 | Access Control List (ACL) – 16 | * 1. A list of permissions associated with an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object. 17 | * 2. A mechanism that implements access control for a system resource by enumerating the system entities that are permitted to access the resource and stating, either implicitly or explicitly, the access modes granted to each entity. 18 | SOURCE: CNSSI-4009 19 | 20 | Access Control Lists (ACLs) – A register of: 21 | * 1. users (including groups, machines, processes) who have been given permission to use a particular system resource, and 22 | * 2. the types of access they have been permitted. 23 | SOURCE: SP 800-12 24 | 25 | Access Control Mechanism – Security safeguards (i.e., hardware and software features, physical controls, operating procedures, management procedures, and various combinations of these) designed to detect and deny unauthorized 26 | access and permit authorized access to an information system. 27 | SOURCE: CNSSI-4009 28 | 29 | Access Level – A category within a given security classification limiting entry or 30 | system connectivity to only authorized persons. 31 | SOURCE: CNSSI-4009 32 | 33 | Access List – Roster of individuals authorized admittance to a controlled area. 34 | SOURCE: CNSSI-4009 35 | 36 | Access Point – A device that logically connects wireless client devices operating in infrastructure to one another and provides access to a distribution system, if connected, which is typically an organization’s enterprise wired network. 37 | SOURCE: SP 800-48; SP 800-121 38 | 39 | Access Profile – Association of a user with a list of protected objects the user may access. 40 | SOURCE: CNSSI-4009 41 | 42 | Access Type – Privilege to perform action on an object. Read, write, execute, append, modify, delete, and create are examples of access types. 43 | SOURCE: CNSSI-4009 44 | 45 | Activation Data – Private data, other than keys, that are required to access cryptographic modules. 46 | SOURCE: SP 800-32 47 | 48 | Active Attack – An attack that alters a system or data. 49 | SOURCE: CNSSI-4009 50 | 51 | Active Content – Software in various forms that is able to automatically carry out or trigger actions on a computer platform without the intervention of a user. 52 | SOURCE: CNSSI-4009 53 | 54 | Active Security Testing – Security testing that involves direct interaction with a target, such as sending packets to a target. 55 | SOURCE: SP 800-115 56 | 57 | Advanced Encryption Standard – (AES) The Advanced Encryption Standard specifies a U.S. government-approved cryptographic algorithm that can be used to protect electronic data. The AES algorithm is a symmetric block cipher that can encrypt (encipher) and decrypt (decipher) information. This standard specifies the Rijndael algorithm, a symmetric block cipher that can process data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits. 58 | SOURCE: FIPS 197 59 | 60 | B 61 | 62 | Blacklisting – The process of the system invalidating a user ID based on the user’s inappropriate actions. A blacklisted user ID cannot be used to log on to the system, even with the correct authenticator. Blacklisting and lifting of a blacklisting are both security-relevant events. Blacklisting also applies to blocks placed against IP addresses to prevent inappropriate or unauthorized use of Internet resources. 63 | SOURCE: CNSSI-4009 64 | 65 | Blue Team – 66 | * 1. The group responsible for defending an enterprise’s use of 67 | information systems by maintaining its security posture against a 68 | group of mock attackers (i.e., the Red Team). Typically the Blue 69 | Team and its supporters must defend against real or simulated 70 | attacks 1) over a significant period of time, 2) in a representative 71 | operational context (e.g., as part of an operational exercise), and 3) 72 | according to rules established and monitored with the help of a 73 | neutral group refereeing the simulation or exercise (i.e., the White 74 | Team). 75 | * 2. The term Blue Team is also used for defining a group of 76 | individuals that conduct operational network vulnerability 77 | evaluations and provide mitigation techniques to customers who have 78 | a need for an independent technical review of their network security 79 | posture. The Blue Team identifies security threats and risks in the 80 | operating environment, and in cooperation with the customer, 81 | analyzes the network environment and its current state of security 82 | readiness. Based on the Blue Team findings and expertise, 83 | they provide recommendations that integrate into an overall 84 | community security solution to increase the customer's cyber security 85 | readiness posture. Often times a Blue Team is employed by itself or 86 | prior to a Red Team employment to ensure that the customer's 87 | networks are as secure as possible before having the Red Team test 88 | the systems. 89 | SOURCE: CNSSI-4009 90 | 91 | Body of Evidence (BoE) – The set of data that documents the information system’s adherence to the security controls applied. The BoE will include a Requirements Verification Traceability Matrix (RVTM) delineating where the selected security controls are met and evidence to that fact can be found. The BoE content required by an Authorizing Official will be adjusted according to the impact levels selected. 92 | SOURCE: CNSSI-4009 93 | 94 | Boundary – Physical or logical perimeter of a system. 95 | SOURCE: CNSSI-4009 96 | 97 | C 98 | 99 | Capstone Policies – Those policies that are developed by governing or coordinating institutions of Health Information Exchanges (HIEs). They provide overall requirements and guidance for protecting health information within those HIEs. Capstone Policies must address the requirements imposed by: (1) all laws, regulations, and guidelines at the federal, state, and local levels; (2) business needs; and (3) policies at the institutional and HIE levels. 100 | SOURCE: NISTIR-7497 101 | 102 | Capture – The method of taking a biometric sample from an end user. 103 | Source: FIPS 201 104 | 105 | Certificate Management – Process whereby certificates (as defined above) are generated, stored, protected, transferred, loaded, used, and destroyed. 106 | SOURCE: CNSSI-4009 107 | 108 | Certificate Management Authority – A Certification Authority (CA) or a Registration Authority (RA). 109 | SOURCE: SP 800-32 110 | 111 | Certificate Policy (CP) – A specialized form of administrative policy tuned to electronic transactions performed during certificate management. A Certificate Policy addresses all aspects associated with the generation, production, distribution, accounting, compromise recovery, and administration of digital certificates. Indirectly, a certificate policy can also govern the transactions conducted using a communications system protected by a certificate-based security system. By controlling critical certificate extensions, such policies and associated enforcement technology can support provision of the security services required by particular applications. 112 | SOURCE: CNSSI-4009; SP 800-32 113 | 114 | Certification Practice Statement – A statement of the practices that a Certification Authority employs in issuing, suspending, revoking, and renewing certificates and providing access to them, in accordance with specific requirements (i.e., requirements specified in this Certificate Policy, or requirements specified in a contract for services). 115 | SOURCE: SP 800-32; CNSSI-4009 116 | 117 | Certification Test and Evaluation – Software and hardware security tests conducted during development of an information system. 118 | SOURCE: CNSSI-4009 119 | 120 | Checksum – Value computed on data to detect error or manipulation. 121 | SOURCE: CNSSI-4009 122 | 123 | Cloud Computing - A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service Provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models 124 | SOURCE(s): NISTIR 8006 under Cloud computing from NIST SP 800-145 - Adapted 125 | 126 | Cryptographic Initialization – Function used to set the state of a cryptographic logic prior to key generation, encryption, or other operating mode. 127 | SOURCE: CNSSI-4009 128 | 129 | Cryptographic Key – A value used to control cryptographic operations, such as decryption, encryption, signature generation, or signature verification. 130 | SOURCE: SP 800-63 131 | 132 | D 133 | 134 | Data – A subset of information in an electronic format that allows it to be retrieved or transmitted. 135 | SOURCE: CNSSI-4009 136 | 137 | Data Aggregation – Compilation of individual data systems and data that could result in the totality of the information being classified, or classified at a higher level, or of beneficial use to an adversary. 138 | SOURCE: CNSSI-4009 139 | 140 | Data Origin Authentication – The process of verifying that the source of the data is as claimed and that the data has not been modified. 141 | SOURCE: CNSSI-4009 142 | 143 | Data Security – Protection of data from unauthorized (accidental or intentional) modification, destruction, or disclosure. 144 | SOURCE: CNSSI-4009 145 | 146 | Data Transfer Device (DTD) – Fill device designed to securely store, transport, and transfer electronically both COMSEC and TRANSEC key, designed to be backward compatible with the previous generation of COMSEC common fill devices, and programmable to support modern mission systems. 147 | SOURCE: CNSSI-4009 148 | 149 | Denial of Service (DoS) – The prevention of authorized access to resources or the delaying of time-critical operations. (Time-critical may be milliseconds or it may be hours, depending upon the service provided.) 150 | SOURCE: CNSSI-4009 151 | 152 | Differential Power Analysis – An analysis of the variations of the electrical power consumption of a cryptographic module, using advanced statistical methods and/or other techniques, for the purpose of extracting information correlated to cryptographic keys used in a cryptographic algorithm. 153 | SOURCE: FIPS 140-2 154 | 155 | Digital Evidence – Electronic information stored or transferred in digital form. 156 | SOURCE: SP 800-72 157 | 158 | Digital Forensics – The application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data. 159 | SOURCE: SP 800-86 160 | 161 | Digital Signature – An asymmetric key operation where the private key is used to digitally sign data and the public key is used to verify the signature. Digital signatures provide authenticity protection, integrity protection, and non-repudiation. 162 | SOURCE: SP 800-63 163 | 164 | Disaster Recovery Plan (DRP) – A written plan for recovering one or more information systems at an alternate facility in response to a major hardware or software failure or destruction of facilities. 165 | SOURCE: SP 800-34 166 | 167 | E 168 | 169 | Embedded Cryptographic System – Cryptosystem performing or controlling a function as an integral element of a larger system or subsystem. 170 | SOURCE: CNSSI-4009 171 | 172 | Embedded Cryptography - Cryptography engineered into an equipment or system whose basic function is not cryptographic. 173 | SOURCE: CNSSI-4009 174 | 175 | Encipher – Convert plain text to cipher text by means of a cryptographic system. 176 | SOURCE: CNSSI-4009 177 | 178 | Encode – Convert plain text to cipher text by means of a code. 179 | SOURCE: CNSSI-4009 180 | 181 | Encrypt – Generic term encompassing encipher and encode. 182 | SOURCE: CNSSI-4009 183 | 184 | Encrypted Key – A cryptographic key that has been encrypted using an Approved security function with a key encrypting key, a PIN, or a password in order to disguise the value of the underlying plaintext key. 185 | SOURCE: FIPS 140-2 186 | 187 | Encrypted Network – A network on which messages are encrypted (e.g., using DES, AES, or other appropriate algorithms) to prevent reading by unauthorized parties. 188 | SOURCE: SP 800-32 189 | 190 | Encryption – Conversion of plaintext to ciphertext through the use of a cryptographic algorithm. 191 | SOURCE: FIPS 185 192 | 193 | End-to-End Encryption – Encryption of information at its origin and decryption at its intended destination without intermediate decryption. 194 | SOURCE: CNSSI-4009 195 | 196 | End-to-End Security – Safeguarding information in an information system from point of origin to point of destination. 197 | SOURCE: CNSSI-4009 198 | 199 | F 200 | 201 | [Federal Risk and Authorization Management Program (FedRAMP)](https://www.gsa.gov/technology/government-it-initiatives/fedramp) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FedRAMP empowers agencies to use modern cloud technologies, with emphasis on security and protection of federal information, and helps accelerate the adoption of secure, cloud solutions. 202 | 203 | [Federal Information Security Management Act (FISMA)](https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma) is a United States federal law that defines a comprehensive framework to protect government information, operations, and assets against natural and manmade threats. This risk management framework was signed into law as part of the Electronic Government Act of 2002. Since 2002, FISMA's scope has widened to apply to state agencies that administer federal programs, or private businesses and service providers that hold a contract with the U.S. government. 204 | 205 | False Positive – An alert that incorrectly indicates that malicious activity is occurring. 206 | SOURCE: SP 800-61 207 | 208 | False Rejection – In biometrics, the instance of a security system failing to verify or identify an authorized person. It does not necessarily indicate a flaw in the biometric system; for example, in a fingerprint-based system, an incorrectly aligned finger on the scanner or dirt on the scanner can result in the scanner misreading the fingerprint, causing a false rejection of the authorized user. 209 | SOURCE: CNSSI-4009 210 | 211 | Federal Information Processing Standard (FIPS) – A standard for adoption and use by federal departments and agencies that has been developed within the Information Technology Laboratory and published by the National Institute of Standards and Technology, a part of the U.S. Department of Commerce. A FIPS covers some topic in information technology in order to achieve a common level of quality or some level of interoperability. 212 | SOURCE: FIPS 201 213 | 214 | File Encryption – The process of encrypting individual files on a storage medium and permitting access to the encrypted data only after proper authentication is provided. 215 | SOURCE: SP 800-111 216 | 217 | File Name Anomaly – 218 | * 1. A mismatch between the internal file header and its external 219 | extension. 220 | * 2. A file name inconsistent with the content of the file (e.g., renaming 221 | a graphics file with a non-graphical extension. 222 | SOURCE: SP 800-72 223 | 224 | File Protection – Aggregate of processes and procedures designed to inhibit unauthorized access, contamination, elimination, modification, or destruction of a file or any of its contents. 225 | SOURCE: CNSSI-4009 226 | 227 | File Security – Means by which access to computer files is limited to authorized users only. 228 | SOURCE: CNSSI-4009 229 | 230 | Firewall – A gateway that limits access between networks in accordance with local security policy. 231 | SOURCE: SP 800-32 232 | 233 | Forensics – The practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data. 234 | SOURCE: CNSSI-4009 235 | 236 | G 237 | 238 | Gateway – Interface providing compatibility between networks by converting transmission speeds, protocols, codes, or security measures. 239 | SOURCE: CNSSI-4009 240 | 241 | H 242 | 243 | Handshaking Procedures – Dialogue between two information systems for synchronizing, identifying, and authenticating themselves to one another. 244 | SOURCE: CNSSI-4009 245 | 246 | Hard Copy Key – Physical keying material, such as printed key lists, punched or printed key tapes, or programmable, read-only memories (PROM). 247 | SOURCE: CNSSI-4009 248 | 249 | Hardening – Configuring a host’s operating systems and applications to reduce the host’s security weaknesses. 250 | SOURCE: SP 800-123 251 | 252 | Hardware – The physical components of an information system. 253 | SOURCE: CNSSI-4009 254 | 255 | High Availability – A failover feature to ensure availability during device or component interruptions. 256 | SOURCE: SP 800-113 257 | 258 | I 259 | 260 | Identification – The process of verifying the identity of a user, process, or device, usually as a prerequisite for granting access to resources in an IT system. 261 | SOURCE: SP 800-47 262 | 263 | Identifier – Unique data used to represent a person’s identity and associated attributes. A name or a card number are examples of identifiers. 264 | SOURCE: FIPS 201 265 | 266 | Identity – A set of attributes that uniquely describe a person within a given context. 267 | SOURCE: SP 800-63 268 | 269 | Identity – The set of physical and behavioral characteristics by which an individual is uniquely recognizable. 270 | SOURCE: FIPS 201 271 | 272 | Identity Token – Smart card, metal key, or other physical object used to authenticate identity. 273 | SOURCE: CNSSI-4009 274 | 275 | Identity Validation – Tests enabling an information system to authenticate users or resources. 276 | SOURCE: CNSSI-4009 277 | 278 | Incident – A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. 279 | SOURCE: SP 800-61 280 | 281 | Intellectual Property – Creations of the mind such as musical, literary, and artistic works; inventions; and symbols, names, images, and designs used in commerce, including copyrights, trademarks, patents, and related rights. Under intellectual property law, the holder of one of these abstract “properties” has certain exclusive rights to the creative work, commercial symbol, or invention by which it is covered. 282 | SOURCE: CNSSI-4009 283 | 284 | Internet Protocol (IP) – Standard protocol for transmission of data from source to destinations in packet-switched communications networks and interconnected systems of such networks. 285 | SOURCE: CNSSI-4009 286 | 287 | Intranet – A private network that is employed within the confines of a given enterprise (e.g., internal to a business or agency). 288 | SOURCE: CNSSI-4009 289 | 290 | Intrusion – Unauthorized act of bypassing the security mechanisms of a system. 291 | SOURCE: CNSSI-4009 292 | 293 | Intrusion Detection Systems (IDS) – Hardware or software product that gathers and analyzes information from various areas within a computer or a network to identify possible security breaches, which include both intrusions (attacks from outside the organizations) and misuse (attacks from within the organizations.) 294 | SOURCE: CNSSI-4009 295 | 296 | J 297 | 298 | Jamming – An attack in which a device is used to emit electromagnetic energy on a wireless network’s frequency to make it unusable. 299 | SOURCE: SP 800-48 300 | 301 | K 302 | 303 | Kerberos – A means of verifying the identities of principals on an open network. It accomplishes this without relying on the authentication, trustworthiness, or physical security of hosts while assuming all packets can be read, modified and inserted at will. It uses a trust broker model and symmetric cryptography to provide authentication and authorization of users and systems on the network. 304 | SOURCE: SP 800-95 305 | 306 | Key – A value used to control cryptographic operations, such as decryption, encryption, signature generation, or signature verification. 307 | SOURCE: SP 800-63 308 | 309 | Key Logger – A program designed to record which keys are pressed on a computer keyboard used to obtain passwords or encryption keys and thus bypass other security measures. 310 | SOURCE: SP 800-82 311 | 312 | L 313 | 314 | Least Privilege – The security objective of granting users only those accesses they need to perform their official duties. 315 | SOURCE: SP 800-12 316 | 317 | Level of Protection – Extent to which protective measures, techniques, and procedures must be applied to information systems and networks based on risk, threat, vulnerability, system interconnectivity considerations, and information assurance needs. Levels of protection are: 318 | * 1. Basic: information systems and networks requiring implementation of standard minimum security countermeasures. 319 | * 2. Medium: information systems and networks requiring layering of additional safeguards above the standard minimum security countermeasures. 320 | * 3. High: information systems and networks requiring the most stringent protection and rigorous security countermeasures. 321 | SOURCE: CNSSI-4009 322 | 323 | Likelihood of Occurrence – In Information Assurance risk analysis, a weighted factor based on a subjective analysis of the probability that a given threat is capable of exploiting a given vulnerability. 324 | SOURCE: CNSSI-4009 325 | 326 | M 327 | 328 | Malicious Code – Software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. A virus, worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code. 329 | SOURCE: SP 800-53; CNSSI-4009 330 | 331 | Malware – A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system or of otherwise annoying or disrupting the victim. 332 | SOURCE: SP 800-83 333 | 334 | Man-in-the-middle Attack (MitM) – A form of active wiretapping attack in which the attacker intercepts and selectively modifies communicated data to masquerade as one or more of the entities involved in a communication association. 335 | SOURCE: CNSSI-4009 336 | 337 | Mandatory Access Control (MAC) – A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (i.e., clearance) of users to access information of such sensitivity. 338 | SOURCE: SP 800-44 339 | 340 | Mandatory Access Control – Access controls (which) are driven by the results of a comparison between the user’s trust level or clearance and the sensitivity designation of the information. 341 | SOURCE: FIPS 191 342 | 343 | Masquerading –When an unauthorized agent claims the identity of another agent, it is said to be masquerading. 344 | SOURCE: SP 800-19 345 | 346 | Multilevel Security (MLS) – A concept of processing information with different classifications and categories that simultaneously permits access by users with different security clearances and denies access to users who lack authorization. 347 | SOURCE: CNSSI-4009 348 | 349 | N 350 | 351 | Needs Assessment (IT Security Awareness and Training) – A process that can be used to determine an organization’s awareness and training needs. The results of a needs assessment can provide justification to convince management to allocate adequate resources 352 | to meet the identified awareness and training needs. 353 | SOURCE: SP 800-50 354 | 355 | Network – Information system(s) implemented with a collection of interconnected components. Such components may include routers, 356 | hubs, cabling, telecommunications controllers, key distribution centers, and technical control devices. 357 | SOURCE: SP 800-53; CNSSI-4009 358 | 359 | Network Access – Access to an organizational information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, Internet). 360 | SOURCE: SP 800-53; CNSSI-4009 361 | 362 | Network Access Control (NAC) – A feature provided by some firewalls that allows access based on a user’s credentials and the results of health checks performed on the telework client device. 363 | SOURCE: SP 800-41 364 | 365 | Network Address Translation (NAT) – A routing technology used by many firewalls to hide internal system addresses from an external network through use of an addressing schema. 366 | SOURCE: SP 800-41 367 | 368 | O 369 | 370 | Object Identifier – A specialized formatted number that is registered with an internationally recognized standards organization. The unique alphanumeric/numeric identifier registered under the ISO registration standard to reference a specific object or object class. In the federal government PKI, they are used to uniquely identify each of the four policies and cryptographic algorithms supported. 371 | SOURCE: SP 800-32 372 | 373 | Open Storage – Any storage of classified national security information outside of approved containers. This includes classified information that is resident on information systems media and outside of an approved storage container, regardless of whether or not that media is in use (i.e., unattended operations). 374 | SOURCE: CNSSI-4009 375 | 376 | Operating System (OS) Fingerprinting – Analyzing characteristics of packets sent by a target, such as packet headers or listening ports, to identify the operating system in use on the target. 377 | SOURCE: SP 800-115 378 | 379 | Operations Code – Code composed largely of words and phrases suitable for general communications use. 380 | SOURCE: CNSSI-4009 381 | 382 | Organization – A federal agency, or, as appropriate, any of its operational elements. 383 | SOURCE: FIPS 200 384 | 385 | Overwrite Procedure – A software process that replaces data previously stored on storage media with a predetermined set of meaningless data or random patterns. 386 | SOURCE: CNSSI-4009 387 | 388 | P 389 | 390 | Packet Filter – A routing device that provides access control functionality for host addresses and communication sessions. 391 | SOURCE: SP 800-41 392 | 393 | Packet Sniffer – Software that observes and records network traffic. 394 | SOURCE: CNSSI-4009 395 | 396 | Password – A protected character string used to authenticate the identity of a computer system user or to authorize access to system resources. 397 | SOURCE: FIPS 181 398 | 399 | Password Cracking – The process of recovering secret passwords stored in a computer system or transmitted over a network. 400 | SOURCE: SP 800-115 401 | 402 | Password Protected – The ability to protect a file using a password access control, protecting the data contents from being viewed with the appropriate viewer unless the proper password is entered. 403 | SOURCE: SP 800-72 404 | 405 | Patch – An update to an operating system, application, or other software issued specifically to correct particular problems with the software. 406 | SOURCE: SP 800-123 407 | 408 | Payload – The input data to the CCM generation-encryption process that is both authenticated and encrypted. 409 | SOURCE: SP 800-38C 410 | 411 | Penetration Testing – A test methodology in which assessors, using all available documentation (e.g., system design, source code, manuals) and working under specific constraints, attempt to circumvent the security features of an information system. 412 | SOURCE: SP 800-53A 413 | 414 | Personal Identification Number (PIN) – A secret that a claimant memorizes and uses to authenticate his or her identity. PINs are generally only decimal digits. 415 | SOURCE: FIPS 201 416 | 417 | Phishing - A digital form of social engineering that uses authentic looking but bogus emails to request information from users or direct them to a fake Web site that requests information. 418 | SOURCE: SP 800-115 419 | 420 | Plaintext – Data input to the Cipher or output from the Inverse Cipher. 421 | SOURCE: FIPS 197 422 | 423 | Policy Mapping – Recognizing that, when a CA in one domain certifies a CA in another domain, a particular certificate policy in the second domain may be considered by the authority of the first domain to be equivalent (but not necessarily identical in all respects) to a particular certificate policy in the first domain. 424 | SOURCE: SP 800-15 425 | 426 | Port – A physical entry or exit point of a cryptographic module that provides access to the module for physical signals, represented by logical information flows (physically separated ports do not share the same physical pin or wire). 427 | SOURCE: FIPS 140-2 428 | 429 | Port Scanning – Using a program to remotely determine which ports on a system are open (e.g., whether systems allow connections through those ports). 430 | SOURCE: CNSSI-4009 431 | 432 | Portal – A high-level remote access architecture that is based on a server that offers teleworkers access to one or more applications through a single centralized interface. 433 | SOURCE: SP 800-46 434 | 435 | Privilege – A right granted to an individual, a program, or a process. 436 | SOURCE: CNSSI-4009 437 | 438 | Privileged Accounts – Individuals who have access to set “access rights” for users on a given system. Sometimes referred to as system or network administrative accounts. 439 | SOURCE: SP 800-12 440 | 441 | Probe – A technique that attempts to access a system to learn something about the system. 442 | SOURCE: CNSSI-4009 443 | 444 | Profiling – Measuring the characteristics of expected activity so that changes to it can be more easily identified. 445 | SOURCE: SP 800-61; CNSSI-4009 446 | 447 | Protocol – Set of rules and formats, semantic and syntactic, permitting information systems to exchange information. 448 | SOURCE: CNSSI-4009 449 | 450 | Protocol Data Unit – A unit of data specified in a protocol and consisting of protocol information and, possibly, user data. 451 | SOURCE: FIPS 188 452 | 453 | Protocol Entity – Entity that follows a set of rules and formats (semantic and syntactic) that determines the communication behavior of other entities. 454 | SOURCE: FIPS 188 455 | 456 | Proxy – A proxy is an application that “breaks” the connection between client and server. The proxy accepts certain types of traffic entering or leaving a network and processes it and forwards it. This effectively closes the straight path between the internal and external networks making it more difficult for an attacker to obtain internal addresses and other details of the organization’s internal network. Proxy servers are available for common Internet services; for example, a Hyper Text Transfer Protocol (HTTP) proxy used for Web access, and a Simple Mail Transfer Protocol (SMTP) proxy used for email. 457 | SOURCE: SP 800-44 458 | 459 | Proxy Server – A server that services the requests of its clients by forwarding those requests to other servers. 460 | SOURCE: CNSSI-4009 461 | 462 | Public Domain Software – Software not protected by copyright laws of any nation that may be freely used without permission of, or payment to, the creator, and that carries no warranties from, or liabilities to the creator. 463 | SOURCE: CNSSI-4009 464 | 465 | Public Key - A cryptographic key used with a public key cryptographic algorithm, uniquely associated with an entity, and which may be made public; it is used to verify a digital signature; this key is mathematically linked with a corresponding private key. 466 | SOURCE: FIPS 196 467 | 468 | Q 469 | 470 | Qualitative Assessment – Use of a set of methods, principles, or rules for assessing risk based on nonnumeric categories or levels. 471 | SOURCE: SP 800-30 472 | 473 | Quality of Service – The measurable end-to-end performance properties of a network service, which can be guaranteed in advance by a Service-Level Agreement between a user and a service provider, so as to satisfy specific customer application requirements. Note: These properties may include throughput (bandwidth), transit delay (latency), error rates, priority, security, packet loss, packet jitter, etc. 474 | SOURCE: CNSSI-4009 475 | 476 | Quantitative Assessment – Use of a set of methods, principles, or rules for assessing risks based on the use of numbers where the meanings and proportionality of values are maintained inside and outside the context of the assessment. 477 | SOURCE: SP 800-30 478 | 479 | Quarantine – Store files containing malware in isolation for future disinfection or examination. 480 | SOURCE: SP 800-69 481 | 482 | R 483 | 484 | Radio Frequency Identification (RFID) – A form of automatic identification and data capture (AIDC) that uses electric or magnetic fields at radio frequencies to transmit information. 485 | SOURCE: SP 800-98 486 | 487 | Read – Fundamental operation in an information system that results only in the flow of information from an object to a subject. 488 | SOURCE: CNSSI-4009 489 | 490 | Read Access – Permission to read information in an information system. 491 | SOURCE: CNSSI-4009 492 | 493 | Real-Time Reaction – Immediate response to a penetration attempt that is detected and diagnosed in time to prevent access. 494 | SOURCE: CNSSI-4009 495 | 496 | Red Team – A group of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s security posture. The Red Team’s objective is to improve enterprise Information Assurance by demonstrating the impacts of successful attacks and by demonstrating what works for the defenders (i.e., the Blue Team) in an operational environment. 497 | SOURCE: CNSSI-4009 498 | 499 | Red Team Exercise – An exercise, reflecting real-world conditions, that is conducted as a simulated adversarial attempt to compromise organizational missions and/or business processes to provide a comprehensive assessment of the security capability of the information system and organization. 500 | SOURCE: SP 800-53 501 | 502 | Remote Access – Access to an organizational information system by a user (or an information system acting on behalf of a user) communicating through an external network (e.g., the Internet). 503 | SOURCE: SP 800-53 504 | 505 | Repository – A database containing information and data relating to certificates as specified in a CP; may also be referred to as a directory. 506 | SOURCE: SP 800-32 507 | 508 | Risk Assessment – The process of identifying risks to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation, arising through the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis. 509 | SOURCE: SP 800-53; SP 800-53A; SP 800-37 510 | 511 | Risk Assessment Methodology – A risk assessment process, together with a risk model, assessment approach, and analysis approach. 512 | SOURCE: SP 800-30 513 | 514 | Risk Assessment Report – The report which contains the results of performing a risk assessment or the formal output from the process of assessing risk. 515 | SOURCE: SP 800-30 516 | 517 | Root Certification Authority – In a hierarchical Public Key Infrastructure, the Certification Authority whose public key serves as the most trusted datum (i.e., the beginning of trust paths) for a security domain. 518 | SOURCE: SP 800-32; CNSSI-4009 519 | 520 | Rootkit – A set of tools used by an attacker after gaining root-level access to a host to conceal the attacker’s activities on the host and permit the attacker to maintain root-level access to the host through covert means. 521 | SOURCE: CNSSI-4009 522 | 523 | S 524 | Safeguards – Protective measures prescribed to meet the security requirements (i.e., confidentiality, integrity, and availability) specified for an information system. Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices. Synonymous with security controls and countermeasures. 525 | SOURCE: SP 800-53; SP 800-37; FIPS 200; CNSSI-4009 526 | 527 | Sandboxing- A restricted, controlled execution environment that prevents potentially malicious software, such as mobile code, from accessing any system resources except those for which the software is authorized. 528 | SOURCE: CNSSI-4009 529 | 530 | Scanning – Sending packets or requests to another system to gain information to be used in a subsequent attack. 531 | SOURCE: CNSSI-4009 532 | 533 | Secure Socket Layer (SSL) – A protocol used for protecting private information during transmission via the Internet. 534 | * **Note:** SSL works by using a public key to encrypt data that's transferred over the SSL connection. Most Web browsers support 535 | SSL, and many Web sites use the protocol to obtain confidential user information, such as credit card numbers. By convention, URLs that require an SSL connection start with “https:” instead of “http:.” 536 | SOURCE: CNSSI-4009 537 | 538 | Security Content Automation Protocol (SCAP) – A method for using specific standardized testing methods to enable automated vulnerability management, measurement, and policy compliance evaluation against a standardized set of security requirements. 539 | SOURCE: CNSSI-4009 540 | 541 | Signature – A recognizable, distinguishing pattern associated with an attack, such as a binary string in a virus or a particular set of keystrokes used to gain unauthorized access to a system. 542 | SOURCE: SP 800-61 543 | 544 | Signature Certificate – A public key certificate that contains a public key intended for verifying digital signatures rather than encrypting data or performing any other cryptographic functions. 545 | SOURCE: SP 800-32; CNSSI-4009 546 | 547 | Smart Card – A credit card-sized card with embedded integrated circuits that can store, process, and communicate information. 548 | SOURCE: CNSSI-4009 549 | 550 | Social Engineering – An attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks. 551 | SOURCE: SP 800-61 552 | 553 | Spam - Electronic junk mail or the abuse of electronic messaging systems to indiscriminately send unsolicited bulk messages. 554 | SOURCE: CNSSI-4009 555 | 556 | Spoofing – “IP spoofing” refers to sending a network packet that appears to come from a source other than its actual source. 557 | SOURCE: SP 800-48 558 | 559 | Spyware – Software that is secretly or surreptitiously installed into an information system to gather information on individuals or 560 | organizations without their knowledge; a type of malicious code. 561 | SOURCE: SP 800-53; CNSSI-4009 562 | 563 | Steganography – The art and science of communicating in a way that hides the existence of the communication. For example, a child pornography image can be hidden inside another graphic image file, audio file, or other file format. 564 | SOURCE: SP 800-72; SP 800-101 565 | 566 | Supply Chain Attack – Attacks that allow the adversary to utilize implants or other vulnerabilities inserted prior to installation in order to infiltrate data, or manipulate information technology hardware, software, operating systems, peripherals (information technology products) or services at any point during the life cycle. 567 | SOURCE: CNSSI-4009 568 | 569 | System Development Life Cycle (SDLC) – The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation. 570 | SOURCE: SP 800-34; CNSSI-4009 571 | 572 | System Development Methodologies – Methodologies developed through software engineering to manage the complexity of system development. Development methodologies include software engineering aids and high-level design analysis tools. 573 | SOURCE: CNSSI-4009 574 | 575 | System Integrity – The quality that a system has when it performs its intended function in an unimpaired manner, free from unauthorized manipulation of the system, whether intentional or accidental. 576 | SOURCE: SP 800-27 577 | 578 | T 579 | 580 | Tailoring – The process by which a security control baseline is modified based on: (i) the application of scoping guidance; (ii) the specification of compensating security controls, if needed; and (iii) the specification of organization-defined parameters in the security controls via explicit assignment and selection statements. 581 | SOURCE: SP 800-37; SP 800-53; SP 800-53A; CNSSI-4009 582 | 583 | Tampering – An intentional event resulting in modification of a system, its intended behavior, or data. 584 | SOURCE: CNSSI-4009 585 | 586 | Telecommunications – Preparation, transmission, communication, or related processing of information (writing, images, sounds, or other data) by electrical, electromagnetic, electromechanical, electro-optical, or electronic means. 587 | SOURCE: CNSSI-4009 588 | 589 | Threat – Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. 590 | SOURCE: SP 800-53; SP 800-53A; SP 800-27; SP 800-60; SP 800- 591 | 37; CNSSI-4009 592 | 593 | Threat Analysis – The examination of threat sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment. 594 | SOURCE: SP 800-27 595 | 596 | Threat Assessment – Formal description and evaluation of threat to an information system. 597 | SOURCE: SP 800-53; SP 800-18 598 | 599 | Threat Monitoring – Analysis, assessment, and review of audit trails and other information collected for the purpose of searching out system events that may constitute violations of system security. 600 | SOURCE: CNSSI-4009 601 | 602 | Token – Something that the Claimant possesses and controls (typically a key or password) that is used to authenticate the Claimant’s identity. 603 | SOURCE: SP 800-63 604 | 605 | Tracking Cookie – A cookie placed on a user’s computer to track the user’s activity on different Web sites, creating a detailed profile of the user’s behavior. 606 | SOURCE: SP 800-83 607 | 608 | Traffic Analysis – A form of passive attack in which an intruder observes information about calls (although not necessarily the contents of the messages) and makes inferences, e.g., from the source and destination numbers, or frequency and length of the messages. 609 | SOURCE: SP 800-24 610 | 611 | Trojan Horse – A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program. 612 | SOURCE: CNSSI-4009 613 | 614 | U 615 | 616 | Unauthorized Access – Unauthorized Occurs when a user, legitimate or unauthorized, accesses a resource that the user is not permitted to use. 617 | SOURCE: FIPS 191 618 | 619 | Unauthorized Disclosure – An event involving the exposure of information to entities not authorized access to the information. 620 | SOURCE: SP 800-57 Part 1; CNSSI-4009 621 | 622 | User – Individual or (system) process authorized to access an information system. 623 | SOURCE: FIPS 200 624 | 625 | User Initialization – A function in the life cycle of keying material; the process whereby a user initializes its cryptographic application (e.g., installing and initializing software and hardware). 626 | SOURCE: SP 800-57 Part 1 627 | 628 | V 629 | 630 | Validation – The process of demonstrating that the system under consideration meets in all respects the specification of that system. 631 | SOURCE: FIPS 201 632 | 633 | Verification – Confirmation, through the provision of objective evidence, that specified requirements have been fulfilled (e.g., an entity’s requirements have been correctly defined, or an entity’s attributes have been correctly presented; or a procedure or function performs as intended and leads to the expected outcome). 634 | SOURCE: CNSSI-4009 635 | 636 | Virtual Machine (VM) – Software that allows a single host to run one or more guest operating systems. 637 | SOURCE: SP 800-115 638 | 639 | Virtual Private Network (VPN) – A virtual network, built on top of existing physical networks, that provides a secure communications tunnel for data and other information transmitted between networks. 640 | SOURCE: SP 800-46 641 | 642 | Virus – A computer program that can copy itself and infect a computer without permission or knowledge of the user. A virus might corrupt 643 | or delete data on a computer, use email programs to spread itself to other computers, or even erase everything on a hard disk. 644 | SOURCE: CNSSI-4009 645 | 646 | Vulnerability – Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. 647 | SOURCE: SP 800-53; SP 800-53A; SP 800-37; SP 800-60; SP 800-115; FIPS 200 648 | 649 | Vulnerability Assessment –Formal description and evaluation of the vulnerabilities in an information system. 650 | SOURCE: SP 800-53; SP 800-37 651 | 652 | W 653 | 654 | Web Content Filtering Software – A program that prevents access to undesirable Web sites, typically by comparing a requested Web site address to a list of known bad Web sites. 655 | SOURCE: SP 800-69 656 | 657 | Web Risk Assessment – Processes for ensuring Web sites are in compliance with applicable policies. 658 | SOURCE: CNSSI-4009 659 | 660 | Whitelist – A list of discrete entities, such as hosts or applications that are known to be benign and are approved for use within an organization and/or information system. 661 | SOURCE: SP 800-128 662 | 663 | Wi-Fi Protected Access-2 (WPA2) – The approved Wi-Fi Alliance interoperable implementation of the IEEE 802.11i security standard. For federal government use, the implementation must use FIPS-approved encryption, such as AES. 664 | SOURCE: CNSSI-4009 665 | 666 | Wireless Local Area Network (WLAN) – A group of wireless networking devices within a limited geographic area, such as an office building, that exchange data through radio communications. The security of each WLAN is heavily dependent on how well each WLAN component—including client devices, APs, and wireless switches—is secured throughout the WLAN lifecycle, from initial WLAN design and deployment through ongoing maintenance and monitoring. 667 | SOURCE: SP 800-153 668 | 669 | Write – Fundamental operation in an information system that results only in the flow of information from a subject to an object. See Access Type. 670 | SOURCE: CNSSI-4009 671 | 672 | Write Access – Permission to write to an object in an information system. 673 | SOURCE: CNSSI-4009 674 | 675 | Z 676 | 677 | Zeroize – To remove or eliminate the key from a cryptographic equipment or fill device. 678 | SOURCE: CNSSI-4009 679 | 680 | Zombie – A program that is installed on a system to cause it to attack other systems. 681 | SOURCE: SP 800-83 682 | --------------------------------------------------------------------------------