PharmingA method of capturing sensitive information (such as Social Security numbers and passwords) by fooling a user into entering such information on a fake Web…
PhishingWhen internet fraudsters impersonate a business in an attempt to trick you into giving out your personal information, such as usernames, passwords, and…
Physically Isolated NetworkA network that is not connected to entities or systems outside a physically controlled space.
PIN (Personal Identification Number)A security method used to show "what you know." Depending on the system, a PIN could be used to either claim or verify a claimed identity.
Pixels Per Inch (PPI)A measure of the resolution of a digital image. The higher the PPI, the more information is included in the image, and the larger the file size.
PlaintextThe least formatted and therefore most portable form of text for computerized documents.
Plan of Action and Milestones (POA&M)A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in…
PolicyThe contract form issued by the company to explain the coverage provided. It is a legal document.
Policy Management Authority (PMA)Body established to oversee the creation and update of Certificate Policies, review Certification Practice Statements, review the results of CA audits for…
Policy MappingRecognizing that, when a CA in one domain certifies a CA in another domain, a particular certificate policy in the second domain may be considered by the…
Populationthe totality of items or units of material under consideration.
PortAn implanted device through which blood may be withdrawn and drugs may be infused without repeated needle sticks. Also called port-a-cath.
Port ScanningUsing a program to remotely determine which ports on a system are open (e.g., whether systems allow connections through those ports).
Potential ImpactThe loss of confidentiality, integrity, or availability could be expected to have: a limited adverse effect (FIPS 199 low); a serious adverse effect (FIPS…
Practice StatementA formal statement of the practices followed by an authentication entity (e.g., RA, CSP, or verifier); typically the specific steps taken to register and…
PrecursorA sign that an attacker may be preparing to cause an incident.
PrincipalFace value of an obligation, such as a bond or a loan, that must be repaid at maturity.
PrivacyIn genetics, the right of people to restrict access to their genetic information.
Privacy Impact AssessmentAn analysis of how information is handled: 1) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; 2)…
private keyIn secure communication, an algorithmic pattern used to encrypt messages that only the corresponding public key can decrypt.
Privileged AccountsIndividuals who have access to set access rights for users on a given system. Sometimes referred to as system or network administrative accounts.
ProbeA sequence of DNA or RNA, labeled or marked with a radioactive isotope, used to detect the presence of complementary nucleotide sequences. See Nucleotide.
ProfilingMeasuring the characteristics of expected activity so that changes to it can be more easily identified.
Protective Distribution SystemWire line or fiber optic system that includes adequate safeguards and/or countermeasures (e.g.
Protocol Data UnitA unit of data specified in a protocol and consisting of protocol information and, possibly, user data.
Protocol EntityEntity that follows a set of rules and formats (semantic and syntactic) that determines the communication behavior of other entities.
Protocol RunAn instance of the exchange of messages between a claimant and a verifier in a defined authentication protocol that results in the authentication (or…
ProxyIf you own common stock in a US corporation, you have the right to vote on certain company policies and elect the board of directors by casting a proxy…
Proxy AgentA proxy agent is a software application running on a firewall or on a dedicated proxy server that is capable of filtering a protocol and routing it to…
proxy serverA server that receives requests intended for another server and that acts on the client's behalf (as the client's proxy) to obtain the requested service.
PseudonymA subscriber name that has been chosen by the subscriber that is not verified as meaningful by identity proofing.
Pseudorandom number generator (PRNG)An algorithm that produces a sequence of bits that are uniquely determined from an initial value called a seed.
public keyAn encryption key associated with a Notes ID that is used to verify an electronic signature, encrypt a message, or identify an authenticating user.
public key certificateA unique electronic stamp stored in a Notes or Domino ID file that associates a name with a public key.
Public Key InfrastructureAn architecture which is used to bind public keys to entities, enable other entities to verify public key bindings, revoke such bindings, and provide…
Public Key Infrastructure (PKI)A set of policies, processes, server platforms, software and workstations used for the purpose of administering certificates and public-private key pairs…
Public SeedA starting value for a pseudorandom number generator. The value produced by the random number generator may be made public.
PurgeTo remove information that has no further value from a file, usually according to a records retention schedule
Random Number Generator (RNG)A process used to generate an unpredictable series of numbers. Each individual value is called random if each of the values in the total population of…
Re-key (a certificate)To change the value of a cryptographic key that is being used in a cryptographic system application; this normally entails issuing a new certificate on…
Receiver Operating Characteristics (ROC)A method of showing measured accuracy performance of a biometric system. A verification ROC compares false accept rate vs. verification rate.
Recipient Usage PeriodThe period of time during the cryptoperiod of a symmetric key when protected information is processed.
RecognitionA generic term used in the description of biometric systems (e.g. face recognition or iris recognition) relating to their fundamental function.
recordAll the documents and evidence plus transcripts of oral proceedings in a case.
recordsAll recorded information, regardless of media or physical characteristics, made or received and maintained by an organization or institution in pursuance…
referenceA document that discloses subject matter that is material to a determination of the patentability of a claimed invention. MPEP 2126, MPEP 2126.
Reference MonitorThe security engineering term for IT functionality that 1) controls all access, 2) cannot be by-passed, 3) is tamper-resistant, and 4) provides confidence…
RegistrationLining up a forms image to determine which fields are where. Also, entering pages into a scanner such that they are correctly read.
Registration Authority (RA)A trusted entity that establishes and vouches for the identity of a subscriber to a CSP.
Relying PartyAn entity that relies upon the subscribers credentials, typically to process a transaction or grant access to information or a system.
RemediationThe cleanup or containment of a hazardous waste disposal site to the satisfaction of the applicable regulatory agency.
Remediation PlanA plan to perform the remediation of one or more threats or vulnerabilities facing an organizations systems.
Remote AccessThe ability to access and use digital information from a location off-site from where the information is physically located.
Remote MaintenanceMaintenance activities conducted by individuals communicating external to an information system security perimeter.
Renew (a certificate)The act or process of extending the validity of the data binding asserted by a public key certificate by issuing a new certificate.
RepositoryA centralized database stored on a computer that houses specific information.
Residual RiskThe remaining, potential risk after all IT security measures are applied. There is a residual risk associated with each threat.
ResponderThe entity that responds to the initiator of the authentication exchange.
Responsible IndividualA trustworthy person designated by a sponsoring organization to authenticate individual applicants seeking certificates on the basis of their affiliation…
Revoke a CertificateTo prematurely end the operational period of a certificate effective at a specific date and time.
Ridge EndingA minutiae point at the ending of a friction ridge, as illustrated below. See also bifurcation, friction ridge.
RijndaelCryptographic algorithm specified in the Advanced Encryption Standard (AES).
RiskThe possibility of loss; the uncertainty of future returns.
risk analysisA process consisting of three components: risk assessment, risk management and risk communication performed to understand the nature of unwanted, negative…
risk assessmenta scientifically based process consisting of the following steps: i) hazard identification; ii) hazard characterization; iii) exposure assessment; and iv)…
risk managementThe process, distinct from risk assessment, of weighing policy alternatives, in consultation with all interested parties, considering risk assessment and…
Risk MitigationRisk mitigation involves prioritizing, evaluating, and implementing the appropriate risk-reducing controls recommended from the risk assessment process.
Risk ToleranceThe degree to which you are willing to risk losing some (or all) of your original investment in exchange for a chance to earn a higher rate of return.
Rolled FingerprintsAn image that includes fingerprint data from nail to nail, obtained by �rolling� the finger across a sensor, as illustrated below.
Root Certification AuthorityIn a hierarchical Public Key Infrastructure, the Certification Authority whose public key serves as the most trusted datum (i.e.
RootkitA set of tools used by an attacker after gaining root-level access to a host to conceal the attackers activities on the host and permit the attacker to…
Round KeyRound keys are values derived from the Cipher Key using the Key Expansion routine; they are applied to the State in the Cipher and Inverse Cipher.
Rule-Based Security PolicyA security policy based on global rules imposed for all subjects. These rules usually rely on a comparison of the sensitivity of the objects being…
S-boxNon-linear substitution table used in several byte substitution transformations and in the Key Expansion routine to perform a one for one substitution of…
S/MIMEA set of specifications for securing electronic mail. Secure/ Multipurpose Internet Mail Extensions (S/MIME) is based upon the widely used MIME standard…
SafeguardsProtective measures prescribed to meet the security requirements (i.e., confidentiality, integrity, and availability) specified for an information system.
SandboxingA method of isolating application modules into distinct fault domains enforced by software.
SanitizationProcess to remove information from media such that information recovery is not possible. It includes removing all labels, markings, and activity logs.
ScanningScanning is the process of converting a hard copy paper document into a digital image for use in a computer system.
Scenario EvaluationOne of the three types of performance evaluations. The primary goal of a scenario evaluation is to measure performance of a biometric system operating in…
Scoping GuidanceProvides organizations with specific technology-related, infrastructure-related, public access-related, scalability-related, common security…
Script kiddieA "cracker" who is not a "hacker", but knows just enough to run canned scripts. A cargo-cult programmer.
Secret (Symmetric) Key EncryptionThis is the traditional method used for encryption. The same key is used for both encryption and decryption.
Secret KeyA cryptographic key that is used with a secret key (symmetric) cryptographic algorithm, that is uniquely associated with one or more entities and is not…
Secret SeedA secret value that used to initialize a pseudorandom number generator. The resulting value from the random number generator remains secret or private.
Secure Communication ProtocolA communication protocol that provides the appropriate confidentiality, authentication and content integrity protection.