3DES
Also known as Triple Digital Encryption Standard (DES). A block cipher algorithm
used for encryption.
802.11a
The standard that provides for bandwidths of up to 54Mbps in the 5GHz frequency spectrum.
802.11b
The standard that provides for bandwidths of up to 11Mbps in the 2.4GHz fre- quency spectrum. This standard is also called Wireless Fidelity (Wi-Fi) or 802.11 high rate.
802.11g
The standard that provides for bandwidths of 20Mbps in the 2.4GHz frequency spectrum.
802.11n
A proposed amendment to the 802.11 standard that provides for bandwidths of 74Mbps in the 2.4GHz and 5GHz frequency spectrums. The standard is expected to be released in 2009.
acceptable use policy
Agreed-upon principles set forth by a company to govern how the employees of that company may use resources such as computers and Internet access.
access attack
An attack aimed at gaining access to resources.
access control
The means of giving or restricting user access to network resources. Access control is usually accomplished through the use of an access control list (ACL).
access control list (ACL)
A table or data file that specifies whether a user or group has access to a specific resource on a computer or network.
access point (AP)
The point at which access to a network is accomplished. This term is often used in relation to a wireless access point (WAP).
accountability
Being responsible for an item. The administrator is often accountable for the network and the resources on it.
accounting
The act of keeping track of activity. Most often, this term is used to refer to tracking users’ interactions with network resources via log files that are routinely scanned and checked.
acknowledgment (ACK)
A message confirming that a data packet was received. Occurs at the Transport layer of the Open Systems Interconnection (OSI) and TCP/IP models.
Active Directory
The replacement for NT Directory Service (NTDS) that is included with Windows 2000/2003. It acts similarly to Novell Directory Services (NDS), which is now known as eDirectory in NetWare 6.x/OES because it’s a true X.500-based directory service.
active response
A response generated in real time.
active sniffing
Involves an attacker gaining access to a host in the network through a switch and logically disconnecting it from the network.
ActiveX
A Microsoft technology that allows customized controls, icons, and other features to increase the usability of web-enabled systems.
activity
Any action a user undertakes.
ad hoc radio frequency network
A network created when two RF-capable devices are
brought within transmission range of each other. (RF stands for radio frequency.)
Address Resolution Protocol (ARP)
Protocol used to map known IP addresses to unknown physical addresses.
AD-IDS
Anomaly-detection intrusion detection system. Works by looking for deviations from a pattern of normal network traffic.
administrative policies
A set of rules that govern administrative usage of a system.
administrator
The user who is accountable and responsible for the network.
Advanced Encryption Standard (AES)
A FIPS publication that specifies a cryptographic algorithm for use by the U.S. government.
adware
Software that gathers information to pass on to marketers or intercepts personal data such as credit card numbers and makes them available to third parties.
AES256
An implementation of Advanced Encryption Standard (AES) that uses 256-bit
encryption.
alert
A notification that an unusual condition exists and should be investigated.
algorithm
The series of steps/formulas/processes that is followed to arrive at a result.
analyzer
The component or process that analyzes the data collected by the sensor.
annual loss expectancy (ALE)
A calculation that is used to identify risks and calculate the expected loss each year.
annualized rate of occurrence (ARO)
A calculation of how often a threat will occur. For example, a threat that occurs once every five years has _____ of 1/5, or 0.2.
anomaly detection
The act of looking for variations from normal operations and reacting to them.
anonymous authentication
Authentication that doesn’t require a user to provide a user- name, password, or any other identification before accessing resources.
antivirus
A category of software that uses various methods to prevent and eliminate viruses in a computer. It typically also protects against future infection.
antivirus engine
The core program that runs the virus-scanning process.
antivirus software
Software that identifies the presence of a virus and is capable of removing or quarantining the virus.
AppleTalk
A networking capability included with all Macintosh computers.
appliance
A freestanding device that operates in a largely self-contained manner.
Application layer
The seventh layer of the Open Systems Interconnection (OSI) model. This layer deals with how applications access the network and describes application func- tionality, such as file transfer, messaging, and so on.
application programming interface (API)
An abstract interface to the services and proto- cols provided by an operating system.
armored virus
A virus that is protected in a way that makes disassembling it difficult. The difficulty makes it “armored” against antivirus programs that have trouble getting to, and understanding, its code.
ARP table
The table that the Address Resolution Protocol uses. Contains a list of known TCP/IP addresses and their associated physical addresses. The table is cached in memory so that ARP lookups don’t have to be performed for frequently accessed addresses. See also Media Access Control (MAC).
asset
Any resource of value that you want to secure and protect.
asymmetric algorithm
An algorithm that utilizes two keys.
asymmetric encryption
Encryption in which two keys must be used. One key is used to encrypt data, and the other is needed to decrypt the data.
attack
Any unauthorized intrusion into the normal operations of a computer or computer network. The attack can be carried out to gain access to the system or any of its resources.
audit files
Files that hold information about a resource’s access by users.
auditing
The act of tracking resource usage by users.
auditors
Individuals involved in auditing log and security files.
authenticating the evidence
Verifying that the logs and other resources collected are legitimate. This technique can be useful in verifying that an attack has occurred.
authentication
The means of verifying that someone is who they say they are.
Authentication Header (AH)
A header used to provide connectionless integrity and data
origin authentication for IP datagrams and to provide protection against replays.
availability
The ability of a resource to be accessed, often expressed as a time period. Many networks limit users’ ability to access network resources to working hours, as a security precaution.
back door (backdoor)
An opening left in a program application (usually by the developer) that allows additional access to data. Typically, these are created for debugging purposes and aren’t documented. Before the product ships, the back doors are closed; when they aren’t closed, security loopholes exist.
Back Orifice
Originally created as a support tool, it is now well known as an illicit server program that can be used to gain access to Windows NT/2000 servers and take control.
backup
A usable copy of data made to media. Ideally, made to removable media and stored for recovery should anything happen to the original data.
backup plan
A documented plan governing backup situations.
backup policy
A written policy detailing the frequency of backups and the location of storage media.
Bell La-Padula model
A model designed for the military to address the storage and protection of classified information. This model is specifically designed to prevent unauthorized access to classified information. The model prevents the user from accessing information that has a higher security rating than they are authorized to access. It also prevents information from being written to a lower level of security.
best practices
A set of rules governing basic operations.
Biba model
A model similar in concept to the Bell La-Padula model but more concerned with information integrity (an area the Bell La-Padula model doesn’t address). In this model, there is no write up or read down. If you’re assigned access to top-secret information, you can’t read secret information or write to any level higher than the level to which you’re authorized. This model keeps higher-level information pure by preventing less-reliable information from being intermixed with it.
biometric device
A device that can authenticate an individual based on a physical characteristic.
biometrics
The science of identifying a person by using one or more of their features. The feature can be a thumbprint, a retinal scan, or any other biological trait.
BIOS
The basic input/output system for an IBM-based PC. It is the firmware that allows the computer to boot.
birthday attack
A probability method of finding collision in hash functions.
Blowfish
A type of symmetric block cipher created by Bruce Schneier.
boot sector
Also known as the Master Boot Record (MBR). The first sector of the hard disk, where the program that boots the operating system resides. It’s a popular target for viruses.
Border Gateway Protocol (BGP)
An ISP protocol that allows routers to share information about routes with each other.
border router
A router used to translate from LAN framing to WAN framing.
bot
An automated software program that collects information on the Web. Can be used for mali- cious purposes as well.
brute force attack
A type of attack that relies purely on trial and error.
buffer overflow attack
A type of denial of service (DoS) attack that occurs when moredata is put into a buffer than it can hold.
Business Continuity Planning (BCP)
A contingency plan that allows a business to keep running in the event of a disruption to vital resources.
Business Impact Analysis (BIA)
A study of the possible impact if a disruption to a business’s vital resources were to occur.
Carlisle Adams Stafford Tavares (CAST)
A type of symmetric block cipher defined by RFC 2144.
central office
The primary office from which most resources extend.
certificate
A digital entity that establishes who you are and is often used with e-commerce. It contains your name and other identifying data.
certificate authority (CA)
An issuer of digital certificates (which are then used for digital signatures or key pairs).
certificate policies
Policies governing the use of certificates.
Certificate Practice Statement (CPS)
The principles and procedures employed in the issuing and managing of certificates.
certificate revocation
The act of making a certificate invalid.
Certificate Revocation List (CRL)
A list of digital certificate revocations that must be regularly downloaded to stay current.
chain of custody
The log of the history of evidence that has been collected.
Challenge Handshake Authentication Protocol (CHAP)
A protocol that challenges a system to verify identity. An improvement over Password Authentication Protocol (PAP) in which one-way hashing is incorporated into a three-way handshake. RFC 1334 applies to both PAP and ___.
change documentation
Documentation required to make a change in the scope of any particular item. In the realm of project management, it is a formal document requiring many signatures before key elements of the project can be modified.
checkpoint
A certain action or moment in time that is used to perform a check. It allows a restart to begin at the last point the data was saved as opposed to from the beginning.
checksum
A hexadecimal value computed from transmitted data that is used in error- checking routines.
circuit switching
A switching method where a dedicated connection between the sender and receiver is maintained throughout the conversation.
Clark-Wilson model
An integrity model for creating a secure architecture.
clear text
Unencrypted text that can be read with any editor.
client
The part of a client/server network where the computing is usually done. In a typical setting, a client uses the server for remote storage, backups, or security (such as a firewall).
client/server network
A server-centric network in which all resources are stored on a file server and processing power is distributed among workstations and the file server.
clipper chip
An early encryption system from the NSA for civilian use; it was a hardware implementation of the skipjack encryption algorithm.
clustering
A method of balancing loads and providing fault tolerance.
coax
A type of cabling used in computer networks.
code escrow
The storage and conditions for release of source code provided by a vendor, partner, or other party.
cold site
A physical site that has all the resources necessary to enable an organization to use it if the main site is inaccessible (destroyed). Commonly, plans call for turning to a this within a certain number of hours after the loss of the main site.
collection of evidence
The means and orderly fashion by which evidence is collected, identified, and marked.
collusion
An agreement between individuals to commit fraud or deceit.
Common Criteria (CC)
A document of specifications detailing security evaluation methods for IT products and systems.
Common Criteria Recognition Agreement (CCRA)
A set of standards, formerly known as the Mutual Recognition Agreement (MRA), that defines Evaluation Assurance Levels (EALs).
Common Gateway Interface (CGI)
An older form of scripting that was used extensively in early web systems.
companion virus
A virus that creates a new program that runs in place of an expected program of the same name.
compartmentalization
Standards that support a nonhierarchical security classification.
confidentiality
Assurance that data remains private and no one sees it except for those
expected to see it.
configuration management
The administration of setup and changes to configurations.
connectionless
Type of communications between two hosts that have no previous session established for synchronizing sent data. The data isn’t acknowledged at the receiving end. This method can allow data loss. Within the TCP/IP suite, User Datagram Protocol (UDP) is used for this type of communication.
connection-oriented
Type of communications between two hosts that have a previous session established for synchronizing sent data. The receiving PC acknowledges the data. This method allows for guaranteed delivery of data between PCs. Within the TCP/IP suite, TCP is used for this type of communications.
cookie
A plain-text file stored on your machine that contains information about you (and your preferences) and is used by a database server.
critical business functions
Functions on which the livelihood of the company depends.
cryptanalysis
The study and practice of finding weaknesses in ciphers.
cryptanalyst
A person who does cryptanalysis.
cryptographer
A person who participates in the study of cryptographic algorithms.
cryptographic algorithm
A symmetric algorithm, also known as a cipher, used to encrypt and decrypt data.
cryptography
The field of mathematics focused on encrypting and decrypting data.
custodian
An individual responsible for maintaining the data, and the integrity of it, within their area.
cyclical redundancy check (CRC)
An error-checking method in data communications that runs a formula against data before transmission. The sending station then appends the resultant value (called a checksum) to the data and sends it. The receiving station uses the same formula on the data. If the receiving station doesn’t get the same checksum result for the calculation, it considers the transmission invalid, rejects the frame, and asks for retransmission.
data integrity
A quality that provides a level of confidence that data won’t be jeopardized and will be kept secret.
Data Link layer
The second layer of the Open Systems Interconnection (OSI) model. It describes the physical topology of a network.
data packet
A unit of data sent over a network. Includes a header, addressing information, and the data itself.
data repository
A centralized storage location for data, such as a database.
data source
Where data originates.
datagram
A Layer 3, User Datagram Protocol (UDP) packet descriptor.
decryption
The process of converting encrypted data back into its original form.
default gateway
The router to which all packets are sent when the workstation doesn’t know where the destination station is or when it can’t find the destination station on the local segment.
demilitarized zone (DMZ)
An area for placing web and other servers that serve the general public outside the firewall, therefore, isolating them from internal network access.
denial of service (DoS) attack
A type of attack that prevents any users—even legitimate ones—from using a system.
destination port number
A portion of a complete address of a PC to which data is being sent from a sending PC. The port portion allows for the demultiplexing of data to be sent to a specific application.
detection
The act of noticing an irregularity as it occurs.
dictionary attack
The act of attempting to crack passwords by testing them against a list of dictionary words. With today’s powerful computers, an attacker can combine one of many available automated password-cracking utilities with several large dictionaries or “wordlists” and crack huge numbers of passwords in a matter of minutes. Any password based on any dictionary word is vulnerable to such an attack.
differential backup
A type of backup that includes only new files or files that have changed since the last full backup. Differential backups differ from incremental backups in that they don’t clear the archive bit upon their completion.
Diffie-Hellman
An asymmetric standard for exchanging keys. This cryptographic algorithm is used primarily to send secret keys across public networks. The process isn’t used to encrypt or decrypt messages; it’s used merely for the transmission of keys in a secure manner.
digital signature
An asymmetrically encrypted signature whose sole purpose is to authenticate the sender.
directory
A network database that contains a listing of all network resources, such as users, printers, groups, and so on.
directory service
A network service that provides access to a central database of informa- tion, which contains detailed information about the resources available on a network.
direct-sequence (DS)
A method of communication between wireless receivers.
direct-sequence spread spectrum (DSSS)
A communications technology that is used to communicate in the 802.11 standard.
disaster recovery
The act of recovering data following a disaster that has destroyed it.
disaster recovery plan
A plan outlining the procedure by which data is recovered after a disaster.
Discretionary Access Control (DAC)
A method of restricting access to objects based on the identity of the subjects or the groups to which they belong.
disk mirroring
Technology that keeps identical copies of data on two disks to prevent the loss of data if one disk faults.
disk striping
Technology that enables writing data to multiple disks simultaneously in small portions called stripes. These stripes maximize use by having all the read/write heads working constantly. Different data is stored on each disk and isn’t automatically duplicated (this means disk striping in and of itself doesn’t provide fault tolerance).
disk striping with parity
A fault-tolerance solution of writing data across a number of disks and recording the parity on another. In the event any one disk fails, the data on it can be re- created by looking at the remaining data and computing parity to figure out the missing data.
distributed denial of service (DDoS) attack
A derivative of a DoS attack in which multiple hosts in multiple locations all focus on one target to reduce its availability to the public. See denial of service (DoS) attack.
DNS server
Any server that performs address resolution from a DNS fully qualified domain name (FQDN) to an IP address. See also Domain Name Service (DNS), Internet Protocol (IP).
DNS zone
An area in the DNS hierarchy that is managed as a single unit. See also Domain Name Service (DNS).
DoD Networking Model
A four-layer conceptual model describing how communications should take place between computer systems. The four layers are Process/Application, Host- to-Host, Internet, and Network Access.
domain
Within the Internet, a group of computers with shared traits and a common IP address set. A domain can also be a group of networked Windows computers that share a single SAM database. See also Security Accounts Manager (SAM).
Domain Name Service (DNS)
The network service used in TCP/IP networks that translates hostnames to IP addresses. See also Transmission Control Protocol/Internet Protocol (TCP/IP).
dual-homed host
A host that resides on more than one network and possesses more than
one physical network card.
dumb terminal
A keyboard and monitor that send keystrokes to a central processing com- puter (typically a mainframe or minicomputer) that returns screen displays to the monitor. The unit has no processing power of its own.
Dumpster diving
Looking through trash for clues—often in the form of paper scraps—to find users’ passwords and other pertinent information.
duplexed hard drives
Two hard drives to which identical information is written simultaneously. A dedicated controller card controls each drive. Used for fault tolerance.
duplicate servers
Two servers that are identical, for use in clustering.
Dynamic Host Configuration Protocol (DHCP)
A protocol used on a TCP/IP network to send client configuration data, including IP address, default gateway, subnet mask, and DNS configuration, to clients. Uses a four-step process: Discover, Offer, Request, and Acknowledgement.
dynamic packet filtering
A type of firewall used to accept or reject packets based on their contents.
dynamic routing
The use of route-discovery protocols to talk to other routers and find out what networks they are attached to. Routers that use dynamic routing send out special packets to request updates from the other routers on the network as well as to send their own updates.
dynamically allocated port
A TCP/IP port that is not constantly used but accessed by an application when needed.
eavesdropping
Any type of passive attack that intercepts data in an unauthorized manner— usually in order to find passwords. Cable sniffing, wiretapping, and man-in-the-middle attacks are eavesdropping attacks.
electromagnetic interference (EMI)
The interference that can occur during transmis- sions over copper cable because of electromagnetic energy outside the cable. The result is degradation of the signal.
Elliptic Curve Cryptosystem (ECC)
A type of public key cryptosystem that requires a shorter
key length than many other cryptosystems (including the de facto industry standard, RSA).
Encapsulating Security Payload (ESP)
A header used to provide a mix of security services in IPv4 and IPv6. Can be used alone or in combination with the IP Authentication Header (AH).
encoding
The process of translating data into signals that can be transmitted on a trans- mission medium.
encryption
The process of converting data into a form that makes it less likely to be usable to anyone intercepting it if they can’t decrypt it.
encryption key
A string of alphanumeric characters used to decrypt encrypted data.
enticement
The process of luring someone.
entrapment
The process of encouraging an attacker to perform an act, even if they don’t want to do it.
enumeration
An attempt to gain information about a network by specifically targeting network resources, users and groups, and applications running on the system.
escalation
The act of moving something up in priority. Often, when an incident is escalated, it’s brought to the attention of the next highest supervisor.
Ethernet
A shared-media network architecture. It operates at the Physical and Data Link layers of the Open Systems Interconnection (OSI) model. As the media access method, it uses baseband signaling over either a bus or a star topology. The cabling used in these networks can be coax, twisted-pair, wireless, or fiber-optic.
Evaluation Assurance Level (EAL)
A level of assurance, expressed as a numeric value, based
on standards set by the Common Criteria Recognition Agreement (CCRA).
event
Any noticeable action or occurrence.
exposure factor (EF)
A calculation of how much data (or other assets) could be lost from a single occurrence. If all the data on the network could be jeopardized by a single attack, the exposure factor is 100 percent.
external threat
A threat that originates from outside the company.
extranet
Web (or similar) services set up in a private network to be accessed internally and by select external entities, such as vendors and suppliers.
extrusion
Examining data leaving a network for signs of malicious traffic.
fail-over/failover
The process of reconstructing a system or switching over to other systems
when a failure is detected.
fail-over device
A device that comes online when another fails.
fail-over server
A hot-site backup system in which the fail-over server is connected to the primary server. A heartbeat is sent from the primary server to the backup server. If the heart- beat stops, the fail-over system starts and takes over. Thus, the system doesn’t go down even if the primary server isn’t running.
false positive
A flagged event that isn’t really an event and has been falsely triggered.
Faraday cage
An electrically conductive wire mesh or other conductor woven into a “cage” that surrounds a room and prevents electromagnetic signals from entering or leaving the room through the walls.
fault-resistant network
A network that is up and running at least 99 percent of the time or that is down less than 8 hours a year.
fault tolerance
The ability to withstand a fault (failure) without losing data.
fault-tolerant network
A network that can recover from minor errors.
Federal Information Processing Standard (FIPS)
An agreed-upon standard published under the Information Technology Management Reform Act. The secretary of commerce approves the standards after they’re developed by the National Institute of Standards and Technology (NIST) for federal computer systems.
File Transfer Protocol (FTP)
TCP/IP and software that permit transferring files between computer systems and utilize clear-text passwords. Because FTP has been implemented on numerous types of computer systems, files can be transferred between disparate computer systems (for example, a personal computer and a minicomputer). See also Transmission Control Protocol/Internet Protocol (TCP/IP).
fire suppression
The act of stopping a fire and preventing it from spreading.
firewall
A combination of hardware and software that protects a network from attack by hackers who could gain access through public networks, including the Internet.
footprinting
The process of systematically identifying the network and its security posture.
forensics
In terms of security, the act of looking at all the data at your disposal to try to figure out who gained unauthorized access and the extent of that access.
frequency-hopping spread spectrum (FHSS)
A communications technology used to communicate in the 802.11 standard. Accomplishes communication by hopping the transmission over a range of predefined frequencies.
FTP proxy
A server that uploads and downloads files from another server on behalf of a workstation.
full backup
A backup that copies all data to the archive medium.
full distribution
An information classification stating that the data so classified is available to anyone.
Gramm-Leach-Bliley Act
A government act containing rules on privacy of consumer finance information.
Grandfather, Father, Son
One of the most popular methods of backup tape rotation. Three sets of tapes are rotated in this method. The most recent backup after the full backup is the Son. As newer backups are made, the Son becomes the Father and the Father, in turn, becomes the Grandfather. At the end of each month, a full backup is performed
on all systems. This backup is stored in an off-site facility for a period of one year. Each monthly backup replaces the monthly backup from the previous year. Weekly or daily incremental backups are performed and stored until the next full backup occurs. This full backup is then stored off site, and the weekly or daily backup tapes are reused.
hacker
Generally used to refer to someone who gains access to a system, software, or hardware without permission. Also can be called a cracker.
handshake
The process of agreeing to communicate and share data. TCP uses a three-way handshake to establish connections, and part of this process can be exploited by certain types of attacks.
hardening
The process of making an entity, usually an operating system, more secure by closing known holes and addressing known security issues.
hash/hashing
The process of transforming characters into other characters that represent (but are not) the originals. Traditionally, the results are smaller and more secure than the original.
hash value
A single number used to represent an original piece of data.
Health Insurance Portability and Accountability Act (HIPAA)
An act that addresses security and privacy of health-related data.
high availability
A clustering solution to provide resource reliability and availability.
hijacking (TCP/IP hijacking)
See man-in-the-middle attack.
hoax
Typically an e-mail message warning of something that isn’t true, such as the outbreak of a new virus. Can send users into a panic and cause more harm than the virus.
honeypot (also known as Honey pot)
A bogus system set up to attract and slow down a hacker. A honeypot can also be used to learn of the hacking techniques and methods that hackers employ.
host
Any network device with a TCP/IP network address.
host-based IDS (H-IDS)
An intrusion detection system that is host based. The alternative is network based.
host-based IPS (H-IPS)
An intrusion prevention system that is host based. To prevent the intrusion, it must first detect it (thus making it a superset of H-IDS) and then act accordingly.
hostile code
Any code that behaves in a way other than in the best interest of the user and the security of data.
host-to-host
Describes communication that occurs between hosts.
hot fix/hotfix
Another word for a patch. When Microsoft rolls a bunch of hotfixes together, they become known as a service pack.
hot site
A location that can provide operations within hours of a failure.
HVAC
A common acronym used for heating, ventilation, and air conditioning.
Hypertext Markup Language (HTML)
A set of codes used to format text and graphics that will be displayed in a browser. The codes define how data will be displayed.
Hypertext Transfer Protocol (HTTP)
The protocol used for communication between a web server and a web browser.
Hypertext Transfer Protocol (Secure) Also known as HTTPS.
A combination of HTTP with Secure Sockets Layer (SSL) to make for a secure connection. It uses port 443 by default.
ICMP attack
An attack that occurs by triggering a response from the Internet Control Message Protocol (ICMP) when it responds to a seemingly legitimate maintenance request. See also Internet Control Message Protocol (ICMP).
identification and authentication (I&A)
A two-step process of identifying a person (usually when they log on) and authenticating them by challenging their claim to access a resource.
IEEE 802.10 LAN/MAN Security
A series of guidelines dealing with various aspects of network security.
IEEE 802.11
A family of protocols that provides for wireless communications using radio- frequency transmissions.
IEEE 802.11 Wireless LAN
Defines the standards for implementing wireless technologies such as infrared and spread-spectrum radio.
illicit server
An application/program that shouldn’t be there but is operating on the net- work, and one that is commonly used to gain unauthorized control by allowing someone to bypass normal authentication. NetBus is one of the best-known examples.
incident
An attempt to violate a security policy, a successful penetration, a compromise of a system, or unauthorized access to information.
incident response
How an organization responds to an incident.
incident response plan (IRP)
A policy that defines how an organization will respond to
an incident.
incident response team (IRT)
Also known as a Computer Security Incident Response Team (CSIRT). The group of individuals responsible for responding when a security breach has occurred.
incremental backup
A type of backup in which only new files or files that have changed since the last full backup or the last incremental backup are included. Incremental backups clear the archive bit on files upon their completion.
information classification
The process of determining what information is accessible to what parties and for what purposes.
information classification policies
Written policies detailing dissemination of information.
information destruction policies
Policies that define how information is destroyed when it
has reached the end of its useful life.
Information Flow model
A model concerned with all the properties of information flow, not just the direction of the flow.
information policies
Policies governing the various aspects of information security. Include access, classifications, marking and storage, and the transmis- sion and destruction of sensitive information. Their development is critical to security.
information retention
A designation of how long data is retained and any other significant considerations about information.
information security
Security practices applied to information.
infrastructure
The hardware and software necessary to run your network.
infrastructure security
Security on the hardware and software necessary to run your network.
instant messaging (IM)
Immediate communication that can be sent back and forth between users who are currently logged on. From a security standpoint, there are risks associated with giving out information via IM that can be used in social engineering attacks; in addition, attachments sent can contain viruses.
Institute of Electrical and Electronics Engineers, Inc. (IEEE)
An international organization that sets standards for various electrical and electronics issues.
Integrated Services Digital Network (ISDN)
A telecommunications standard that is used to digitally send voice, data, and video signals over the same lines.
interception
The process of covertly obtaining information not meant for you. Can be an active or passive process.
internal information
Information intended to remain within an organization.
internal threat
A threat that arises from within an organization.
International Data Encryption Algorithm (IDEA)
An algorithm that uses a 128-bit key. This product is similar in speed and capability to Digital Encryption Standard (DES), but it’s more secure. Used in Pretty Good Privacy (PGP).
International Organization for Standardization (ISO)
The standards organization that developed the Open Systems Interconnection (OSI) model. This model provides a guideline for how communications occur between computers.
International Telecommunications Union (ITU)
Organization responsible for commu- nications standards, spectrum management, and the development of communications infrastructures in underdeveloped nations.
Internet
A global network made up of a large number of individual networks that are inter- connected and use TCP/IP. See also Transmission Control Protocol/Internet Protocol (TCP/IP).
Internet Architecture Board (IAB)
The committee that oversees management of the Internet. It’s made up of two subcommittees: the Internet Engineering Task Force (IETF) and the Inter- net Research Task Force (IRTF). See also Internet Engineering Task Force (IETF) and Internet Research Task Force (IRTF).
Internet Assigned Numbers Authority (IANA)
The organization responsible for governing IP addresses.
Internet Control Message Protocol (ICMP)
A message and management protocol for TCP/IP. The Ping utility uses this. See also Ping, Transmission Control Protocol/Internet Protocol (TCP/IP).
Internet Engineering Task Force (IETF)
An international organization that works under the Internet Architecture Board to establish standards and protocols relating to the Internet. See also Internet Architecture Board (IAB).
Internet Group Management Protocol (IGMP)
A protocol used for multicasting operations across the Internet.
Internet layer
The network layer responsible for routing, IP addressing, and packaging.
Internet Message Access Protocol (IMAP)
A protocol with a store-and-forward capability. It can also allow messages to be stored on an e-mail server instead of downloaded to the client.
Internet Protocol (IP)
The protocol in the TCP/IP suite responsible for network addressing.
Internet Research Task Force (IRTF)
An international organization that works under the Internet Architecture Board to research new Internet technologies. See also Internet Architecture Board (IAB).
Internet service provider (ISP)
A company that provides direct access to the Internet for home and business computer users.
Internet Society (ISOC)
A professional membership group composed primarily of Internet experts. It oversees a number of committees and groups, including the Internet Engineering Task Force (IETF).
Internetwork Packet Exchange (IPX)
A connectionless, routable network protocol based on the Xerox XNS architecture. It’s the default protocol for versions of NetWare before NetWare 5. It operates at the Network layer of the Open Systems Interconnection (OSI) model and is responsible for addressing and routing packets to workstations or servers on other networks.
intranet
Web (or similar) services set up in a private network to be accessed internally only.
intrusion
The act of entering a system without authorization to do so.
intrusion detection system (IDS)
Tools that identify and respond to attacks using defined rules or logic. An IDS can be network based or host based.
intrusion detector
The item/application performing intrusion detection. See also intrusion detection system (IDS).
IP proxy
A server that acts as a go-between for clients accessing the Internet. All commu- nications look as if they originated from a proxy server because the IP address of the user making a request is hidden. Also known as Network Address Translation (NAT).
IP Security (IPSec)
A set of protocols that enable encryption, authentication, and integrity over IP. Commonly used with virtual private networks (VPNs) and operates at Layer 3.
IP spoofing
An attack during which a hacker tries to gain access to a network by pretending their interface has the same network address as the internal network.
ISO 17799
A 10-part plan designed to provide a generic security audit on the best practices of security for virtually all aspects of your IT department.
JavaScript
A programming language that allows access to system resources of the system running the script. These scripts can interface with all aspects of an operating system just like programming languages, such as the C language.
journaling
The ability of a filesystem to use a log file of all changes and transactions that have occurred within a set period of time (for example, the last few hours). If a crash occurs, the operating system can look at the log files to see what transactions have been committed and which ones have not.
Kerberos
An authentication scheme that uses tickets (unique keys) embedded within messages. Named after the three-headed guard dog who stood at the gates of Hades in Greek mythology.
key/certificate life cycle
The time during which the processes of a key or certificate take place.
Key Distribution Center (KDC)
An organization/facility that generates keys for users.
key escrow agency
An agency that stores keys for the purpose of law-enforcement access.
Key Exchange Algorithm (KEA)
A method of offering mutual authentication and establishing data encryption keys.
key generation
The act of creating keys for use by users.
key suspension
The temporary deferment of a key for a period of time (such as for a leave of absence).
Keyed-Hash Message Authentication Code (HMAC)
“A mechanism for message authentication using cryptographic hash functions” per the draft of the Federal Informa- tion Processing Standard (FIPS) publication. Addressed in RFC 2104.
LANMAN
An old authentication method used with early Windows-based systems.
latency
The wait time between the call for an action or activity and the actual execution of that action.
lattice
The concept that access differs at different levels. Often used in discussion with the Biba and Bell La-Padula models as well as with cryptography to differentiate between security levels based upon user/group labels.
Layer 2 Forwarding (L2F)
A tunneling protocol often used with virtual private networks (VPNs). Was developed by Cisco.
Layer 2 Tunneling Protocol (L2TP)
A tunneling protocol that adds functionality to Point- to-Point Protocol (PPP). This protocol was created by Microsoft and Cisco and is often used with virtual private networks (VPNs).
Lightweight Directory Access Protocol (LDAP)
A set of protocols that was derived from X.500 and operates at port 389.
limited distribution
Describes information that isn’t intended for release to the public. This category of information isn’t secret, but it’s private.
Link Control Protocol (LCP)
The protocol used to establish, configure, and test the link between a client and PPP host. See also Point-to-Point Protocol (PPP).
local area network (LAN)
A network that is restricted to a single building, group of buildings, or even a single room. A LAN can have one or more servers.
local registration authority (LRA)
An authority used to identify or establish the identity of an individual for certificate issuance.
logic bomb
Any code that is hidden within an application and causes something unexpected to happen based on some criteria being met. For example, a programmer could create a pro- gram that always makes sure his name appears on the payroll roster; if it doesn’t, then key files begin to be erased.
logs and inventories
Tools used to help an organization know what is happening to its systems and assets. System logs tell what is happening with the systems in the network. Inventories refer to both the physical assets and the software assets a company owns.
M of N Control method
A rule stating that in order to access the key server if n number of administrators have the ability to perform a process, m number of those administrators must authenticate for access to occur. May involve physical presence.
message digest
The signature area within a message.
MAC address
The address that is either assigned to a network card or burned into the network interface card (NIC). PCs use MAC addresses to keep track of one another and keep each other separate.
macro virus
A software exploitation virus that works by using the macro feature included in many applications.
malicious code
Any code that is meant to do harm.
Mandatory Access Control (MAC)
A security policy wherein labels are used to identify the sensitivity of objects. When a user attempts to access an object, the label is checked to see if access should be allowed (that is, whether the user is operating at the same sensitivity level). This policy is “mandatory,” because labels are automatically applied to all data (and can be changed only by administrative action), as opposed to “discretionary” policies that leave it up to the user to decide whether to apply a label.
man-in-the-middle attack
An attack that occurs when someone/-thing that is trusted intercepts packets and retransmits them to another party. Man-in-the-middle attacks have also been called TCP/IP hijacking in the past.
mantrap
A device, such as a small room, that limits access to one or a few individuals. Mantraps typically use electronic locks and other methods to control access.
mathematical attack
An attack focused on the encryption algorithm itself, the key mechanism, or any potential area of weakness in the algorithm.
mean time between failure (MTBF)
The measure of the anticipated incidence of failure of a system or component.
mean time to repair (MTTR)
The measurement of how long it takes to repair a system or component once a failure occurs.
media
Any storage medium.
Media Access Control (MAC)
A sublayer of the Data Link layer of the Open Systems Interconnection (OSI) model that controls the way multiple devices use the same media channel. It controls which devices can transmit and when they can transmit.
message authentication code (MAC)
A common method of verifying integrity. The MAC is derived from the message and a secret key.
Message Digest Algorithm (MDA)
An algorithm that creates a hash value. The hash value is also used to help maintain integrity. There are several versions of MD; the most common are MD5, MD4, and MD2.
Microsoft Challenge Handshake Authentication Protocol (MSCHAP)
An implementation of the Challenge Handshake Authentication Protocol (CHAP) common in Microsoft’s Windows-based operating systems.
misuse-detection IDS (MD-IDS)
A method of evaluating attacks based on attack signatures and audit trails.
modem
A communications device that converts digital computer signals into analog tones for transmission over the Public Switched Telephone Network (PSTN) and converts them back to digital upon reception. The word modem is an acronym for modulator/demodulator.
modification attack
An attack that modifies information on your system.
multicasting
Sending data to more than one address.
multi-factor
The term employed anytime more than one factor must be considered.
multipartite virus
A virus that attacks a system in more than one way.
National Computing Security Center (NCSC)
The agency that developed the Trusted Computer System Evaluation Criteria (TCSEC) and the Trusted Network Interpretation Environmental Guideline (TNIEG).
National Institute of Standards and Technology (NIST)
An agency (formerly known as the National Bureau of Standards [NBS]) that has been involved in developing and support- ing standards for the U.S. government for over 100 years. NIST has become involved in cryptography standards, systems, and technology in a variety of areas. It’s primarily con- cerned with governmental systems, where it exercises a great deal of influence.
National Security Agency (NSA)
The U.S. government agency responsible for protecting U.S. communications and producing foreign intelligence information. It was established by presidential directive in 1952 as a separately organized agency within the Department of Defense (DoD).
need-to-know
A method of information dissemination based on passing information only to those who need to know it.
NetBIOS Extended User Interface (NetBEUI)
A protocol used to transport Network Basic Input Output System (NetBIOS) traffic in a LAN.
NetWare Core Protocol (NCP)
The upper-layer NetWare protocol that functions on top of IPX and provides NetWare resource access to workstations. See also Internetwork Packet Exchange (IPX).
NetWare Directory Services (NDS)
A directory management service used to manage all of the resources in a network. In later versions, the acronym was changed to Novell Directory Services, and the service is now known as eDirectory. NDS provides a database of all of the network objects or resources.
NetWare Link State Protocol (NLSP)
A protocol that gathers routing information based on the link-state routing method. Its precursor is the Routing Information Protocol (RIP). NLSP is a more efficient routing protocol than RIP.
NetWare Loadable Module (NLM)
A component used to provide a NetWare server with additional services and functionality. Unneeded services can be unloaded, thereby conserving memory.
network
A group of devices connected by some means for the purpose of sharing information or resources.
network access control (NAC)
The set of standards defined by the network for clients attempting to access it. Usually, NAC requires that clients be virus free and adhere to speci- fied policies before allowing them on the network.
network attached storage
Storage, such as hard drives, attached to a network for the purpose of storing data for clients on the network. Commonly used for backing up data.
network-based IPS (N-IPS)
An intrusion prevention system that is network based. To prevent the intrusion, it must first detect it (thus making it a superset of IDS), and then act accordingly.
Network Basic Input Output System (NetBIOS)
The native protocol of Windows PCs. It provides a 15-character naming convention for resources on the network. Is a broadcast-oriented network protocol in that all traffic is available to all devices in a LAN. The protocol can be transported over (NetBEUI), TCP/IP, or Internetwork Packet Exchange/Sequenced Packet Exchange (IPX/SPX).
Network Control Protocol (NCP)
The protocol Point-to-Point Protocol (PPP) employs for encapsulating network traffic.
Network File System (NFS)
A protocol that enables users to access files on remote computers as if the files were local.
network interface card (NIC)
A physical device that connects computers and other network equipment to the transmission medium.
Network Interface layer
The lowest level of the TCP/IP suite; it is responsible for placing and removing packets on the physical network.
Network layer
The third layer of the OSI model, it is responsible for logical addressing and translating logical names into physical addresses. This layer also controls the routing of data from source to destination as well as the building and dismantling of packets. See also Open Systems Interconnection (OSI) model.
Network Operations Center (NOC)
A single, centralized area for network monitoring and administrative control of systems.
network operating system (NOS)
The software enabling networking; can be on a LAN or WAN.
network sniffer
A device that has access to the signaling on the network cable.
network-based IDS (N-IDS)
An approach to an intrusion detection system (IDS), it attaches the system to a point in the network where it can monitor and report on all network traffic.
New Technology LAN Manager (NTLM)
The protocol that Microsoft Windows–based operating systems use for authentication with remote access protocols.
nonessential service
A service that isn’t necessary to keep the server operating at the expected level in its expected role.
Noninterference model
A model intended to ensure that higher-level security functions don’t interfere with lower-level functions.
nonrepudiation
Verifying (by whatever means) that data was seen by an intended party. It makes sure they received the data and can’t repudiate (dispute) that it arrived.
notification
The act of being alerted to an event.
notification policies
A set of rules about what triggers notification.
Novell Distributed Print Services (NDPS)
A Novell-designed printing system that uses NetWare Directory Services (NDS), known as eDirectory in NetWare 6, to install and manage printers. NDPS supports automatic network printer installation, automatic distribution of client printer drivers, and centralized printer management without the use of print queues.
offsite storage
Storing data off site, usually in a secure location.
one-tier model
A model in which the database and applications exist on the same system.
one-time pad
Words added to values during authentication. The message to be encrypted is added to this random text before hashing.
onsite storage
Storing backup data at the same site as the servers on which the original data resides.
Open Shortest Path First (OSPF)
A link-state routing protocol used in IP networks.
Open Systems Interconnection (OSI) model
A model defined by the ISO to categorize the process of communication between computers in terms of seven layers. The seven layers are Application, Presentation, Session, Transport, Network, Data Link, and Physical. See also International Organization for Standardization (ISO).
operational security
Security as it relates to how an organization does things (operates).
operator
The person primarily responsible for the intrusion detection system (IDS).
OS hardening
The process of applying all security patches and fixes to an operating system to make it as secure as possible.
out-of-band method
A way to transmit the encryption key by using a method other than the one used to transmit the data. The key value is sent by letter, by courier, or by some other separate means.
OVAL
An acronym for Open Vulnerability and Assessment Language, it is a community standard for system analysis that focuses on testing, analyzing, and reporting.
owner
The person responsible for the current existence of a resource.
packet filtering
A firewall technology that accepts or rejects packets based on their content.
packet switching
The process of breaking messages into packets at the sending router for easier transmission over a WAN.
pad
A number of characters often added to data before an operation such as hashing takes place. Most often unique values, known as one-time pads, are added to make the resulting hash unique.
partitioning
The process of breaking a network into smaller components that can be individually protected.
passive detection
A type of intruder detection that logs all network events to a file for an administrator to view later.
passive response
A nonactive response, such as logging. The most common type of response to many intrusions. In general, the easiest to develop and implement.
Password Authentication Protocol (PAP)
One of the simplest forms of authentication. Authentication is accomplished by sending the username and password to the server and having them verified. Passwords are sent as clear text and, therefore, can be easily seen if intercepted.
password guessing
Attempting to enter a password by guessing its value.
password history
A list of passwords that have already been used.
patch
A fix for a known software problem.
penetration
The act of gaining access.
perimeter security
Security set up on the outside of the network or server to protect it.
phage virus
A virus that modifies and alters other programs and databases.
phishing
A form of social engineering in which you simply ask someone for a piece of information that you are missing by making it look as if it is a legitimate request. Commonly sent via e-mail.
phreaker
Someone who abuses phone systems, as opposed to data systems.
physical access control
Control access measures used to restrict physical access to the
server(s).
physical barrier
An object, such as a locked door, used to restrict physical access to network components.
Physical layer
The first layer of the OSI model; controls the functional interface. See also Open Systems Interconnection (OSI) model.
physical port
On a computer, an interface where you can connect a device.
physical security
Security that guards the physical aspects of the network.
Ping
A TCP/IP utility used to test whether another host is reachable. An Internet Control Message Protocol (ICMP) request is sent to the host, which responds with a reply if it’s reachable. The request times out if the host isn’t reachable.
ping of death
A large Internet Control Message Protocol (ICMP) packet sent to overflow the remote host’s buffer. Usually causes the remote host to reboot or hang.
Plain Old Telephone Service (POTS)
Standard telephone service, as opposed to other connection technologies like Digital Subscriber Line (DSL).
point-to-point
Network communication in which two devices have exclusive access to a network medium. For example, a printer connected to only one workstation is using this type of connection.
Point-to-Point Protocol (PPP)
A full-duplex line protocol that supersedes Serial Line Internet Protocol (SLIP). It’s part of the standard TCP/IP suite and is often used in dial-up connections.
Point-to-Point Tunneling Protocol (PPTP)
An extension to Point-to-Point Protocol (PPP) that is used in virtual private networks (VPNs). An alternative is L2TP.
policies
Rules or standards governing usage.
polymorphic
An attribute of some viruses that allows them to mutate and appear differ- ently each time they crop up. The mutations make it harder for virus scanners to detect (and react) to the viruses.
port
Some kind of opening that allows network data to pass through.
Port Address Translation (PAT)
A means of translating between ports on a public and private network. Similar to Network Address Translation (NAT), which translates addresses between public and private.
port scanner
The item (physical or software) that scans a server for open ports that can be taken advantage of. Port scanning is the process of sending messages to ports to see which ones are available and which ones aren’t.
postmortem
Anything that occurs “after the fact,” such as an audit or review.
Post Office Protocol (POP)
An e-mail access program that can be used to retrieve e-mail from an e-mail server.
Post Office Protocol Version 3 (POP3)
The protocol used to download e-mail from an SMTP e-mail server to a network client. See also Simple Mail Transfer Protocol (SMTP).
power conditioner
A device that “conditions” the electrical supply to take out spikes and surges.
power system
A device that provides electrical power.
Presentation layer
The sixth layer of the OSI model; responsible for formatting data exchange, such as graphic commands, and converting character sets. This layer is also responsible for data compression, data encryption, and data stream redirection. See also Open Systems Interconnection (OSI) model.
preservation of evidence
The process of controlling access to evidence within chain-of- custody measures, often by placing it in a controlled-access area with a single custodian responsible for all access.
Pretty Good Privacy (PGP)
An implementation of RSA encryption. See also RSA.
privacy
A state of security in which information isn’t seen by unauthorized parties without the express permission of the party involved.
Private Branch Exchange (PBX)
A system that allows users to connect voice, data, pagers, networks, and almost any other application into a single telecommunications system. This system allows an organization to be its own phone company.
private information
Information that isn’t for public knowledge.
private key
An asymmetric encryption technology in which both the sender and the receiver have different keys. A public key is used to encrypt messages and the private key is used to decrypt them. See also public key.
private network
The part of a network that lies behind a firewall and isn’t “seen” on the Internet. See also firewall.
privilege audit
An audit performed to verify that no user is accessing information, or able to access information, beyond the security level at which they should be operating.
privilege escalation
The result when a user obtains access to a resource they wouldn’t normally be able to access. an be done inadvertently, by running a program with Set User ID (SUID) or Set Group ID (SGID) permissions or by temporarily becoming another user (via su or sudo in Unix/Linux or RunAs in Windows 2000/2003).
process list
The list of processes currently running on a system. In Windows NT/2000, it can be seen with Task Manager; the ps command shows it in Unix/Linux. Viewing a pro- cess list is one of the first steps to take to look for rogue processes running on a server.
promiscuous mode
A mode wherein a network interface card (NIC) intercepts all traffic crossing the network wire and not just the traffic intended for it.
protocol analyzer
A software and hardware troubleshooting tool that is used to decode protocol information to try to determine the source of a network problem and to establish baselines.
protocols
Standards or rules.
proxy
A type of firewall that prevents direct communication between a client and a host by acting as an intermediary. See also firewall.
proxy cache server
An implementation of a web proxy. The server receives an HTTP request from a web browser and makes the request on behalf of the sending workstation. When the response comes, the proxy cache server caches a copy of the response locally. The next time someone makes a request for the same web page or Internet information, the proxy cache server can fulfill the request out of the cache instead of having to retrieve the resource from the Web.
proxy firewall
A proxy server that also acts as a firewall, blocking network access from external networks.
proxy server
A type of server that makes a single Internet connection and services requests on behalf of many users.
public information
Information that is publicly made available to all.
public key
A technology that uses two keys—a public key and a private key—to facilitate communication. The public key is used to encrypt a message to a receiver. See also private key.
Public Key Cryptography Standards (PKCS)
A set of voluntary standards created by RSA security and industry security leaders.
Public Key Infrastructure (PKI)
A two-key encryption system wherein messages are encrypted with a private key and decrypted with a public key.
Public Key Infrastructure X.509 (PKIX)
The Internet Engineering Task Force (IETF) working group developing standards and models for the Public Key Infrastructure (PKI) environment.
public network
The part of a network outside a firewall that is exposed to the public. See also firewall.
public key system
An encryption system employing a key that is known to users beyond the recipient.
quantum cryptography
Cryptography based on changing the polarity of a photon. Makes the process of interception difficult because any attempt to intercept the message changes the value of the message.
radio frequency (RF)
The part of the radio spectrum that a device uses.
radio frequency interference (RFI)
The byproduct of electrical processes, similar to electromagnetic interference. The major difference is that RFI is usually projected across a radio spectrum.
RAID levels
The different types of RAID, such as RAID-0, RAID-1, and so on.
Redundant Array of Independent (or Inexpensive) Disks (RAID)
A configuration of multiple hard disks used to provide fault tolerance, should a disk fail, or gains in efficiency. Different levels exist.
registration authority (RA)
An organization that offloads some of the work from a certificate authority (CA). This system operates as a middleman in the process & can distribute keys, accept registrations for the CA, and validate identities. Doesn’t issue certificates; that responsibility remains with the CA.
relying party
The person receiving a certificate.
remote access protocol
Any networking protocol that is used to gain access to a network over public communication links.
remote access server (RAS)
A computer that has one or more modems installed to enable remote connections to the network.
Remote Authentication Dial-In User Service (RADIUS)
A mechanism that allows authen- tication of dial-in and other network connections. RADIUS is commonly used by Internet service providers (ISPs) and in the implementation of virtual private networks (VPNs).
replay attack
Any attack where the data is retransmitted repeatedly (often fraudulently or maliciously). In one such possibility, a user can replay a web session and visit sites intended only for the original user.
replication
The process of copying directory information to other servers to keep them all synchronized.
repository
A database or database server where the certificates are stored.
repudiation attack
An attack in which the intruder modifies information in a system.
Request for Comments (RFC)
A document creation process and a set of practices that originated in 1969 and is used for proposed changes to Internet standards.
response
How you react to an event.
restricted information
Information that isn’t made available to all and to which access is granted based on some criteria.
retrovirus
A virus that attacks or bypasses the antivirus software installed on a computer.
reverse DNS
Using an IP address to find a domain name rather than using a domain name to find an IP address (normal DNS). Pointer (PTR) records are used for the reverse lookup, and often reverse DNS is used to authenticate incoming connections.
reverse engineering
The process of re-creating the functionality of an item by first deciding what the result is and then creating something from scratch that serves the same purpose.
revocation
The process of canceling credentials that have been lost or stolen (or are no longer valid).
risk analysis
An evaluation of each risk that can be identified. Each risk should be outlined,
described, and evaluated on the likelihood of it occurring.
risk assessment
An evaluation of how much risk you and your organization are willing to take. An assessment must be performed before any other actions—such as how much to spend on security in terms of dollars and manpower—can be decided.
Rivest Cipher 5 (RC5)
A cipher algorithm created by Ronald Rivest (for RSA) and known for its speed. It works through blocks of variable sizes using three phases: key expansion, encryption, and decryption.
roaming profile
A profile downloaded from a server at each logon. When a user logs out at the end of the session, changes are made and remembered for the next time the user logs on.
rogue server
An active Dynamic Host Configuration Protocol (DHCP) server that has been added to the network and is now leasing addresses to users instead of them obtaining an address from your server.
Role-Based Access Control (RBAC)
A type of control wherein the levels of security closely follow the structure of an organization. The role the person plays in the organization (accoun- tant, salesman, and so on) corresponds to the level of security access they have to data.
rootkit
Software program that has the ability to obtain root-level access and hide certain things from the operating system.
route
The path to get to the destination from a source.
route cost
The number of router hops between the source and the destination in an inter-
network.
router
A device that connects two or more networks and allows packets to be transmitted and received between them. A router determines the best path for data packets from source to destination.
routing
A function of the Network layer that involves moving data throughout a network. Data passes through several network subnetworks using routers that can select the path the data takes.
Routing Information Protocol (RIP)
A distance-vector route discovery protocol used by Internetwork Packet Exchange (IPX) and Internet Protocol (IP). IPX uses hops and ticks to determine the cost for a particular route. See also Internetwork Packet Exchange (IPX).
routing table
A table that contains information about the locations of other routers on the network and their distance from the current router.
RSA
One of the providers of cryptography systems to industry and government. Acronym stands for the initials of the three founders. Maintains a list of standards for Public Key Cryptography Standards (PKCS).
RSA
A commercial company that produces encryption software. RSA stands for Rivest, Shamir, and Adleman, the founders of the company.
Rule Set-Based Access Control (RSBAC)
An open-source access control framework for the Linux kernel that uses access control modules to implement Mandatory Access Control (MAC).
sandbox
A set of rules used when creating a Java applet that prevents certain functions when the applet is sent as part of a web page.
scanning
The process that attackers use to gather information about how a network is configured.
screened host
A router that is in front of a server on the private network. Typically, this server does packet filtering before reaching the firewall/proxy server that services the internal network.
Secure Electronic Transaction (SET)
A protocol developed by Visa and MasterCard for secure credit card transactions. The protocol is becoming an accepted standard by many companies. SET provides encrypted credit card numbers over the Internet, and it’s most suited to small amounts of data transmission.
Secure Hash Algorithm (SHA)
A one-way hash algorithm designed to ensure the integrity of a message.
Secure Hypertext Transfer Protocol (S-HTTP)
A protocol used for secure communications between a web server and a web browser.
Secure Shell (SSH)
A replacement for rlogin in Unix/Linux that includes security. rlogin allowed one host to establish a connection with another with no real security being employed; this replaces it with slogin and digital certificates.
Secure Sockets Layer (SSL)
A protocol that secures messages by operating between the Application layer (HTTP) and the Transport layer.
Secure WLAN Protocol (SWP)
A method of securing wireless networks that is beginning to gain momentum and acceptance.
Security Accounts Manager (SAM)
A database within Windows NT–based operating systems that contains information about all users and groups and their associated rights and settings within a domain.
security audit
An audit of the system (host, network, and so on) for security vulnerabilities and holes.
security log
A log file used in Windows NT to keep track of security events specified by the domain’s audit policy.
security policies
Rules set in place by a company to ensure the security of a network. These may include how often a password must be changed or how many characters a pass- word should be.
security professionals
Individuals who make their living working with computer security.
security token
A piece of data that contains the rights and access privileges of the token bearer as part of the token.
security zone
A method of isolating a system from other systems or networks.
segment
A unit of data transmission found at the Transport layer of the Open Systems Interconnection (OSI) model and used by TCP.
sensor
A device that collects data from the data source and passes it on to the analyzer.
separation of duties
A set of policies designed to reduce the risk of fraud and prevent other losses in an organization.
sequence number
A number used to determine the order in which parts of a packet are to be reassembled after the packet has been split into sections.
Sequenced Packet Exchange (SPX)
A connection-oriented protocol that is part of the Internetwork Packet Exchange (IPX) protocol suite. It operates at the Transport layer of the OSI model. It initiates the connection between the sender and receiver, transmits the data, and then terminates the connection. See also Internetwork Packet Exchange (IPX), Open Systems Interconnection (OSI) model.
Serial Line Internet Protocol (SLIP)
An older protocol that was used in early remote- access environments. SLIP was originally designed to connect Unix systems together in a dial-up environment, and it supports only serial communications.
server
A computer that provides resources to the clients on the network.
server and client configuration
A network in which the resources are located on a server and accessed by clients.
server authentication
A process that requires the workstation to authenticate against the server.
service
An item that adds functionality to a network by providing resources or doing tasks for other computers. In Windows-based operating systems, these include file and printer sharing for Microsoft or Novell networks.
service account
An account created on a server for a user to perform special services, such as a backup operator, an account operator, and a server operator.
service-level agreement (SLA)
An agreement that specifies performance requirements for a vendor. This agreement may use mean time before failure (MTBF) and mean time to repair (MTTR) as performance measures in the SLA.
service pack
Operating system updates from Microsoft.
session key
The agreed-upon (during connection) key used between a client and a server during a session. This key is generated by encrypting the server’s digital ID (after validity has been established). The asymmetric key pair is then used to encrypt and verify the session key that is passed back and forth between client and server during the length of the connection.
Session layer
The fifth layer of the OSI model. It determines how two computers establish, use, and end a session. Security authentication and network naming functions required for applications occur here. The Session layer establishes, maintains, and breaks dialogs between two stations. See also Open Systems Interconnection (OSI) model.
share-level security
A network security method that assigns passwords to individual files or other network resources (such as printers) instead of assigning rights to network resources to users. The passwords are then given to all users that need access to these resources. All resources are visible from anywhere in the network, and any user who knows the password for a particular network resource can make changes to it.
Shielded Twisted Pair (STP)
Network cabling media that has a shield, similar to coax, wrapped over the wires.
shoulder surfing
Watching someone when they enter their username/password/ sensitive data.
signal
Transmission from one PC to another. A signal could be a notification to start a
session or end a session.
signal encoding
The process whereby a protocol at the Physical layer receives information from the upper layers and translates all the data into signals that can be transmitted on a transmission medium.
signaling method
The process of transmitting data across the medium. Two types are digital and analog.
signed applet
An applet that doesn’t run in the Java sandbox and has higher system access capabilities. Signed applets aren’t usually downloaded from the Internet but are provided by in-house or custom programming efforts.
Simple Mail Transfer Protocol (SMTP)
A protocol for sending e-mail between SMTP servers.
Simple Network Management Protocol (SNMP)
The management protocol created for sending information about the health of the network-to-network management consoles.
single loss expectancy (SLE)
The cost of a single loss when it occurs. This loss can be a critical failure, or it can be the result of an attack.
single sign-on (SSO)
A relationship between the client and the network wherein the client is allowed to log on one time, and all resource access is based on that logon (as opposed to needing to log on to each individual server to access the resources there).
site survey
A generic site survey involves listening in on an existing wireless network using commercially available technologies. A wireless site survey, or wireless survey, is the process of planning and designing a wireless network, in particular an 802.11.
SMTP relay
A feature designed into many e-mail servers that allows them to forward e-mail to other e-mail servers. While the ability to act as a relay exists to allow networks to grow, the possibility exists for rogue servers to also participate.
smurf attack
An attack in which large volumes of ICMP echo requests (pings) are broad- cast to all other machines on the network and in which the source address of the broadcast system has been spoofed to appear as though it came from the target computer. When all the machines that received the broadcast respond, they flood the target with more data than it can handle.
snapshot backup
A method of performing backups that creates a compressed file of a database as it exists at the moment, without taking the users offline. A snapshot backup can take the place of other backups. It’s often run on mirrored servers, but the snapshot captures only the most recent version of files.
sniffer
A physical device that listens in on network traffic and looks for items it can make sense of. There is a legitimate purpose for these devices: Administrators use them to analyze traffic. However, when they’re used by sources other than the administrator, they become security risks.
sniffing
Analyzing data to look for passwords and anything else of value. Sniffing is also known as wiretapping, eavesdropping, and a number of other terms (packet sniffing, net- work sniffing, and so on).
snooping
Looking through files in hopes of finding something interesting.
social engineering
An attack that uses others by deceiving them.
socket
The primary method used to communicate with services and applications such as the Web and Telnet. Is a programming construct that enables communication by mapping between ports and addresses.
software exploitation
An attack launched against applications and higher-level services.
spam
Unwanted, unsolicited e-mail sent in bulk.
spike
A momentary or instantaneous increase in power over a power line.
spoofing attack
An attempt by someone or something to masquerade as someone else.
spyware
Software programs that work—often actively—on behalf of a third party.
state table
A firewall security method that monitors the status of all the connections through the firewall.
stateful packet filtering
Inspections that occur at all levels of the network and provide additional security using a state table that tracks every communications channel.
static Address Resolution Protocol (ARP) table entry
An entry in the Address Resolution Protocol (ARP) table that a user adds manually when a PC will be accessed often.
static routing
A method of routing packets where the router’s routing table is updated manually by the network administrator instead of automatically by a route discovery protocol.
stealth port
A port that is open but might not be obvious (invisible to those who don’t know it exists). Trojan horses often exploit them.
stealth virus
A virus that attempts to avoid detection by masking itself from applications.
steganography
The science of hiding information within other information, such as a picture.
strength
The effectiveness of a cryptographic system in preventing unauthorized decryption.
subscriber
An individual who is attempting to present a certificate proving authenticity.
surge protector
A device that protects electrical components from momentary or instantaneous increases (called spikes) in a power line.
switched
A network that has multiple routes to get from a source to a destination. Switching allows for higher speeds.
symmetrical keys
The keys used when the same key encrypts and decrypts data.
SYN flood
A denial of service attack in which the hacker sends a barrage of spoofed SYN packets. The receiving station tries to respond to each SYN request for a connection, thereby tying up all the resources. All incoming connections are rejected until all current connections can be established.
system architecture
Documents that provide you with the blueprint of your organization’s software and hardware infrastructure.
tap
A type of connection that directly attaches to a cable
TCP ACK attack
An attack that begins as a normal TCP connection and whose purpose is to deny service. It’s also known as a TCP SYN flood.
TCP sequence attack
An attack wherein the attacker intercepts and then responds with a sequence number similar to the one used in the original session. The attack can either disrupt a session or hijack a valid session.
TCP wrapper
A low-level logging package designed for Unix systems.
TCP/IP hijacking
An attack in which the attacker commandeers a TCP session from a legitimate user after the legitimate user has achieved authentication, thereby removing the need for the attacker to authenticate himself.
teardrop attack
A DoS attack that uses large packets and odd offset values to confuse the receiver and help facilitate a crash.
Telnet
A protocol that functions at the Application layer of the OSI model, providing terminal emulation capabilities. See also Open Systems Interconnection (OSI) model.
Temporal Key Interchange/Integrity Protocol (TKIP)
A wrapper that works with wireless encryption to strengthen WEP implementations.
Terminal Access Controller Access Control System (TACACS)
An authentication system that allows credentials to be accepted from multiple methods, including Kerberos. This client/server process occurs in the same manner as the Remote Authentication Dial-In User Service (RADIUS) process.
terminal emulator
A program that enables a PC to act as a terminal for a mainframe or a Unix system.
termination policy
A clear process of informing affected departments of a voluntary or involuntary termination.
test account
An administrator-created account for confirming the basic functionality of a newly installed application, for example. The test account has equal rights to accounts that will use the new functionality. It’s important to use test accounts instead of administrator accounts to test new functionality. If an administrator account is used, problems related to user rights might not manifest themselves because administrator accounts typically have full rights to all network resources.
thin client
Systems that don’t provide any disk storage or removable media on their workstations.
third party
A party responsible for providing assurance to the relying party that a subscriber is genuine.
threat
Any perceivable risk.
three-tier model
A system that effectively isolates the end user from the database by introducing a middle-tier server.
time to live (TTL)
A field in an IP packet that indicates how many routers the packet can cross (hops it can make) and how long it takes before it’s discarded. Also used in Address Resolution Protocol (ARP) tables to indicate how long an entry should remain in the table.
token
A piece of data holding information about the user. This information can contain
group IDs, user IDs, privilege level, and so on.
Tracert
The command-line utility that shows the user every router interface a packet passes through on its way to a destination.
trailer
A section of a data packet that contains error-checking information.
transceiver
A device that allows the network interface card (NIC) to connect to the network.
transmission
Sending packets from the PC to the server. Can occur over a network cable, wireless connection, or other medium.
Transmission Control Protocol (TCP)
The protocol found at the Host-to-Host layer of the Department of Defense (DoD) model. This protocol breaks data packets into segments, num- bers them, and sends them in order. The receiving computer reassembles the data so that the information is readable for the user. In the process, the sender and the receiver confirm that all data has been received; if not, it’s resent. TCP is a connection-oriented protocol. See also connection-oriented.
Transmission Control Protocol/Internet Protocol (TCP/IP)
The protocol suite developed by the Department of Defense (DoD) in conjunction with the Internet. It was designed as an internetworking protocol suite that could route information around network failures. Today it’s the de facto standard for communications on the Internet.
transmission media
Physical cables and/or wireless technology across which computers are able to communicate.
Transport layer
The fourth layer of the OSI model. It’s responsible for checking that the data packet created in the Session layer was received. If necessary, it also changes the length of messages for transport up or down the remaining layers. See also Open Systems Intercon- nection (OSI) model.
Transport Layer Security (TLS)
A protocol whose purpose is to verify that secure com- munications between a server and a client remain secure. Defined in RFC 2246.
Triple-DES (3DES)
A symmetric block cipher algorithm used for encryption.
Trivial File Transfer Protocol (TFTP)
A UDP-based protocol similar to FTP that doesn’t provide the security or error-checking features of FTP. See also File Transfer Protocol (FTP).
Trojan horse
Any application that masquerades as one thing in order to get past scrutiny and then does something malicious. One of the major differences is that these tend not to replicate themselves.
Trust List
A list of objects signed by a trusted entity. Also known as a Certificate Trust List (CTL).
Trusted Platform Module (TPM)
A method of utilizing encryption and storing the pass- words on a chip. The hardware holding the chip is then needed to unencrypt the data and make it readable.
tunneling
The act of sending data across a public network by encapsulating it into other packets.
two-factor authentication
Using two access methods as a part of the authentication process.
two-tier model
A model in which the client PC or system runs an application that communicates with a database that is running on a different server.
Uniform Resource Locator (URL)
A way of identifying a document on the Internet. It consists of the protocol used to access the document and the domain name or IP address of the host that holds the document; for example, http://www.sybex.com.
uninterruptible power supply (UPS)
A device that can provide short-term power, usually by using batteries.
Unshielded Twisted Pair (UTP)
The most common networking cable currently in use; 8-wire cabling used with Ethernet.
uptime
The amount of time a particular computer or network component has been functional.
usage policies
Defined policies governing computer usage.
user
The person who is using a computer or network or a resource.
User Datagram Protocol (UDP)
The protocol at the Host-to-Host layer of the TCP/IP Department of Defense (DoD) model, which corresponds to the Transport layer of the OSI model. Packets are divided into datagrams, given numbers, sent, and put back together at the receiving end. UDP is a connectionless protocol. See also connectionless, Open Systems Interconnection (OSI) model.
user-level security
A type of network security in which user accounts can read, write, change, and take ownership of files. Rights are assigned to user accounts, and each user knows only their own username and password—which makes this the preferred method for securing files.
user management policies
Defined policies that detail user management.
virtual LAN (VLAN)
Local area network (LAN) that allows users on different switch ports to participate in their own network separate from, but still connected to, the other stations on the same or a connected switch.
virtual link
A link created by using a switch to limit network traffic.
virtual private network (VPN)
System that uses the public Internet as a backbone for a
private interconnection (network) between locations.
virus
A program intended to damage a computer system. Sophisticated viruses are encrypted and hide in a computer, and might not appear until the user performs a certain action or until a certain date. See also antivirus.
volume
The loudness of a sound, or the portion of a hard disk that functions as if it were a separate hard disk.
war driving
Driving around with a laptop looking for open wireless access points with which to communicate.
warm site
A site that provides some capabilities in the event of a disaster. The organiza- tion that wants to use a warm site will need to install, configure, and reestablish operations on systems that might already exist in the warm site.
weak key
A cipher hole that can be exploited.
weak key attack
An attack that looks for cipher holes.
web proxy
A type of proxy that is used to act on behalf of a web client or web server.
web server
A server that holds and delivers web pages and other web content using HTTP. See also Hypertext Transfer Protocol (HTTP).
wide area network (WAN)
A network that crosses local, regional, and/or international
boundaries.
Windows Internet Naming Service (WINS)
A Network Basic Input Output System (NetBIOS) name resolution service employed in Windows networks. Windows Internet Naming Service (WINS) translates hostnames into network addresses.
Windows NT service
A type of Windows program (a file with either an .exe or a .dll file- name extension) that is loaded automatically by the server or manually by the administrator.
Windows socket
A Microsoft API used to interact with TCP/IP.
WinNuke
A Windows-based attack that affects only computers running Windows NT 3.51 or 4. It’s caused by the way the Windows NT TCP/IP stack handles bad data in the TCP header. Instead of returning an error code or rejecting the bad data, it sends NT to the Blue Screen of Death (BSOD). Figuratively speaking, the attack “nukes” the computer.
Wired Equivalent Privacy (WEP)
A security protocol for 802.11b (wireless) networks that attempts to establish the same security for them as would be present in a wired network.
wireless access point
A wireless bridge used in a multipoint radio frequency (RF) network.
wireless bridge
A bridge that performs all the functions of a regular bridge but uses RF instead of cables to transmit signals.
Wireless Fidelity (Wi-Fi)
An 802.11b or 802.11g wireless network operating in the 2.4Ghz or 5Hhz frequency range.
wireless local area network (WLAN)
A local area network that employs wireless access points (WAPs) and clients using the 802.11 standards.
wireless portal
The primary method of connecting a wireless device to a network.
wireless technologies
Technologies employing wireless communications.
Wireless Transport Layer Security (WTLS)
The security layer of the Wireless Applications Protocol (WAP). Provides authentication, encryption, and data integrity for wireless devices.
work factor
An estimate of the amount of time and effort that would be needed to break a system.
workgroup
A specific group of users or network devices, organized by job function or proximity to shared resources.
working copy
The copy of the data currently in use on a network.
workstation
A computer that isn’t a server but is on a network. Generally, a workstation
is used to do work, whereas a server is used to store data or perform a network function.
World Wide Web Consortium (W3C)
An association concerned with interoperability, growth, and standardization of the World Wide Web (WWW). This group is the primary sponsor of XML and other web-enabled technologies.
worm
A program similar to a virus. Propagate themselves over a network. See also virus.
X.500
The International Telecommunications Union (ITU) standard for directory services in the late 1980s. The standard was the basis for later models of directory structure, such as Lightweight Directory Access Protocol (LDAP).
zombie
Any system taking directions from a master control computer. Often utilized in distributed denial of service (DDoS) attacks.
zone
An area in a building where access is individually monitored and controlled.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes:

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>