Glossary 2.0

Below are frequently used terms. Included are definitions and examples for these terms.




acceptable use policies

Agreed-upon principles set forth by a company to govern how the employees of that company may use resources such as computers and Internet access.

access control

The means of giving or restricting user access to network resources. Access control can be accomplished through the use of an access control list (ACL).

access control list (ACL)

A table or data file that specifies whether a user or group has access to a specific resource on a computer or network.

access point (AP)

The point at which access to a network is accomplished. This term is often used in relation to a wireless access point (WAP).

accountability statement

A policy that provides information to the reader about who to contact if a problem is discovered.

active response

A response generated in real time.


Any action a user undertakes.

Address Resolution Protocol (ARP)

Protocol used to map known IP addresses to unknown physical addresses.

Address Resolution Protocol (ARP) poisoning

An attack that convinces the network that the attacker’s MAC address is the one associated with an allowed address so that traffic is wrongly sent to attacker’s machine.

administrative control

A control implemented through administrative policies or procedures.


The user who is accountable and responsible for the network.

Advanced Encryption Standard (AES)

A Federal Information Processing Standards (FIPS) publication that specifies a cryptographic algorithm for use by the U.S. government.


Software that gathers information to pass on to marketers or that intercepts personal data such as credit card numbers and makes them available to third parties.


An implementation of Advanced Encryption Standard (AES) that uses 256-bit encryption.


A notification that an unusual condition exists and should be investigated.


A notification that an unusual condition exists and should be investigated.

all-in-one appliance

An appliance that performs multiple functions.


The component or process that analyzes the data collected by the sensor.

annual loss expectancy (ALE)

A calculation used to identify risks and calculate the expected loss each year.

annualized rate of occurrence (ARO)

A calculation of how often a threat will occur. For example, a threat that occurs once every five years has an annualized rate of occurrence of 1/5, or 0.2.


Variations from normal operations.

anomaly-detection IDS (AD-IDS)

An anomaly-detection intrusion detection system works by looking for deviations from a pattern of normal network traffic.

antivirus software

Software that identifies the presence of a virus and is capable of removing or quarantining the virus.

Anything as a Service (XaaS)

A cloud computing model that can work with a combination of other models: SaaS, IaaS, or PaaS.


A freestanding device that operates in a largely self-contained manner.


An application has both a user interactive front-end and a back-end where the data resides.  Front-ends can be a web page, a mobile app, or a desktop fat client.  An application generally supports multiple users, requires a login, and goes through a software development lifecycle (SDLC). 

Applications are the software elements that are directly touched and felt by end users.

Application Administrator

Individual or group responsible for the administration of the application. This role is similar to a System Administrator.

Application layer

The seventh layer of the Open Systems Interconnection (OSI) model. This layer deals with how applications access the network and describes application functionality, such as file transfer and messaging.

Application Manager

UCSF employee responsible for routine management of application, may also perform application administrator functions, such as adding/deleting users.

application programming interfaces (APIs)

An abstract interface to the services and protocols provided by an operating system.

application-level proxy

A device or software that recognizes application-specific commands and offers granular control over them.

arbitrary code execution

Accepting commands unrelated to a program and running them on the host machine within a shell, or command interpreter.

architectural approach

An approach to security that involves using a control framework to focus on the foundational infrastructure.

armored virus

A virus that is protected in a way that makes disassembling it difficult. The difficulty makes it “armored” against antivirus programs that have trouble getting to, and understanding, its code.

ARP spoofing

More commonly known as ARP poisoning, this involves the MAC (Media Access Control) address of the data being faked.

asymmetric algorithm

An algorithm that uses two keys.

asymmetric encryption

Encryption in which two keys must be used. One key is used to encrypt data, and the other is needed to decrypt the data. Asymmetric encryption is the opposite of symmetric encryption, where a single key serves both purposes.


Any unauthorized intrusion into the normal operations of a computer or computer network. The attack can be carried out to gain access to the system or any of its resources.

attack surface

The area of an application that is available to users—those who are authenticated and, more importantly, those who are not.

attack surface reduction (ASR)

Minimizing the possibility of exploitation by reducing the amount of code and limiting potential damage.


The act of tracking resource usage by users.


The means of verifying that someone is who they say they are.

Authentication Header (AH)

A header used to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays.


A type of certificate technology that allows ActiveX components to be validated by a server.

Automated System Recovery (ASR) disk

A utility used with Windows 7 and 8 for creating a copy of the configuration settings necessary to reach the present state after a disaster.




An opening left in a program application (usually by the developer) that allows additional access to data. Typically, a backdoor is created for debugging purposes and is not documented. Before the product ships, the backdoors are closed; when they aren’t closed, security loopholes exist.


A reversion, or roll back to a previous state, from a change that had negative consequences.


A usable copy of data made to media. Ideally, the backup is made to removable media and stored for recovery should anything happen to the original data.

backup generator

A generator that can supply power in the event the primary provider is unable to deliver it.

backup plan

A documented plan governing backup situations. It can include alternate or secondary plans as well.

backup policy

A written policy detailing the frequency of backups and the location of storage media.

banner grabbing

Looking at the banner, or the header information messages sent with data, to find out about a system(s).


Comparing performance to a historic metric.

bastion host

A host with multiple network interface cards so that it can reside on multiple networks.

best practices

A set of rules governing basic operations.

Big Data analysis

Data that is too large to be dealt with by traditional database management means.


birthday attack

A probability method of finding collision in hash functions.


A Microsoft utility used to encrypt a drive.

block cipher

A method of encryption that processes blocks of data rather than streams.


A type of symmetric block cipher created by Bruce Schneier.


The sending of unsolicited messages over a Bluetooth connection.


The gaining of unauthorized access through a Bluetooth connection.

border router

A router used to translate from LAN framing to WAN framing.


An automated software program (network robot) that collects information on the Web. In the malicious form, a bot is a compromised computer being controlled remotely.

bridge trust model

A trust model in which a peer-to-peer relationship exists among the root certificate authorities.

brute-force attack

A type of attack that relies purely on trial and error and tries all possible combinations.

buffer overflow

A type of denial-of-service (DoS) attack that occurs when more data is put into a buffer than it can hold, thereby overflowing it (as the name implies).

business continuity planning (BCP)

the creation and validation of a practiced plan for how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption.

business impact analysis (BIA)

A study of the possible impact if a disruption to a business’s vital resources were to occur.

Business Owner

UCSF employee responsible for business purpose of application, typically a senior manager or faculty member.



cable lock

A physical security deterrent used to protect a computer.

captive portal

An access point that requires users to agree to some condition before they use the network or Internet.


A type of symmetric block cipher defined by RFC 2144.


A digital entity that establishes who you are and is often used with e-commerce. It contains your name and other identifying data and usually includes the public key in PKI.

certificate authority (CA)

An issuer of digital certificates (which are then used for digital signatures or key pairs). A certificate authority is occasionally referred to as a certification authority.

Certificate Management Protocol (CMP)

A messaging protocol used between PKI entities. This protocol is used in some PKI environments.

Certificate Practice Statement (CPS)

The principles and procedures employed in the issuing and managing of certificates.

certificate revocation

The act of making a certificate invalid.

certificate revocation list (CRL)

A list of digital certificate revocations that must be regularly downloaded to stay current.

Challenge Handshake Authentication Protocol (CHAP)

A protocol that challenges a system to verify identity. CHAP is an improvement over Password Authentication Protocol (PAP), in which one-way hashing is incorporated into a three-way handshake.

change management

Management included in the making of a change in the scope of any particular item.


An algorithm, also known as a cryptographic algorithm, used to encrypt and decrypt data.


A role responsible for security functions throughout a Location, including assisting in the interpretation and application of UCOP IS-3.


The part of a client-server network where the computing is usually done. In a typical setting, a client uses the server for remote storage, backups, or security (such as a firewall).

closed-circuit television (CCTV)

A surveillance camera used for physical-access monitoring.

cloud bursting

Moving the execution of an application to the cloud on an as-needed basis.

cloud computing

A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources.


A method of balancing loads and providing fault tolerance.

code escrow

The storage and conditions for release of source code provided by a vendor, partner, or other party.

code review

Looking at all custom written code for holes that may exist.

cold aisles

Server room aisles that blow cold air from the floor.

cold site

A physical site that can be used if the main site is inaccessible (destroyed) but that lacks all the resources necessary to enable an organization to use it immediately. Commonly, plans call for turning to a cold site within a certain number of hours after the loss of the main site.


An agreement between individuals to commit fraud or deceit.

Common Access Card (CAC)

A standard identification card used by the Department of Defense (DoD) and other employers. It is used for authentication as well as identification.

Common Criteria (CC)

A document of specifications detailing security evaluation methods for IT products and systems.

community cloud

Cloud delivery model in which the infrastructure is shared by organizations with something in common.

companion virus

A virus that creates a new program that runs in place of an expected program of the same name.

compensating controls

Gap controls that fill in the coverage between other types of vulnerability mitigation techniques (where there are holes in coverage, we compensate for them).

compliance risk

If audited or investigated, gaps in compliance could expose UCSF to regulatory fines and administrative action from the Office for Civil Rights(OCR). These can include areas such as undocumented policies and procedures, lack of recurring training programs, or lack of encryption for systems hosting ePHI. To be fully compliant to HIPAA, FERPA, & SB1386, all controls must be implemented.

Computer Security Incident Response Team (CSIRT)

A formalized or an ad hoc team you can call upon to respond to an incident after it arises.

connection-oriented protocol

Type of communications between two hosts that have a previous session established for synchronizing sent data. The receiving PC acknowledges the data. This method allows for guaranteed delivery of data between PCs. Within the TCP/IP suite, TCP is used for connection-oriented communications.

contingency plan

A plan that allows a business to keep running in the event of a disruption to vital resources.


Processes or actions used to respond to situations or events.

control types

Technical or administrative measures in place to assist with resource management.


A plain-text file stored on your machine that contains information about you (and your preferences) and is used by a server.

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)

A wrapper that uses 128-bit AES encryption with a 48-bit initialization vector.

critical business functions (CBF)

Functions on which the livelihood of the company depends.

Cross-Site Request Forgery (XSRF)

A form of web-based attack in which unauthorized commands are sent from a user that a website trusts.

cross-site scripting (XSS)

Running a script routine on a user’s machine from a website without their permission.


The study and practice of finding weaknesses in ciphers.


A person who does cryptanalysis.


A person who participates in the study of cryptographic algorithms.

cryptographic algorithm

An algorithm, also known as a cipher, used to encrypt and decrypt data.


The field of mathematics focused on encrypting and decrypting data.



data disposal

Getting rid of/destroying media no longer needed.

Data Encryption Standard (DES)

The primary standard used in government and industry until it was replaced by AES.

data loss prevention (DLP)

Any systems that identify, monitor, and protect data to prevent it from unauthorized use, modification, or destruction.

data policy

A policy dealing with some aspect of data (usage, destruction, retention, etc.).

data loss risk

while the gaps above may result in fines if identified, it is more critical to the organization to be aware that lack of security controls could result in loss of data and additional penalties or cost for notification and remediation. Typically from a HIPAA perspective, organizations are investigated by OCR only if they have reported a breach or have had a whistleblower inform OCR of possible non-compliant actions. Therefore, as a good steward of data and to present a proactive stance to prevent data loss, additional actions may be recommended.

deception active response

A response that fools the attacker into thinking that the attack is succeeding while the system monitors the activity and potentially redirects the attacker to a system that is designed to be broken.

demilitarized zone (DMZ)

An area for placing web and other servers outside the firewall. The purpose for so doing is not specifically to protect them but to protect the internal network.

denial-of-service (DoS)

A type of attack that prevents any users—even legitimate ones—from using a system.

design review

Reviewing the security design, including examining the ports and protocols used, the rules, segmentation, and access control.

detective control

Controls that are intended to identify and characterize an incident in progress (for example, sounding the alarm and altering the administrator).

dictionary attack

The act of attempting to crack passwords by testing them against a list of dictionary words. With today’s powerful computers, an attacker can combine one of many available automated password-cracking utilities with several large dictionaries or “wordlists” and crack huge numbers of passwords in a matter of minutes. Any password based on any dictionary word is vulnerable to such an attack.

differential backup

A type of backup that includes only new files or files that have changed since the last full backup. Differential backups differ from incremental backups in that they don’t clear the archive bit upon their completion.

Diffie-Hellman key exchange

An asymmetric standard for exchanging keys. This cryptographic algorithm is used primarily to send secret keys across public networks. The process isn’t used to encrypt or decrypt messages; it’s used merely for the transmission of keys in a secure manner.

digital signature

An asymmetrically encrypted signature whose sole purpose is to authenticate the sender.

directory traversal attack

An attack that involves navigating to other directories and gaining access to files/directories that would be otherwise restricted.

disaster recovery

The act of recovering data following a disaster that has destroyed it.

disaster-recovery plan

A plan outlining the procedure by which data is recovered after a disaster.

Discretionary Access Control (DAC)

A method of restricting access to objects based on the identity of the subjects or the groups to which they belong. The user can assign permissions to data and assets at their discretion.

disk duplexing

Technology that uses two controllers and two disks to keep identical copies of data to prevent the loss of data if one disk fails.

disk mirroring

Technology that keeps identical copies of data on two disks to prevent the loss of data if one disk fails.

disk striping

Technology that enables writing data to multiple disks simultaneously in small portions called stripes. These stripes maximize use by having all of the read/write heads working constantly. Different data is stored on each disk and isn’t automatically duplicated. (This means that disk striping in and of itself doesn’t provide fault tolerance.)

disk striping with parity

A fault-tolerance solution of writing data across a number of disks and recording the parity on another (also known as disk striping with a parity disk). In the event that any one disk fails, the data on it can be re-created by looking at the remaining data and computing parity to figure out the missing data.

distributed denial-of-service (DDoS)

A derivative of a DoS attack in which multiple hosts in multiple locations all focus on one target to reduce its availability to the public. This can be accomplished through the use of compromised systems, botnets, etc.

DNS poisoning

An attack method in which a daemon caches DNS reply packets, which sometimes contain other information (data used to fill the packets). The extra data can be scanned for information useful in a break-in or man-in-the-middle attack.

DNS spoofing

The DNS server is given information about a name server that it thinks is legitimate when it isn’t.

Domain Name System (DNS)

The network service used in TCP/IP networks that translates hostnames to IP addresses.

dual-homed firewall

A host that resides on more than one network and possesses more than one physical network card.

dumpster diving

Looking through trash for clues—often in the form of paper scraps—to find users’ passwords and other pertinent information.

Dynamic Host Configuration Protocol (DHCP)

A protocol used on a TCP/IP network to send client configuration data, including IP address, default gateway, subnet mask, and DNS configuration, to clients. DHCP uses a four-step process: Discover, Offer, Request, and Acknowledgment.




The IEEE standard that defines port-based security for wireless network access control. It offers a means of authentication and defines the Extensible Authentication Protocol (EAP) over IEEE 802, and it is often known as 802.1x.


Dynamic provisioning of resources as needed.

electromagnetic interference (EMI)

The interference that can occur during transmissions over copper cable because of electromagnetic energy outside the cable. The result is degradation of the signal.

electronic wallet

A device that identifies you electronically in the same way as the cards you carry in your wallet.

Elliptic Curve Cryptography (ECC)

A type of public key cryptosystem that requires a shorter key length than many other cryptography systems (including the de facto industry standard, RSA).

Encapsulating Security Payload (ESP)

A header used to provide a mix of security services in IPv4 and IPv6. ESP can be used alone or in combination with the IP Authentication Header (AH).


The process of enclosing data in a packet.


The process of converting data into a form that makes it less likely to be usable to anyone intercepting it if they can’t decrypt it.

encryption key

A string of alphanumeric characters used to decrypt encrypted data.


The process of luring someone.


The process of encouraging an attacker to perform an act, even if they don’t want to do it.

ephemeral key

A key that exists only for that session.


The act of moving something up in priority. Often, when an incident is escalated, it’s brought to the attention of the next-highest supervisor.

evaluation assurance levels (EALs)

A level of assurance, expressed as a numeric value, based on standards set by the Common Criteria Recognition Agreement (CCRA).


Any noticeable action or occurrence.

exception statement

A statement that differs from the norm.

Extensible Authentication Protocol (EAP)

An authentication protocol used in wireless networks and point-to-point connections.




The process of reconstructing a system or switching over to other systems when a failure is detected.

false negative

An event that should be flagged but isn’t.

false positive

A flagged event that isn’t really an event and has been falsely triggered.

Faraday cage

An electrically conductive wire mesh or other conductor woven into a “cage” that surrounds a room and prevents electromagnetic signals from entering or leaving the room through the walls.

fault tolerance

The ability to withstand a fault (failure) without losing data.

FCoE (Fibre Channel over Ethernet)

A networking protocol that is not routable at the IP layer and thus cannot work across large networks.

Federal Information Processing Standard (FIPS)

A set of guidelines for U.S. federal government information systems.

federated identity

A means of linking a user’s identity with their privileges in a manner that can be used across business boundaries.


A collection of computer networks that agree on standards of operation, such as security standards.

Fibre Channel

A high-speed networking technology.

File Allocation Table (FAT)

Microsoft’s earliest filesystem.

File Transfer Protocol (FTP)

TCP/IP and software that permit transferring files between computer systems and use cleartext passwords. Because FTP has been implemented on numerous types of computer systems, files can be transferred between disparate computer systems.

fire suppression

The act of stopping a fire and preventing it from spreading.


A combination of hardware and software that protects a network from attack by hackers who could gain access through public networks, including the Internet.

five nines availability

A system that is up and running at least 99.999 percent of the time.


The process of systematically identifying the network and its security posture. This is typically a passive process.


In terms of security, the act of looking at all the data at your disposal to try to figure out who gained unauthorized access and the extent of that access.

forward secrecy

A property of any key exchange system that ensures that if one key is compromised, subsequent keys will not also be compromised.


A secure form of FTP.

Full Archival method

A concept that works on the assumption that any information created on any system is stored forever.

full backup

A backup that copies all data to the archive medium.

full distribution

An information classification stating that the data so classified is available to anyone.


A technique of penetration testing. It can include providing unexpected values as input to an application in order to make it crash.



gap in the WAP

Vulnerability possible when the interconnection between the WAP server and the Internet isn’t encrypted and packets between the devices may be intercepted.

Grandfather, Father, Son method

One of the most popular methods of backup tape rotation. Three sets of tapes are rotated in this method. The most recent backup after the full backup is the Son. As newer backups are made, the Son becomes the Father, and the Father, in turn, becomes the Grandfather. At the end of each month, a full backup is performed on all systems. This backup is stored in an offsite facility for a period of one year. Each monthly backup replaces the monthly backup from the previous year. Weekly or daily incremental backups are performed and stored until the next full backup occurs. This full backup is then stored offsite, and the weekly or daily backup tapes are reused.


Virtual machines running on a physical machine.


Rules, policies, or procedures that are advisory or nonmandatory.




The process of making certain that an entity (such as an operating system or application) is as secure as it can be.

heuristic system

A system that bases actions on the heuristics it observes. It is used in intrusion detection and prevention systems and coupled with if-then analysis.

hierarchical storage management (HSM)

A newer backup type that provides continuous online backup by using optical or tape jukeboxes. It appears as an infinite disk to the system, and it can be configured to provide the closest version of an available real-time backup.

hierarchical trust model

A trust model, also known as a tree, in which a root CA at the top provides all of the information.

high availability (HA)

A clustering solution to provide resource reliability and availability.

HMAC (Hash-Based Message Authentication Code)

“A mechanism for message authentication using cryptographic hash functions,” per the draft of the Federal Information Processing Standard (FIPS) publication. Addressed in RFC 2104.


Typically an email message warning of something that isn’t true, such as an outbreak of a new virus. A hoax can send users into a panic and cause more harm than the virus.


A bogus system set up to attract and slow down a hacker. A honeypot can also be used to learn about the hacking techniques and methods that hackers employ.


Any network device with a TCP/IP network address or physical machines running virtual machines.

host-based IDS (HIDS)

An intrusion detection system that is host based. An alternative is an intrusion detection system that is network based.

hot aisles

A server room aisle that removes hot air.

hot site

A location that can provide operations within hours of a failure.


Another word for a patch. When Microsoft rolls a bunch of hotfixes together, they become known as a service pack.

HSM (Hardware Security Module)

A cryptoprocessor chip (or circuit mounted within the computer) that can be used to enhance security and is commonly used with PKI systems.


A combination of HTTP with Secure Sockets Layer (SSL) that results in a secure connection. It uses port 443 by default.

hybrid attack

A password attack that uses a combination of dictionary entries and brute force.

hybrid cloud

Cloud delivery model that combines other types.

hybrid trust model

A trust model that can use the capabilities of any or all of the structures of other trust models.

Hypertext Markup Language (HTML)

A set of codes used to format text and graphics that will be displayed in a browser. The codes define how data will be displayed.

Hypertext Transfer Protocol (HTTP)

The protocol used for communication between a web server and a web browser.

Hypertext Transport Protocol over SSL (HTTPS)

Also known as HTTPS and HTTP Secure. A combination of HTTP with Secure Sockets Layer (SSL) to make for a secure connection. It uses port 443 by default.


The software that allows virtual machines to exist.



identity proofing

The process of proofing invoked when a person claims that they are the user but cannot be authenticated, such as when they lose their password.


Pretending to be another to gain information.

implicit deny

A condition that states that unless otherwise given, the permission will be denied.


An attempt to violate a security policy, a successful penetration, a compromise of a system, or unauthorized access to information.

incident response

How an organization responds to an incident.

incident response plan (IRP)

A policy that defines how an organization will respond to an incident.

incremental backup

A type of backup in which only new files or files that have changed since the last full backup or the last incremental backup are included. Incremental backups clear the archive bit on files upon their completion.

information classification

The process of determining what information is accessible to what parties and for what purposes.

Infrastructure as a Service (IaaS)

A model of cloud computing that utilizes virtualization; clients pay an outsourcer for the resources used.

instant messaging (IM)

Immediate communication that can be sent back and forth between users who are currently logged on. From a security standpoint, there are risks associated with giving out information via IM that can be used in social engineering attacks; in addition, attachments sent can contain viruses.

Institute of Electrical and Electronics Engineers (IEEE)

An international organization that sets standards for various electrical and electronics issues.

Institutional Information

A term that broadly describes all data and information created, received and/or collected by UC.

integer overflow

Putting too much information into too small of a space that has been set aside for numbers.


An obstruction to the signal.

internal information

An information classification stating that the data so classified is limited to internal employees only.

International Data Encryption Algorithm (IDEA)

An algorithm that uses a 128-bit key. This product is similar in speed and capability to Digital Encryption Standard (DES), but it’s more secure. IDEA is used in Pretty Good Privacy (PGP).

International Telecommunications Union (ITU)

Organization responsible for communications standards, spectrum management, and the development of communications infrastructures in underdeveloped nations.

Internet Assigned Numbers Authority (IANA)

The organization responsible for governing IP addresses; its website is

Internet Control Message Protocol (ICMP)

A message and management protocol for TCP/IP. The Ping utility uses ICMP.

Internet Engineering Task Force (IETF)

An international organization that works under the Internet Architecture Board to establish standards and protocols relating to the Internet.

Internet layer

The network layer responsible for routing, IP addressing, and packaging.

Internet Message Access Protocol (IMAP)

A protocol with a store-and-forward capability. It can also allow messages to be stored on an email server instead of downloaded to the client.

Internet Protocol (IP)

The protocol in the TCP/IP suite responsible for network addressing.

Internet Protocol Security (IPSec)

A set of protocols that enable encryption, authentication, and integrity over IP. IPSec is commonly used with virtual private networks (VPNs) and operates at Layer 3.

Internet Society (ISOC)

A professional membership group composed primarily of Internet experts. It oversees a number of committees and groups, including the Internet Engineering Task Force (IETF).


The act of entering a system without authorization to do so.

intrusion detection system (IDS)

Tools that identify and respond to attacks using defined rules or logic. An IDS can be network based or host based.

intrusive tests

Penetration-type testing that involves trying to break into the network.

IP spoofing

Making the data look as if it came from a trusted host when it didn’t (thus spoofing the IP address of the sending host).

iSCSI (Internet Small Computer Systems Interface)

A protocol that enables the creation of storage area networks (SANs) and is used in sending storage-related commands over IP networks.

IT Resources

A term that broadly describes IT infrastructure, software and/or hardware with computing and networking capability. These include, but are not limited to: personal and mobile computing systems and devices, mobile phones, printers, network devices, industrial control systems (SCADA, etc.), access control systems, digital video monitoring systems, data storage systems, data processing systems, backup systems, electronic and physical media, biometric and access tokens and other devices that connect to any UC network. This includes both UC-owned and personally owned devices while they store Institutional Information, are connected to UC systems, are connected to UC Networks or used for UC business.


IV attack

An attack that involves looking at repeated results in order to crack the WEP secret key.




Purposely obstructing or interfering with a signal.

job rotation policy

A policy of rotating employees through various jobs.


The ability of a filesystem to use a log file of all changes and transactions that have occurred within a set period of time (for example, the last few hours). If a crash occurs, the operating system can look at the log files to see what transactions have been committed and which ones have not.




An authentication scheme that uses tickets (unique keys) embedded within messages. Named after the three-headed guard dog that stood at the gates of Hades in Greek mythology.

Kerckhoffs’s principle

A principle that states that the security of an algorithm should depend only on the secrecy of the key and not on the secrecy of the algorithm itself.

key distribution center (KDC)

An organization or facility that generates keys for users and is a part of Kerberos.

key escrow agency

An agency that stores keys for the purpose of law-enforcement access.

Key Exchange Algorithm (KEA)

A method of offering mutual authentication and establishing data encryption keys.


key generation

The act of creating keys for use by users.

key suspension

The temporary deferment of a key for a period of time (such as for a leave of absence).




The wait time between the call for an action or activity and the actual execution of that action.

lattice-based control

The concept that access differs at different levels. Often used in discussion with various access models as well as with cryptography to differentiate between security levels based on user/group labels.

Layer 2 Forwarding (L2F)

A tunneling protocol often used with virtual private networks (VPNs). L2F was developed by Cisco.

Layer 2 Tunneling Protocol (L2TP)

A tunneling protocol that adds functionality to the Point-to-Point Protocol (PPP). This protocol was created by Microsoft and Cisco, and it is often used with virtual private networks (VPNs).

LDAP injection attack

Exploiting weaknesses in LDAP (Lightweight Directory Access Protocol) implementations by not properly filtering input. The result can be executed commands, modified content, or results returned to unauthorized queries.

least privilege

A permission method in which users are granted only the privileges necessary to perform their job function.

least privilege policy

The policy of giving a user only the minimum permissions needed to do the work that must be done.

Lightweight Directory Access Protocol (LDAP)

A set of protocols that was derived from X.500 and operates at port 389.

Lightweight Extensible Authentication Protocol (LEAP)

An authentication protocol created by Cisco as an extension to EAP. LEAP is being phased out in favor of PEAP.


Assigning a quantitative number to the chance that something will occur.

limited distribution

Describes information that isn’t intended for release to the public. This category of information isn’t secret, but it’s private.

Link Control Protocol (LCP)

The protocol used to establish, configure, and test the link between a client and the PPP host.

load balancing

Dividing a load for greater efficiency of management among multiple devices.

local registration authority (LRA)

An authority used to identify or establish the identity of an individual for certificate issuance.


A discrete organization or entity governed by the Regents of the University of California. Locations include, but are not limited to: campuses, laboratories, medical centers and health systems, as well as satellite offices, affiliates or other offices in the United States controlled by the Regents of the University of California.

logic bomb

Any code that is hidden within an application and causes something unexpected to happen based on some criteria being met. For example, a programmer could create a program that always makes sure her name appears on the payroll roster; if it doesn’t, then key files begin to be erased.



MAC filtering

Limiting network access to a list of the MAC addresses associated with known users’ computers.

macro virus

A software exploitation virus that works by using the macro feature included in many applications, such as Microsoft Office.

malicious code

Any code that is meant to do harm.

malicious insider threat

A threat from someone inside the organization intent on doing harm.

Mandatory Access Control

A security policy in which labels are used to identify the sensitivity of objects. When a user attempts to access an object, the label is checked to see if access should be allowed (that is, whether the user is operating at the same sensitivity level). This policy is “mandatory,” because labels are automatically applied to all data (and can be changed only by administrative action), as opposed to “discretionary” policies that leave it up to the user to decide whether to apply a label.

mandatory vacation policy

A policy requiring earned vacation time be used or lost.


An attack that occurs when someone/something that is trusted intercepts packets and retransmits them to another party. Man-in-the-middle attacks have also been called TCP/IP hijacking in the past.


A device, such as a small room, that limits access to one or a few individuals. Mantraps typically use electronic locks and other methods to control access.

mean time between failures (MTBF)

The measurement of the anticipated incidence of failure of a system or component.

mean time to failure (MTTF)

The measurement of the average of how long it takes a system or component to fail.

mean time to restore (MTTR)

The measurement of how long it takes to repair a system or component once a failure occurs.

Media Access Control (MAC)

A sublayer of the Data Link layer of the Open Systems Interconnection (OSI) model that controls the way multiple devices use the same media channel. It controls which devices can transmit and when they can transmit.

mesh trust model

A trust model that expands the concepts of the bridge model by supporting multiple paths and multiple root certificate authorities.

Message Authentication Code (MAC)

A common method of verifying integrity. The MAC is derived from the message and a secret key.

message digest

The cryptographic hash containing a string of digits within a message.

middle-tier server

In a three-tier database model, this server accepts requests from clients, evaluates them, and then sends them on to the database server for processing.

misuse-detection IDS (MD-IDS)

An intrusion detection system that works by detecting misuse.


Residing on more than one network.

multipartite virus

A virus that attacks a system in more than one way.

mutual authentication

Whenever two or more parties authenticate each other.



National Institute of Standards and Technology (NIST)

An agency (formerly known as the National Bureau of Standards [NBS]) that has been involved in developing and supporting standards for the U.S. government for over 100 years. NIST has become involved in cryptography standards, systems, and technology in a variety of areas. It’s primarily concerned with governmental systems, where it exercises a great deal of influence.

National Security Agency (NSA)

The U.S. government agency responsible for protecting U.S. communications and producing foreign intelligence information. It was established by presidential directive in 1952 as a separately organized agency within the Department of Defense (DoD).

National Software Reference Library (NSRL)

An organization with the purpose of collecting “known, traceable software applications” through their hash values and storing them in a Reference Data Set (RDS) for law enforcement.

near field communication (NFC)

Technology that requires a user to bring the client close to the AP in order to verify (often through RFID or Wi-Fi) that the device is present.


An early networking protocol from Microsoft.

network access control (NAC)

The set of standards defined by the network for clients attempting to access it. Usually, NAC requires that clients be virus free and adhere to specified policies before allowing them on the network.

Network Address Translation (NAT)

A server that acts as a go-between for clients accessing the Internet. All communications look as if they originated from a proxy server because the IP address of the user making a request is hidden.

Network Control Protocol (NCP)

The protocol Point-to-Point Protocol (PPP) employs for encapsulating network traffic.

network intrusion prevention system (NIPS)

An intrusion prevention system that is network based.

network lock

Another term for MAC filtering.

network-based IDS (NIDS)

An approach to an intrusion detection system (IDS), it attaches the system to a point in the network where it can monitor and report on all network traffic.

nonintrusive tests

Penetration/vulnerability testing that takes a passive approach rather than actually trying to break into the network.


Making sure the sender can’t repudiate (dispute) sending the data.

NoSQL database

A database that is not a relational database and does not use SQL. These databases are less common than relational databases.



offsite storage

Storing data off the premise, usually in a secure location.


An antenna type that receives a signal from all directions.

one-tier model

A database model in which the database and the application exist on a single system.

one-time pad

A type of encryption in which plain text is paired with secret keys and then encrypted. This greatly increases the difficulty of cracking.

Online Certificate Status Protocol (OCSP)

A real-time protocol that replaces CRLs to immediately verify a certificate’s authenticity.

onsite storage

Storing backup data at the same site as the servers on which the original data resides.



packet filtering

A firewall technology that accepts or rejects packets based on their content.

packet sniffing

The process of looking through message packets to find data.

parity information

The computation of parity for a given set of data.

PASS method

The correct method of extinguishing a fire with an extinguisher: pull, aim, squeeze, and sweep.

passive response

A nonactive response, such as logging. Passive response is the most common type of response to many intrusions. In general, passive responses are the easiest to develop and implement.

password attacks

Attempting to ascertain a password that you should not know.


A fix for a known software problem.


Password-Based Key Derivation Function 2 applies some function (like a hash or HMAC) to the password or passphrase along with Salt to produce a derived key.

perimeter security

Security set up on the outside of the network or server to protect it.

Personal Identity Verification (PIV)

Card required of federal employees and contractors to gain access (physical and logical) to government resources.

personally identifiable information (PII)

Information that can be uniquely used to identify, contact, or locate a single person. Examples include Social Security number, driver’s license number, fingerprints, and handwriting.

phage virus

A virus that modifies and alters other programs and databases.


A form of redirection in which traffic intended for one host is sent to another.


A form of social engineering in which you simply ask someone for a piece of information that you are missing by making it look as if it is a legitimate request. Commonly sent via email.

ping of death

A large Internet Control Message Protocol (ICMP) packet sent to overflow the remote host’s buffer. A ping of death usually causes the remote host to reboot or hang.

plain-old telephone service (POTS)

Standard telephone service, as opposed to other connection technologies like Digital Subscriber Line (DSL).

Platform as a Service (PaaS)

A cloud service model wherein the consumer can deploy but does not manage or control any of the underlying cloud infrastructure.

pod slurping

When portable data storage devices (such as an iPod) are plugged directly into a machine and used to bypass the network security measures and illicitly download confidential data.

Point-to-Point Protocol (PPP)

A full-duplex line protocol that supersedes Serial Line Internet Protocol (SLIP). It’s part of the standard TCP/IP suite and is often used in dial-up connections.

Point-to-Point Tunneling Protocol (PPTP)

An extension to Point-to-Point Protocol (PPP) that is used in virtual private networks (VPNs). An alternative to PPTP is L2TP.


Rules or standards governing usage. These are typically high level in nature.


An attribute of some viruses that allows them to mutate and appear differently each time they crop up. The mutations make it harder for virus scanners to detect (and react) to the viruses.

Port Address Translation (PAT)

A means of translating between ports on a public and private network. Similar to Network Address Translation (NAT), which translates addresses between public and private.

port scanning

Scanning a server for open ports that can be taken advantage of by sending messages to ports to see which ones are available and which ones aren’t.


Connections available within TCP/IP.

Post Office Protocol (POP)

An email access program that can be used to retrieve email from an email server.

Post Office Protocol Version 3 (POP3)

The protocol used to download email from an SMTP email server to a network client.


Anything that occurs “after the fact,” such as an audit or review.

preventive controls

Controls intended to prevent attacks or intrusions.


A state of security in which information isn’t seen by unauthorized parties without the express permission of the party involved.

privacy filters

Screens that restrict viewing of monitors to only those sitting in front of them.

private cloud

A cloud delivery model owned and managed internally.

private key

An asymmetric encryption technology in which both the sender and the receiver have different keys. A public key is used to encrypt messages and the private key is used to decrypt them. See also public key.

privilege escalation

The result when a user obtains access to a resource they wouldn’t normally be able to access. Privilege escalation can be done inadvertently, by running a program with Set User ID (SUID) or Set Group ID (SGID) permissions or by temporarily becoming another user (via su or sudo in Unix/Linux or RunAs in Windows). It can also be done purposefully by an attacker seeking full access.


The likelihood of something occurring.

promiscuous mode

A mode wherein a network interface card (NIC) intercepts all traffic crossing the network wire and not just the traffic intended for it.

protected distribution system (PDS)

A network in which physical network security has been substituted for encryption security.

Protected Extensible Authentication Protocol (PEAP)

An authentication protocol that replaces LEAP and for which there is native support in Windows.

protocol analyzer

A software and hardware troubleshooting tool that is used to decode protocol information to try to determine the source of a network problem and to establish baselines.

proximity cards

Cards that can be read by being near a reader.

proximity readers

Readers capable of working with proximity cards.


A type of system that prevents direct communication between a client and a host by acting as an intermediary.

proxy firewall

A proxy server that also acts as a firewall, blocking network access from external networks.

proxy server

A type of server that makes a single Internet connection and services requests on behalf of many users.


Cameras that can pan, tilt, and zoom.

public cloud

A cloud delivery model available to others.

public key

A technology that facilitates encryption using two keys—a public key and a private key—to facilitate communication. The public key is used to encrypt a message to a receiver. See also private key.

Public-Key Cryptography Standards (PKCS)

A set of voluntary standards created by RSA security and industry security leaders.

public-key infrastructure (PKI)

A two-key encryption system wherein messages are encrypted with a private key and decrypted with a public key.

Public-Key Infrastructure X.509 (PKIX)

The Internet Engineering Task Force (IETF) working group developing standards and models for the Public Key Infrastructure (PKI) environment. The most current version is v3.



QoS (quality of service)

A collection of technologies that provide the ability to balance network traffic and prioritize workloads.


Used in risk management, it involves measuring the quality of something (as opposed to the quantity).



Numerically measuring the quantity of something (as opposed to the quality).

quantum cryptography

Cryptography based on changing the polarity of a photon. Quantum cryptography makes the process of interception difficult because any attempt to intercept the message changes the value of the message.



radio frequency interference (RFI)

The byproduct of electrical processes, similar to electromagnetic interference. The major difference is that RFI is usually projected across a radio spectrum.

rainbow table

A table of hashed phrases/words that can be used in a password attack.


Software that demands payment before restoring the data or system infected.

recommendations (short term, mid-term, long term)

Short Term Recommendations
Items associated with this period are typically risks where remediation can be addressed quickly with current staffing levels. Examples include defining and documenting security policies & procedures, user training, and continuation of assessment processes.

Mid-Term Recommendations
Items associated with this period are typically risks where remediation will require additional staffing or minor technology investments. These include expansion of the risk management program to include assessments of technologies or organizations that were not included in this scope or with new and expanded techniques. Examples include web application testing, mobile code analysis, complete network vulnerability analysis, and external penetration testing.
Additionally, process improvements or integrations with other organizations such as procurement will require discussion, collaboration on defining workflow, and improving staffing levels to support new services. Examples include implementing vendor risk assessment into the procurement lifecycle.

Long Term Recommendations
Items associated with this period are typically risks where remediation will require significant staffing or technology investments. Remediation activities will likely require a funded project, enterprise collaboration and involvement, and only occur after the next full capital funding cycle.

recovery point objective (RPO)

Within business continuity planning, this is the point of maximum tolerable loss for a system due to a major incident.

recovery time objective (RTO)

The maximum amount of time that a process or service is allowed to be down and the consequences still to be considered acceptable.

Redundant Array of Independent Disks (RAID)

A configuration of multiple hard disks used to provide fault tolerance should a disk fail. Different levels of RAID exist.

registration authority (RA)

An organization that offloads some of the work from a certificate authority (CA). An RA system operates as a middleman in the process. The RA can distribute keys, accept registrations for the CA, and validate identities. The RA doesn’t issue certificates; that responsibility remains with the CA.

relational database

A database technology that allows data to be viewed in dynamic ways based on the user’s or administrator’s needs.

Remote Access Services (RAS)

A computer that has one or more connections installed to enable remote connections to the network.

Remote Authentication Dial-In User Service (RADIUS)

A networking protocol that allows authentication of dial-in and other network connections. RADIUS is commonly used by Internet service providers (ISPs) and in the implementation of virtual private networks (VPNs).

Remote Desktop Protocol (RDP)

A protocol used to allow remote desktop connections.

Remote Procedure Call (RPC)

A programming interface that allows a remote computer to run programs on a local machine.

remote wipe

The process of sending a command to remotely clear data.

replay attack

An attack that captures portions of a session to play back later to convince a host that it is still talking to the original connection.


A database or database server where the certificates are stored.

Request for Comments (RFC)

A document-creation process and a set of practices that originated in 1969 and is used for proposed changes to Internet standards.

restricted information

Information that isn’t made available to all and to which access is granted based on some criteria.


A virus that attacks or bypasses the antivirus software installed on a computer.

risk acceptance

A strategy of dealing with risk in which it is decided the best approach is simply to accept that the risk exists.

risk analysis

An evaluation of each risk that can be identified. Each risk should be outlined, described, and evaluated on the likelihood of it occurring.

risk assessment

An evaluation of how much risk you and your organization are willing to take. An assessment must be performed before any other actions—such as how much to spend on security in terms of dollars and manpower—can be decided.

risk avoidance

A strategy of dealing with risk in which it is decided that the best approach is to avoid the risk.

risk calculation

The process of calculating the risks that exist.

risk deterrence

A strategy of dealing with risk in which it is decided that the best approach is to discourage potential attackers from engaging in the behavior that leads to the risk.

risk mitigation

A strategy of dealing with risk in which it is decided that the best approach is to lessen the risk.

risk transference

A strategy of dealing with risk in which it is decided that the best approach is to offload some of the risk.

rogue access points

An unauthorized wireless access point on a network.


A form of malware that tries to convince the user to pay for a fake threat.

Role-Based Access Control (RBAC)

A type of control wherein the levels of security closely follow the structure of an organization. The role the person plays in the organization (accountant, salesman, and so on) corresponds to the level of security access they have to data.


Software program that has the ability to obtain root-level access and hide certain things from the operating system.


A device that connects two or more networks and allows packets to be transmitted and received between them. A router determines the best path for data packets from source to destination.

Routing and Remote Access Services (RRAS)

The current Microsoft server service for Windows-based clients that offers the ability to connect to remote systems.


One of the providers of cryptography systems to industry and government. RSA stands for the initials of the three founders of RSA Security Inc.: Rivest, Shamir, and Adleman. RSA maintains a list of standards for Public Key Cryptography Standards (PKCS).

Rule-Based Access Control (RBAC)

Access control method that uses the settings in preconfigured security policies to make all decisions.



SAN (storage area network)

A separate network set up to appear as a server to the main organizational network.


Isolating applications to keep users of them from venturing to other data.


Software that tries to convince unsuspecting users that a threat exists.

scope and purpose

The section of a guideline that provides an overview and statement of the guideline’s intent.

scope statement

The portion of the policy outlining what it intends to accomplish and which documents, laws, and practices the policy addresses.

Secure Copy (SCP)

A replacement for FTP that allows secure copying of files from one host to another.

Secure Electronic Transaction (SET)

A protocol developed by Visa and MasterCard for secure credit card transactions. The protocol is becoming an accepted standard by many companies. SET provides encrypted credit card numbers over the Internet, and it’s most suited to small amounts of data transmission.

Secure Hash Algorithm (SHA)

A one-way hash algorithm designed to ensure the integrity of a message.

Secure Hypertext Transport Protocol (S-HTTP)

A protocol used for secure communications between a web server and a web browser.

Secure Multipurpose Internet Mail Extensions (S/MIME)

A protocol used for secure communications between email servers.

Secure Shell (SSH)

A replacement for rlogin in Unix/Linux that includes security. rlogin allowed one host to establish a connection with another with no real security being employed; SSH replaces it with slogin and digital certificates.

Secure Sockets Layer (SSL)

A protocol that secures messages by operating between the Application layer (HTTP) and the Transport layer.

security control testing (SCT)

Looking for weaknesses through interviews, examinations, and testing of systems.

security policies

Policies related to security.


security token

A piece of data that contains the rights and access privileges of the token bearer as part of the token.

security zone

A method of isolating a system from other systems or networks.


The IDS component that collects data from the data source and passes it to the analyzer for analysis.

service pack

Operating system updates from Microsoft.

service provider

UC groups or organizations providing specific IT services to a Unit.

service-level agreement (SLA)

An agreement that specifies performance requirements for a vendor. This agreement may use mean time before failure (MTBF) and mean time to repair (MTTR) as performance measures in the SLA.


Protective coating around wiring often intended to protect it from interference.

shoulder surfing

Watching someone when they enter their username, password, or sensitive data.


The process of ignoring an attack.

signature-based system

A system that acts based on the digital signature it sees.

Simple Mail Transfer Protocol (SMTP)

A protocol for sending email between SMTP servers.

Simple Network Management Protocol (SNMP)

The management protocol created for sending information about the health of the network-to-network management consoles.

single loss expectancy (SLE)

The cost of a single loss when it occurs. This loss can be a critical failure, or it can be the result of an attack.

single point of failure (SPOF)

A weakness that brings a system down.

single sign-on (SSO)

A relationship between the client and the network wherein the client is allowed to log on one time, and all resource access is based on that logon (as opposed to needing to log on to each individual server to access the resources there).

single-factor authentication (SFA)

Authentication based on a single factor (a password, for example).

single-tier environment

A database model in which the database and the application exist on a single system.

site survey

A generic site survey involves listening in on an existing wireless network using commercially available technologies. A wireless site survey, or wireless survey, is the process of planning and designing a wireless network, in particular an 802.11 network.

smart card

A physical card used for access control and security purposes. The card itself usually contains a small amount of memory that can be used to store permissions and access information.

smurf attack

An attack in which large volumes of ICMP echo requests (pings) are broadcast to all other machines on the network and in which the source address of the broadcast system has been spoofed to appear as though it came from the target computer. When all of the machines that received the broadcast respond, they flood the target with more data than it can handle.


Image of a virtual machine at a moment in time.


A physical device that listens in (sniffs) on network traffic and looks for items it can make sense of. There is a legitimate purpose for these devices: Administrators use them to analyze traffic. However, when they’re used by sources other than the administrator, they become security risks.


Analyzing data to look for passwords and anything else of value. Sniffing is also known as wiretapping, eavesdropping, packet sniffing, and network sniffing, among other terms.

social engineering

An attack that uses others by deceiving them. It does not directly target hardware or software but instead targets and manipulates people.

Software as a Service (SaaS)

A model of cloud computing in which the consumer can use the provider’s applications but they do not manage or control any of the underlying cloud infrastructure.


Unwanted, unsolicited email sent in bulk.

spam filters

Filters that try to eliminate unwanted, unsolicited email sent in bulk.

spear phishing

A form of phishing in which the message is made to look as if it came from someone you know and trust as opposed to an informal third party.


An attempt by someone or something to masquerade as someone/something else.


Software programs that work—often actively—on behalf of a third party.

SSH File Transfer Protocol (SFTP)

A replacement for FTP that allows secure copying of files from one host to another.

SSID broadcast

An access point’s broadcasting of the network name.


Derived from policies, a standard deals with specific issues or aspects of a business.

stateful inspection

Inspections that occur at all levels of the network and provide additional security using a state table that tracks every communications channel.

stealth virus

A virus that attempts to avoid detection by masking itself from applications.


The science of hiding information within other information, such as a picture.

stream cipher

A method of encryption that encrypts streams of data rather than blocks.

Structured Query Language (SQL)

A database language that allows queries to be configured in real time and passed to database servers.


Using subnet values to divide a network into smaller segments.

substitution cipher

A method of encryption in which one letter or item is substituted for another.

succession planning

An outline of those internal to the organization who have the ability to step into positions when they open.


An external, third-party entity that provides goods or services to UC.


A network device that can replace a router or hub in a local network and get data from a source to a destination. Switching allows for higher speeds.

symmetrical keys

The keys used when the same key encrypts and decrypts data.

system image

A snapshot of what exists.



tabletop exercise 

An exercise that involves individuals sitting around a table with a facilitator discussing situations that could arise and how best to respond to them.


Following someone through an entry point.

technical controls 

Controls that rely on technology.


A protocol that functions at the Application layer of the OSI model, providing terminal emulation capabilities.

Temporal Key Integrity Protocol (TKIP) 

A wrapper that works with wireless encryption to strengthen WEP implementations. It was designed to provide more secure encryption than the notoriously weak Wired Equivalent Privacy (WEP).

Terminal Access Controller Access-Control System (TACACS) 

An authentication system that allows credentials to be accepted from multiple methods, including Kerberos. The TACACS client-server process occurs in the same manner as the Remote Authentication Dial-In User Service (RADIUS) process.

threat vector 

Any perceivable risk’s area of attack.

three-tier model 

A database model that effectively isolates the end user from the database by introducing a middle server.

transitive access 

A form of trust relationship often used between domains.

transitive trusts 

Trust gained because one party (A) trusts another party (B), which then trusts another party (C). Since (B) trusts (C), then a relationship can exist where the first party (A) also may trust the third party (C).

Transmission Control Protocol (TCP) 

The protocol found at the Host-to-Host layer of the Department of Defense (DoD) model. This protocol breaks data packets into segments, numbers them, and sends them in order. The receiving computer reassembles the data so that the information is readable for the user. In the process, the sender and the receiver confirm that all data has been received; if not, it’s resent. TCP is a connection-oriented protocol. See also connection-oriented protocol.

Transport Layer Security (TLS) 

A protocol whose purpose is to verify that secure communications between a server and a client remain secure. Defined in RFC 2246. 

transposition cipher 

An encryption method that involves transposing or scrambling the letters in a certain manner.

Triple-DES (3DES) 

A symmetric block cipher algorithm used for encryption.

Trivial File Transfer Protocol (TFTP) 

A UDP-based protocol similar to FTP that doesn’t provide the security or error-checking features of FTP.

Trojan horse 

Any application that masquerades as one thing in order to get past scrutiny and then does something malicious. One of the major differences between Trojan horses and viruses is that Trojan horses tend not to replicate themselves.

trusted operating system (TOS) 

Any operating system that meets the government’s requirements for security.

Trusted Platform Module (TPM) 

A method of using encryption and storing the passwords on a chip. The hardware holding the chip is then needed to unencrypt the data and make it readable.


The act of sending data across a public network by encapsulating it into other packets.

two-factor authentication 

Using two access methods as a part of the authentication process.

two-tier model 

A database model in which the client workstation or system runs an application that communicates with the database that is running on a different server.

Type I hypervisor 

Virtualization method that is independent of the operating system and boots before the OS.

Type II hypervisor 

Virtualization method that is dependent on the operating system.

typo squatting 

Creating domains that are based on the misspelling of another.



uninterruptible power supply (UPS)

A device that can provide short-term power, usually by using batteries.


A point of accountability and responsibility that results from creating/collecting or managing/possessing Institutional Information or installing/managing IT Resources. A Unit is typically a defined organization or set of departments.

unit head

A generic term for dean, vice chancellor or person in a similarly senior role who has the authority to allocate budget and is responsible for Unit performance and administration. At a particular Location or in a specific situation, the following senior roles may also be Unit Heads: department chairs, assistant/associate vice chancellor (AVC), principal investigators, directors or senior managers.

Unit Information Security Lead (UISL)

A term for the Workforce Member(s) assigned responsibility for tactical execution of information security activities including, but not limited to: implementing security controls; reviewing and updating Risk Assessments and Risk Treatment Plans; devising procedures for the proper handling, storing and disposing of electronic media within the Unit; and reviewing access rights. These activities are performed in consultation with the Unit Head.

URL hijacking

Registering domains that are similar to those for a known entity but based on a misspelling or typographical error.

User Datagram Protocol (UDP)

The protocol at the Host-to-Host layer of the TCP/IP Department of Defense (DoD) model, which corresponds to the Transport layer of the OSI model. Packets are divided into datagrams, given numbers, sent, and put back together at the receiving end. UDP is a connectionless protocol.



Van Eck phreaking

Eavesdropping on CRT and LCD displays by detecting their electromagnetic emissions.

Vigenère cipher

A multialphabet substitution cipher.

virtual local area network (VLAN)

A local area network (LAN) that allows users on different switch ports to participate in their own network, separate from but still connected to the other stations on the same or a connected switch.

virtual private network (VPN)

A system that uses the public Internet as a backbone for a private interconnection (network) between locations.


Emulating one or more physical computers on the same host.


A program intended to damage a computer system.


Combining phishing with Voice over IP (VoIP).


The amount of time that you have to collect certain data before a window of opportunity is gone.

vulnerability scanning

Identifying specific vulnerabilities in your network.



war chalking

Markings left, often written in chalk, by those who discover a vulnerability that provides a way into the wireless network.

war driving

Driving around with a laptop looking for open wireless access points with which to communicate.

warm site

A site that provides some capabilities in the event of a disaster. The organization that wants to use a warm site will need to install, configure, and reestablish operations on systems that might already exist in the warm site.

watering hole attack

Identifying a site that is visited by those that they are targeting, poisoning that site, and then waiting for the results.

web application firewall (WAF)

A firewall that can look at every request between a web client and a web server and identify possible attacks.


Another term for social engineering.


Phishing only large accounts.


A wireless network operating in the 2.4 GHz or 5 GHz range.

Wi-Fi Protected Access 2 (WPA2)

The second version of WPA.

Wi-Fi Protected Setup (WPS)

An authentication process that requires the user to do something in order to complete the enrollment process. Examples include pressing a button on the router within a short time period, entering a PIN, or bringing the new device close.

Windows Sockets (Winsock) API

A Microsoft API used to interact with TCP/IP.

Wired Equivalent Privacy (WEP)

A security protocol for 802.11b (wireless) networks that attempts to establish the same security for them as would be present in a wired network.

wireless access point

A connection device used for clients in a radio frequency (RF) network.

Wireless Application Protocol (WAP)

Technology designed for use with wireless devices.

Wireless Markup Language (WML)

Language used for Internet displays. WAP-enabled devices can also respond to scripts using WMLScript.

Wireless Transport Layer Security (WTLS)

The security layer of the Wireless Applications Protocol (WAP). WTLS provides authentication, encryption, and data integrity for wireless devices.

workforce manager

A person who supervises/manages other personnel or approves work or research on behalf of the University.

workforce member

An employee, faculty, staff, volunteer, contractor, researcher, student worker, student supporting/performing research, medical center staff/personnel, clinician, student intern, student volunteer or person.

working copy backup

The copy of the data currently in use on a network.

World Wide Web Consortium (W3C)

An association concerned with interoperability, growth, and standardization of the World Wide Web (WWW). This group is the primary sponsor of XML and other web-enabled technologies.




The working group formed by the IETF to develop standards and models for the PKI environment.

Xmas attack

An advanced attack that tries to get around detection and send a packet with every single option enabled.

XML Key Management Specification (XKMS)

A specification designed to allow XMLbased programs access to PKI services.





zero-day exploit

An attack that begins the very day an exploit is discovered.


Any system taking directions from a master control computer. Zombies are often used in distributed denial-of-service (DDoS) and botnet attacks.




The IEEE standard that defines port-based security for wireless network access control.