Glossary

Typically unauthorized hidden software or hardware mechanism used to circumvent security controls. 

SOURCE: CNSSI-4009 

An undocumented way of gaining access to a computer system. A backdoor is a potential security risk. 

SOURCE: SP 800-82 

A malicious program that listens for commands on a certain Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port. 

SOURCE: GUIDE TO MALWARE INCIDENT PREVENTION AND HANDLING FOR DESKTOPS AND LAPTOPS 

Commonly used to mean the capacity of a communication channel to pass data through the channel in a given amount of time. Usually expressed in bits per second 

The process of capturing banner information—such as application type and version—that is transmitted by a remote port when a connection is initiated. 

SOURCE: SP 800-115 

An interim compliance validation assessment performed by a QSA to determine the PCI Security compliance status.

SOURCE: VERIZON PCI SECURITY

The minimum security controls required for safeguarding an IT system based on its identified needs for confidentiality, integrity, and/or availability protection. 

SOURCE: SP 800-16 

The simplest web-based authentication scheme that works by sending the username and password with each request 

A special-purpose computer on a network specifically designed and configured to withstand attacks. 

SOURCE: CNSSI-4009 

A non-hostile location protected from external hostile elements by physical, personnel, and procedural security countermeasures. 

SOURCE: CNSSI-4009 

AZNet’s invoicing tool used to generate monthly invoices, in a Graphical User Interface (GUI) format, for telecommunications services provided to state agencies.

A physical or behavioral characteristic of a human being. 

SOURCE: SP 800-32 

A measurable physical characteristic or personal behavioral trait used to recognize the identity, or verify the claimed identity, of an applicant. Facial images, fingerprints, and iris scan samples are all examples of biometrics. 

SOURCE: FIPS 201 

An automated system capable of: 

1) capturing a biometric sample from an end user; 

2) extracting biometric data from that sample; 

3) comparing the extracted biometric data with data contained in one or more references; 

4) deciding how well they match; and 

5) indicating whether or not an identification or verification of identity has been achieved. 

SOURCE: FIPS 201 

A contraction of the term Binary Digit. The smallest unit of information in a binary system of notation. 

SOURCE: CNSSI-4009 

A binary digit having a value of 0 or 1. 

SOURCE: FIPS 180-4 

Designation applied to encrypted information and the information systems, the associated areas, circuits, components, and equipment processing that information. 

SOURCE: CNSSI-4009 

A communication network architecture in which user data traversing a global Internet Protocol (IP) network is end-to-end encrypted at the IP layer. Related to striped core. 

SOURCE: CNSSI-4009 

The process of the system invalidating a user ID based on the user’s inappropriate actions. A blacklisted user ID cannot be used to log on to the system, even with the correct authenticator. Blacklisting and lifting of a blacklisting are both security-relevant events. Blacklisting also applies to blocks placed against IP addresses to prevent inappropriate or unauthorized use of Internet resources. 

SOURCE: CNSSI-4009 

Generating network traffic that is likely to trigger many alerts in a short period of time, to conceal alerts triggered by a “real” attack performed simultaneously. 

SOURCE: SP 800-94 

A symmetric key cryptographic algorithm that transforms a block of information at a time using a cryptographic key. For a block cipher algorithm, the length of the input block is the same as the length of the output block. 

SOURCE: SP 800-90 

A discussion or informational site published on the World Wide Web and consisting of discrete entries ("posts") typically displayed in reverse chronological order (the most recent post appears first). Blogs may be the work of a single individual, occasionally of a small group, and covering a single subject, or may include posts written by large numbers of authors and professionally edited. 

SOURCE: WIKIPEDIA 

The set of data that documents the information system’s adherence to the security controls applied. The BoE will include a Requirements Verification Traceability Matrix (RVTM) delineating where the selected security controls are met and evidence to that 

fact can be found. The BoE content required by an Authorizing Official will be adjusted according to the impact levels selected. 

SOURCE: CNSSI-4009 

Monitoring and control of communications at the external boundary of an information system to prevent and detect malicious and other unauthorized communication, through the use of boundary protection devices (e.g., proxies, gateways, routers, firewalls, guards, encrypted tunnels). 

SOURCE: SP 800-53; CNSSI-4009 

A device with appropriate mechanisms that: (i) facilitates the adjudication of different interconnected system security policies (e.g., controlling the flow of information into or out of an interconnected system); and/or (ii) provides information system boundary protection. 

SOURCE: SP 800-53 

A device with appropriate mechanisms that facilitates the adjudication of different security policies for interconnected systems. 

SOURCE: CNSSI-4009 

An impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors: 

1. The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification; 

2. The unauthorized person who used the protected health information or to whom the disclosure was made; 

3. Whether the protected health information was actually acquired or viewed; and 

4. The extent to which the risk to the protected health information has been mitigated. 

SOURCE: HIPAA (45 CFR §§ 164.400-414) 

A client computer program that can retrieve and display information from servers on the World Wide Web 

A cryptanalysis technique or other kind of attack method involving an exhaustive procedure that tries all possibilities, one-by-one 

Chief Information Officer overseeing all IT assets and personnel in a BU. 

Individual assigned responsibility for maintaining the appropriate operational security posture for an information system or program 

A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information. Attackers exploit such a condition to crash a system or to insert specially crafted code that allows them to gain control of the system. 

SOURCE: SP 800-28; CNSSI-4009 

The documentation of a predetermined set of instructions or procedures that describe how an organization’s mission/business processes will be sustained during and after a significant disruption. 

SOURCE: SP 800-34; CNSSI-4009 

The process of analyzing data and producing reports, data extracts, charts, dashboards and similar output, referred to generically as BI Reports. 

The usability of BI Reports is dependent upon many factors including accuracy, timeliness, availability, change management, service level compliance and the underlying data. 

The dependency upon underlying data (BI Source Data) includes factors such as its fitness for use, accuracy, timeliness, completeness, security, stability and stewardship and transparent communication to consumers of BI Reports when any of these is compromised.