Security

Security terms

1. access right, opportunity, or means of finding, using, or retrieving information
2. Access Authority An entity responsible for monitoring and granting access privileges for other authorized entities.
3. access control The mechanisms for limiting access to certain information based on a user's identity and membership in various predefined groups.
4. Access Control Lists (ACLs) A register of: 1) users (including groups, machines, processes) who have been given permission to use a particular system resource, and 2) the types of…
5. Account Management, User Involves the process of requesting, establishing, issuing, and closing user accounts; 2) tracking users and their respective access authorizations; and 3)…
6. Accountability The principle that individuals using a facility or a computer system must be identifiable.
7. Accreditation If a Marketplace health plan is approved, this is the “seal of approval” given to the plan by an independent organization to show that the plan meets…
8. Accreditation Authority SEE Authorizing Official
9. Accreditation Boundary All components of an information system to be accredited by an authorizing official and excludes separately accredited systems, to which the information…
10. Accreditation Package The evidence provided to the authorizing official to be used in the security accreditation decision process.
11. Accrediting Authority Official with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to agency operations…
12. Accuracy Department of Defense parlance for the notion that information has been maintained and transferred in such a way as to be inviolate (the information has…
13. Activation Data Private data, other than keys, that are required to access cryptographic modules.
14. Active Content Active content refers to electronic documents that are able to automatically carry out or trigger actions on a computer platform without the intervention…
15. Adequate Security Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.
16. Administrative Safeguards Administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect…
17. Advanced Encryption Standard (AES) The Advanced Encryption Standard specifies a U.S. Government-approved cryptographic algorithm that can be used to protect electronic data.
18. Agency A firm that solicits insurance for one or more insurance carriers. It also may issue policies and adjust losses.
19. Agency Certification Authority (CA) A CA that acts on behalf of an Agency, and is under the operational control of an Agency.
20. Agent Agent means any individual, other than a broker-dealer, who represents a broker-dealer or issuer in effecting or attempting to effect purchases or sales…
21. Algorithm A detailed formula or set of steps for solving a particular problem. To be an algorithm, a set of rules must be unambiguous and have a clear stopping…
22. Analysis A process in which anything complex is separated into simple or less complex parts.
23. ANSI (American National Standards Institute) A private, non-profit organization that administers and coordinates the U.S. voluntary standardization and conformity assessment system.
24. Antivirus Software A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents.
25. API (Application Programming Interface) A set of functions that gives programmers access to another application's internal features from within their own application.
26. Applicant inventor or joint inventors who are applying for a patent on their own invention, or the person mentioned in 37 CFR 1.42, 1.43 or 1.
27. Application Under the Equal Credit Opportunity Act (ECOA), an oral or written request for an extension of credit that is made in accordance with the procedures…
28. Application Content Filtering Application content filtering is performed by a software proxy agent to remove or quarantine viruses that may be contained in email attachments, to block…
29. Approved Federal Information Processing Standard (FIPS) approved or National Institute of Standards and Technology (NIST) recommended.
30. Approved Mode of Operation A mode of the cryptographic module that employs only Approved security functions (not to be confused with a specific mode of an Approved security…
31. Approved Security Function A security function (e.g., cryptographic algorithm, cryptographic key management technique, or authentication technique) that is either a) specified in an…
32. Arch A fingerprint pattern in which the friction ridges enter from one side, make a rise in the center, and exit on the opposite side.
33. Assessment Method A focused activity or action employed by an assessor for evaluating a particular attribute of a security control.
34. Assessment Procedure A set of activities or actions employed by an assessor to determine the extent to which a security control is implemented correctly, operating as…
35. Asset Anything owned that has value; any interest in real property or personal property that can be used for payment of debts.
36. Assurance One of the five Security Goals. It involves support for our confidence that the other four security goals (integrity, availability, confidentiality, and…
37. Asymmetric Keys Two related keys, a public key and a private key that are used to perform complementary operations, such as encryption and decryption or signature…
38. Attack Signature A specific sequence of events indicative of an unauthorized access attempt.
39. Attempt The submission of a single set of biometric sample to a biometric system for identification or verification.
40. Attribute Authority An entity, recognized by the Federal Public Key Infrastructure (PKI) Policy Authority or comparable Agency body as having the authority to verify the…
41. Audit An audit is a professional, independent examination of a company's financial statements and accounting documents following generally accepted accounting…
42. Audit Data Chronological record of system activities to enable the reconstruction and examination of the sequence of events and changes in an event.
43. Audit Reduction Tools Preprocessors designed to reduce the volume of audit records to facilitate manual review.
44. Audit Trail In computer security systems, a chronological record of when users logged in, how long they were engaged in various activities, what they were doing, and…
45. Authenticate To confirm the identity of an entity when that identity is presented.
46. authentication The process of validating the credentials of a person, computer process, or device.
47. Authentication Code A cryptographic checksum based on an Approved security function (also known as a Message Authentication Code (MAC)).
48. Authentication Mechanism Hardware or software-based mechanisms that force users to prove their identity before accessing data on a device.
49. Authentication Mode A block cipher mode of operation that can provide assurance of the authenticity and, therefore, the integrity of data.
50. Authentication Protocol The protocol by which an entity on a network proves its identity to a remote entity.
51. Authentication Tag A pair of bit strings associated to data to provide assurance of its authenticity.
52. Authentication Token Authentication information conveyed during an authentication exchange.
53. Authentication, Electronic The process of establishing confidence in user identities electronically presented to an information system.
54. authenticity sum of the qualities of a record that establish the origin, reliability, trustworthiness, and correctness of its content
55. Authorization The issuance of approval, by a credit card issuer, merchant, or other affiliate, to complete a credit card transaction.
56. Authorize Processing The official management decision given by a senior agency official to authorize operation of an information system and to explicitly accept the risk to…
57. Authorizing Official Official with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to agency operations…
58. Authorizing Official Designated Representative Individual selected by an authorizing official to act on their behalf in coordinating and carrying out the necessary activities required during the…
59. Automated Biometric Identification System (ABIS) Department of Defense (DOD) system implemented to improve the U.S. government's ability to track and identify national security threats.
60. Automated Fingerprint Identification System (AFIS) (AFIS) A system designed to significantly speed and increase the accuracy of the finger printing process.
61. Automated Key Transport The transport of cryptographic keys, usually in encrypted form, using electronic means such as a computer network (e.g.
62. Automated Password Generator An algorithm which creates random passwords that have no association with a particular user.
63. Availability A reflection of the form and location of nutritional elements and their suitability for absorption.
64. Awareness (Information Security) Activities which seek to focus an individuals attention on an (information security) issue or set of issues.
65. Backup To create a copy of data as a precaution against the loss or damage of the original data.
66. Baseline Security The minimum security controls required for safeguarding an IT system based on its identified needs for confidentiality, integrity and/or availability…
67. Baselining Monitoring resources to determine typical utilization patterns so that significant deviations can be detected.
68. Bastion Host A bastion host is typically a firewall implemented on top of an operating system that has been specially configured and hardened to be resistant to attack.
69. Behavioral Biometric Characteristic A biometric characteristic that is learned and acquired over time rather than one based primarily on biology.
70. Behavioral Outcome What an individual who has completed the specific training module is expected to be able to accomplish in terms of IT security-related job performance.
71. Benchmarking To measure a process or practice according to specified standards or references
72. Bifurcation A split in the delivery path of an e-mail message, which is sent to multiple recipients, so that the different recipients receive different copies of the…
73. binding The ability of molecules to bind each other non-covalently because of the exact shape and chemical nature of parts of their surfaces.
74. Binning Process of parsing (examining) or classifying data in order to accelerate and/or improve biometric matching.
75. BioAPI (Biometrics Application Programming Interface) Defines the application programming interface and service provider interface for a standard biometric technology interface.
76. Biological Biometric Characteristic A biometric characteristic based primarily on an anatomical or physiological characteristic, rather than a learned behavior.
77. Biometric A physical or behavioral characteristic of a human being.
78. Biometric Consortium (BC) An open forum to share information throughout government, industry, and academia. For more information visit www.biometrics.org.
79. Biometric Data A catch-all phrase for computer data created during a biometric process. It encompasses raw sensor observations, biometric samples, models, templates…
80. Biometric Information The stored electronic information pertaining to a biometric. This information can be in terms of raw or compressed pixels or in terms of some…
81. Biometric Sample Information or computer data obtained from a biometric sensor device. Examples are images of a face or fingerprint.
82. Biometric System An automated system capable of: 1) capturing a biometric sample from an end user; 2) extracting biometric data from that sample; 3) comparing the…
83. Biometric Template A characteristic of biometric information (e.g. minutiae or patterns.)
84. Biometrics (BY-oh-MEH-triks) The science of collecting and analyzing biologic or health data using statistical methods.
85. Blended Attack Malicious code that uses multiple methods to spread.
86. block A repetition/replication of the Early, Mid and Late Seral Treatment plots and a Control plot. See Repetition/replication.
87. Block Cipher A symmetric key cryptographic algorithm that transforms a block of information at a time using a cryptographic key.
88. Block Cipher Algorithm A family of functions and their inverses that is parameterized by a cryptographic key; the function maps bit strings of a fixed length to bit strings of…
89. Boot Sector Virus A virus that plants itself in a systems boot sector and infects the master boot record.
90. Botnet (also zombies) A collection of computers subject to centralized remote control by an outside party, usually without the knowledge of the owners, using surreptitiously…
91. Boundary Protection Monitoring and control of communications at the external boundary between information systems completely under the management and control of the…
92. Boundary Router A boundary router is located at the organizations boundary to an external network.
93. Brute Force Password Attack A method of accessing an obstructed device through attempting multiple combinations of numeric and/or alphanumeric passwords.
94. Buffer Overflow A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other…
95. Buffer Overflow Attack A method of overloading a predefined amount of space in a buffer, which can potentially overwrite and corrupt data in memory.
96. Business Continuity Plan (BCP) The documentation of a predetermined set of instructions or procedures that describe how an organizations business functions will be sustained during and…
97. Business Impact Analysis (BIA) An analysis of an information technology (IT) systems requirements, processes, and interdependencies used to characterize system contingency requirements…
98. Business Recovery-Resumption Plan (BRP) The documentation of a predetermined set of instructions or procedures that describe how business processes will be restored after a significant…
99. CA (certification authority) An entity responsible for establishing and vouching for the authenticity of public keys belonging to subjects (usually users or computers) or other…
100. Capture The method of taking a biometric sample from an end user. Source: FIPS 201