CISSP - Certified Information Systems Security Professional Study Guide, 2nd Edition (2004)

Glossary 631

quantitative decision making The use of numbers and formulas to reach a decision. Options are often expressed in terms of the dollar value to the business.

quantitative risk analysis A method that assigns real dollar figures to the loss of an asset.

R

radiation monitoring A specific form of sniffing or eavesdropping that involves the detection, capture, and recording of radio frequency signals and other radiated communication methods, including sound and light.

radio frequency interference (RFI) A type of noise that is generated by a wide number of common electrical appliances, including florescent lights, electrical cables, electric space heaters, computers, elevators, motors, electric magnets, and so on. RFI can affect many of the same systems EMI affects.

RADIUS See Remote Authentication Dial-In User Service (RADIUS).

random access memory (RAM) Readable and writeable memory that contains information the computer uses during processing. RAM retains its contents only when power is continuously supplied to it.

random access storage Devices, such as RAM and hard drives, that allow the operating system to request contents from any point within the media.

read-only memory (ROM) Memory that can be read but cannot be written to.

ready state The state in which a process is ready to execute but is waiting for its turn on the CPU.

real evidence Items that can actually be brought into a court of law; also known as object evidence.

real memory Typically the largest RAM storage resource available to a computer. It is normally composed of a number of dynamic RAM chips and therefore must be refreshed by the CPU on a periodic basis; also known as main memory or primary memory.

realized risk The incident, occurrence, or event when a risk becomes a reality and a breach, attack, penetration, or intrusion has occurred that may or may not result in loss, damage, or disclosure of assets.

record Contents of a table in a relational database.

record retention The organizational policy that defines what information is maintained and for how long. In most cases, the records in question are audit trails of user activity. This may include file and resource access, logon patterns, e-mail, and the use of privileges.

record sequence checking Similar to hash total checking, but instead of verifying content integrity, it involves verifying packet or message sequence integrity.

632 Glossary

recovery access control A type of access control that is used to repair or restore resources, functions, and capabilities after a security policy violation.

reducing risk The implementation of safeguards and countermeasures. Also referred to as mitigating risk.

reference monitor A portion of the security kernel that validates user requests against the system’s access control mechanisms.

referential integrity Used to enforce relationships between two tables. One table in the relationship contains a foreign key that corresponds to the primary key of the other table in the relationship.

register A limited amount of onboard memory in a CPU.

register address The address of a register, which is a small memory locations directly on the CPU. When the CPU needs information from one of those registers to complete an operation, it can simply use the register address (e.g., “register one”) to access the information.

registration authority (RA) A read-only version of a certificate authority that is able to distribute the CRL and perform certificate verification processes but is not able to create new certificates. An RA is used to share the workload of a CA.

regulatory policy A policy that is required whenever industry or legal standards are applicable to your organization. This policy discusses the regulations that must be followed and outlines the procedures that should be used to elicit compliance.

reject risk To deny that a risk exists or hope that by ignoring a risk, it will never be realized. It is an unacceptable response to risk. Also referred to as deny risk.

relational database A database that consists of tables that contain a set of related records.

relationship The association of information in tables of a relational database.

relevant Characteristic of evidence that is applicable in determining a fact in a court of law.

Remote Authentication Dial-In User Service (RADIUS) A service used to centralize the authentication of remote dial-up connections.

remote journaling Transferring copies of the database transaction logs containing the transactions that occurred since the previous bulk transfer.

remote mirroring Maintaining a live database server at the backup site. It is the most advanced database backup solution.

repeater A network device used to amplify signals on network cabling to allow for longer distances between nodes.

replay attack An attack in which a malicious user records the traffic between a client and server. The packets sent from the client to the server are then played back or retransmitted to the server with slight variations of the time stamp and source IP address (i.e., spoofing). In some cases, this allows the malicious user to restart an old communication link with a server. Also referred to as a playback attack.

Glossary 633

residual risk Risk that comprises specific threats to specific assets against which upper management chooses not to implement a safeguard. In other words, residual risk is the risk that management has chosen to accept rather than mitigate.

restricted interface model A model that uses classification-based restrictions to offer only subjectspecific authorized information and functions. One subject at one classification level will see one set of data and have access to one set of functions while another subject at a different classification level will see a different set of data and have access to a different set of functions.

retina scan An example of a biometric factor, which is a behavioral or physiological characteristic that is unique to a subject. The blood vessel pattern at the back of the eyeball is used to establish identity or provide authentication.

revocation A mechanism that allows a PKI certificate to be canceled, effectively removing a user from the system.

RFC 1918 The public standard that defines public and private IP addresses.

Rijndael block cipher A block cipher that was selected to replace DES. The Rijndael cipher allows the use of three key strengths: 128 bits, 192 bits, and 256 bits.

risk The likelihood that any specific threat will exploit a specific vulnerability to cause harm to an asset. Risk is an assessment of probability, possibility, or chance. Risk = threat + vulnerability.

risk analysis An element of risk management that includes analyzing an environment for risks, evaluating each risk as to its likelihood of occurring and cost of damage, assessing the cost of various countermeasures for each risk, and creating a cost/benefit report for safeguards to present to upper management.

risk management A detailed process of identifying factors that could damage or disclose data, evaluating those factors in light of data value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk.

risk tolerance The ability of an organization to absorb the losses associated with realized risks.

Rivest, Shamir, and Adleman (RSA) A public key encryption algorithm named after Rivest, Shamir, and Adleman, its inventors.

role-based access control A form of nondiscretionary access controls that employs job function roles to regulate subject access to objects.

root The administrator level of a system.

rootkit A specialized software package that allows hackers to gain expanded access to a system.

router A network device used to control traffic flow on networks. Routers are often used to connect similar networks together and control traffic flow between them. They can function using statically defined routing tables or employ a dynamic routing system.

RSA See Rivest, Shamir, and Adleman (RSA).

634 Glossary

rule-based access control A variation of mandatory access controls. A rule-based system uses a set of rules, restrictions, or filters to determine what can and cannot occur on the system, such as granting subject access, performing an action on an object, or accessing a resource. Firewalls, proxies, and routers are common examples of rule-based access control systems.

running key cipher A form of cryptography in which the key is a designation of a changing source, such as the third page of the New York Times.

running state The state in which a process is actively executing. This is another name for problem state.

S

S/MIME See Secure Multipurpose Internet Mail Extensions (S/MIME).

safeguard Anything that removes a vulnerability or protects against one or more specific threats. Also referred to as a countermeasure.

sag Momentary low voltage.

salami attack An attack performed by gathering small amounts of data to construct something of greater value or higher sensitivity.

sampling A form of data reduction that allows an auditor to quickly determine the important issues or events from an audit trail.

sandbox A security boundary within which a Java applet executes.

sanitization Any number of processes that prepares media for destruction. Sanitization is the process that ensures that data cannot be recovered by any means from destroyed or discarded media. Sanitization can also be the actual means by which media is destroyed. Media can be sanitized by purging or degaussing without physically destroying the media.

scanning Similar to “casing” a neighborhood prior to a burglary, the process by which a potential intruder looks for possible entryways into a system. Scanning can indicate that illegal activity will follow, so it is a good idea to treat scans as incidents and to collect evidence of scanning activity.

scavenging A form of dumpster diving performed electronically. Online scavenging searches for useful information in the remnants of data left over after processes or tasks are completed. This could include audit trails, log files, memory dumps, variable settings, port mappings, cached data, and so on.

schema The structure that holds the data that defines or describes a database. The schema is written using a Data Definition Language (DDL).

scripted access A method to automate the logon process with a script that provides the logon credentials to a system. It is considered a form of single sign-on.

Glossary 635

search warrant A document obtained through the judicial system that allows law enforcement personnel to acquire evidence from a location without first alerting the individual believed to have perpetrated a crime.

secondary evidence A copy of evidence or an oral description of the contents of best evidence.

secondary memory Magnetic/optical media and other storage devices that contain data not immediately available to the CPU.

secondary storage Data repositories that include magnetic and optical media, such as tapes, disks, hard drives, and CD/DVD storage.

second-tier attack An assault that relies upon information or data gained from eavesdropping or other similar data-gathering techniques. In other words, it is an attack that is launched only after some other attack is completed.

secret A government/military classification, used for data of a secret nature. Unauthorized disclosure of secret data could cause serious damage to national security.

secure communication protocol A protocol that uses encryption to provide security for the data transmitted by it.

Secure Electronic Transaction (SET) A security protocol for the transmission of transactions over the Internet. SET is based on RSA encryption and DES. SET has the support of major credit card companies, such as Visa and MasterCard.

Secure Hash Algorithm (SHA) A government standard hash function developed by the National Institute of Standards and Technology (NIST) and specified in an official government publication.

Secure HTTP (S-HTTP) The second major protocol used to provide security on the World Wide Web.

Secure Multipurpose Internet Mail Extensions (S/MIME) A protocol used to secure the transmission of e-mail and attachments.

Secure Remote Procedure Call (S-RPC) An authentication service. S-RPC is simply a means to prevent unauthorized execution of code on remote systems.

Secure Shell (SSH) An end-to-end encryption technique. This suite of programs provide encrypted alternatives to common Internet applications like FTP, Telnet, and rlogin. There are actually two versions of SSH. SSH1 supports the DES, 3DES, IDEA, and Blowfish algorithms. SSH2 drops support for DES and IDEA but adds support for several other algorithms.

Secure Sockets Layer (SSL) An encryption protocol developed by Netscape to protect the communications between a web server and a web browser.

security association (SA) In an IPSec session, the representation of the communication session and process of recording any configuration and status information about the connection.

636 Glossary

security ID A form of physical identification, generally contains a picture of the subject and/ or a magnetic strip that contains additional information about a subject.

security kernel The core set of operating system services that handles all user/application requests for access to system resources.

security label An assigned classification or sensitivity level used in security models to determine the level of security required to protect an object and prevent unauthorized access.

security perimeter The imaginary boundary that separates the trusted computing base from the rest of the system.

security policy A document that defines the scope of security needs of an organization, prescribes solutions to manage security issues, and discusses the assets that need protection, and the extent to which security solutions should go to provide the necessary protection.

security professional Trained and experienced network, systems, and security engineer who is responsible for following the directives mandated by senior management.

security role The part an individual plays in the overall scheme of security implementation and administration within an organization.

senior management A person or group who is ultimately responsible for the security maintained by an organization and who should be most concerned about the protection of its assets. They must sign off on all policy issues, and they will be held liable for overall success or failure of a security solution. It is the responsibility of senior management to show prudent due care. Also referred to as organizational owner and upper management.

sensitive A commercial business/private sector classification used for data that is more sensitive than public data. A negative impact could occur for the company if sensitive data is disclosed.

sensitive but unclassified A government/military classification used for data of a sensitive or private nature but significant damage would not occur if disclosed.

sensitivity In regard to biometric devices, the level at which the device is configured for scanning.

separation of duties and responsibilities A common practice to prevent any single subject from being able to circumvent or disable security mechanisms. By dividing core administration or high-authority responsibilities among several subjects, no one subject has sufficient access to perform significant malicious activities or bypass imposed security controls.

separation of privilege The principle that builds upon the principle of least privilege. It requires the use of granular access permissions; that is, different permissions for each type of privileged operation. This allows designers to assign some processes rights to perform certain supervisory functions without granting them unrestricted access to the system.

Sequenced Packet Exchange (SPX) The Transport layer protocol of the IPX/SPX protocol suite from Novell.

Glossary 637

sequential storage Devices that require that you read (or speed past) all of the data physically stored prior to the desired location. A common example of a sequential storage device is a magnetic tape drive.

Serial Line Internet Protocol (SLIP) An older technology developed to support TCP/IP communications over asynchronous serial connections, such as serial cables or modem dial-up.

Service Level Agreement (SLA) A contractual obligation to your clients that requires you to implement sound BCP practices. Also used to assure acceptable levels of service from suppliers for sound BCP practices.

SESAME A ticket-based authentication mechanism similar to Kerberos.

session hijacking An attack that occurs when a malicious individual intercepts part of a communication between an authorized user and a resource and then uses a hijacking technique to take over the session and assume the identity of the authorized user.

Session layer Layer 5 of the OSI model.

shielded twisted-pair (STP) A twisted-pair wire that includes a metal foil wrapper inside of the outer sheath to provide additional protection from EMI.

shoulder surfing The act of gathering information from a system by observing the monitor or the use of the keyboard by the operator.

shrink-wrap license agreement A license written on the outside of software packaging. Such licenses get their name because they commonly include a clause stating that you acknowledge agreement to the terms of the contract simply by breaking the shrink-wrap seal on the package.

signature-based detection The process used by antivirus software to identify potential virus infections on a system.

signature dynamics When used as a biometric, the use of the pattern and speed of a person writing their signature to establish identity or provide authentication.

Simple Integrity Axiom (SI Axiom) An axiom of the Biba model that states that a subject at a specific classification level cannot read data with a lower classification level. This is often shortened to “no read down.”

Simple Key Management for IP (SKIP) An encryption tool used to protect sessionless datagram protocols.

Simple Mail Transfer Protocol (SMTP) The primary protocol used to move e-mail messages from clients to servers and from server to server.

Simple Security Property (SS property) A property of the Bell-LaPadula model that states that a subject at a specific classification level cannot read data with a higher classification level. This is often shortened to “no read up.”

638 Glossary

simulation tests A test in which disaster recovery team members are presented with a scenario and asked to develop an appropriate response. Some of these response measures are then tested. This may involve the interruption of noncritical business activities and the use of some operational personnel.

single loss expectancy (SLE) The cost associated with a single realized risk against a specific asset. The SLE indicates the exact amount of loss an organization would experience if an asset were harmed by a specific threat. SLE = asset value ($) * exposure factor (EF).

Single Sign On (SSO) A mechanism that allows subjects to authenticate themselves only once to a system. With SSO, once subjects are authenticated, they can freely roam the network and access resources and service without being rechallenged for authentication.

single state Systems that require the use of policy mechanisms to manage information at different levels. In this type of arrangement, security administrators approve a processor and system to handle only one security level at a time.

single-use passwords A variant of dynamic passwords that are changed every time they are used.

Skipjack Associated with the Escrowed Encryption Standard, an algorithm that operates on 64-bit blocks of text. It uses an 80-bit key and supports the same four modes of operation supported by DES. Skipjack was proposed but never implemented by the U.S. government. It provides the cryptographic routines supporting the Clipper and Capstone high-speed encryption chips designed for mainstream commercial use.

smart card Credit-card-sized ID, badge, or security pass that has a magnetic strip, bar code, or integrated circuit chip embedded in it. Smart cards can contain information about the authorized bearer that can be used for identification and/or authentication purposes.

Smurf attack A type of DoS. A Smurf attack occurs when an amplifying server or network is used to flood a victim with useless data.

sniffer attack Any activity that results in a malicious user obtaining information about a network or the traffic over that network. A sniffer is often a packet-capturing program that duplicates the contents of packets traveling over the network medium into a file. Also referred to as a snooping attack.

sniffing A form of network traffic monitoring. Sniffing often involves the capture or duplication of network traffic for examination, re-creation, and extraction.

snooping attack See sniffer attack.

social engineering A skill by which an unknown person gains the trust of someone inside of your organization and encourages them to make a change to IT system in order to grant them access.

socket Another name for a port.

software IP encryption (SWIPE) A layer 3 security protocol for IP. It provides authentication, integrity, and confidentiality using an encapsulation protocol.

Glossary 639

spam The term describing unwanted e-mail, newsgroup, or discussion forum messages. Spam can be as innocuous as an advertisement from a well-meaning vendor or as malignant as floods of unrequested messages with viruses or Trojan horses attached.

spamming attacks Sending significant amounts of spam to a system in order to cause a DoS or general irritation, consume storage space, or consume bandwidth and processing capabilities.

spike Momentary high voltage.

spoofing The act of replacing the valid source and/or destination IP address and node numbers with false ones.

spoofing attack Any attack that involves spoofed or modified packets.

standards Documents that define compulsory requirements for the homogenous use of hardware, software, technology, and security controls. They provide a course of action by which technology and procedures are uniformly implemented throughout an organization. Standards are tactical documents that define steps or methods to accomplish the goals and overall direction defined by security policies.

state A snapshot of a system at a specific instance in time.

state machine model A system that is designed so that no matter what function is performed, it is always a secure system.

stateful inspection firewall A firewall that evaluates the state or the context of network traffic. By examining source and destination address, application usage, source of origin, and the relationship between current packets with the previous packets of the same session, stateful inspection firewalls are able to grant a broader range of access for authorized users and activities and actively watch for and block unauthorized users and activities. Stateful inspection firewalls are known as third-generation firewalls.

static packet-filtering firewall A firewall that filters traffic by examining data from a message header. Usually the rules are concerned with source, destination, and port addresses. Static packet-filtering firewalls as known as first-generation firewalls.

static password Password that does not change over time or that remains the same for a significant period of time.

static token A physical means to provide identity, usually not employed as an authentication factor. Examples include a swipe card, a smart card, a floppy disk, a USB RAM dongle, or even something as simple as a key to operate a physical lock.

statistical intrusion detection See behavior-based detection.

stealth virus A virus that hides itself by actually tampering with the operating system to fool antivirus packages into thinking that everything is functioning normally.

steganography The act of embedding messages within another message, commonly used within an image or a WAV file.

640 Glossary

stopped state The state in which a process is finished or must be terminated. At this point, the operating system can recover all memory and other resources allocated to the process and reuse them for other processes as needed.

strategic plan A long-term plan that is fairly stable. It defines the organization’s goals, mission, and objectives. A strategic plan is useful for about five years if it is maintained and updated annually. The strategic plan also serves as the planning horizon.

stream attack A type of DoS. A stream attack occurs when a large number of packets are sent to numerous ports on the victim system using random source and sequence numbers. The processing performed by the victim system attempting to make sense of the data will result in a DoS. Also referred to as flooding.

stream ciphers Ciphers that operate on each character or bit of a message (or data stream) one character/bit at a time.

strong password Password that is resistant to dictionary and brute force attacks.

Structured Query Language (SQL) The standard language used by relational databases to enter and extract the information stored in them.

structured walk-through A type of disaster recovery test, often referred to as a “table-top exercise,” in which members of the disaster recovery team gather in a large conference room and role-play a disaster scenario.

subject An active entity that seeks information about or data from passive objects through the exercise of access. A subject can be a user, a program, a process, a file, a computer, a database, and so on.

subpoena A court order that compels an individual or organization to surrender evidence or to appear in court.

substitution cipher Cipher that uses an encryption algorithm to replace each character or bit of the plaintext message with a different character, such as a Caesar cipher.

supervisor state The state in which a process is operating in a privileged, all-access mode.

supervisory mode Mode in which processes at layer 0 run, which is the ring where the operating system itself resides.

surge Prolonged high voltage.

SWIPE See software IP encryption (SWIPE).

switch A network device that is an intelligent hub because it knows the addresses of the systems connected on each outbound port. Instead of repeating traffic on every outbound port, a switch repeats only traffic out of the port on which the destination is known to exist. Switches offer greater efficiency for traffic delivery, create separate broadcast and collision domains, and improve the overall throughput of data.