Agreed-upon principles set forth by a company to govern how the employees of that company may use resources such as computers and Internet access.

The means of giving or restricting user access to network resources. Access control can be accomplished through the use of an access control list (ACL).

A table or data file that specifies whether a user or group has access to a specific resource on a computer or network.

The point at which access to a network is accomplished. This term is often used in relation to a wireless access point (WAP).

A policy that provides information to the reader about who to contact if a problem is discovered.

A response generated in real time.

Any action a user undertakes.

Protocol used to map known IP addresses to unknown physical addresses.

An attack that convinces the network that the attacker’s MAC address is the one associated with an allowed address so that traffic is wrongly sent to attacker’s machine.

A control implemented through administrative policies or procedures.

The user who is accountable and responsible for the network.

A Federal Information Processing Standards (FIPS) publication that specifies a cryptographic algorithm for use by the U.S. government.

Software that gathers information to pass on to marketers or that intercepts personal data such as credit card numbers and makes them available to third parties.

An implementation of Advanced Encryption Standard (AES) that uses 256-bit encryption.

A notification that an unusual condition exists and should be investigated.

A notification that an unusual condition exists and should be investigated.

An appliance that performs multiple functions.

The component or process that analyzes the data collected by the sensor.

A calculation used to identify risks and calculate the expected loss each year.

A calculation of how often a threat will occur. For example, a threat that occurs once every five years has an annualized rate of occurrence of 1/5, or 0.2.

Variations from normal operations.

An anomaly-detection intrusion detection system works by looking for deviations from a pattern of normal network traffic.

Software that identifies the presence of a virus and is capable of removing or quarantining the virus.

A cloud computing model that can work with a combination of other models: SaaS, IaaS, or PaaS.

A freestanding device that operates in a largely self-contained manner.

An application has both a user interactive front-end and a back-end where the data resides.  Front-ends can be a web page, a mobile app, or a desktop fat client.  An application generally supports multiple users, requires a login, and goes through a software development lifecycle (SDLC). 

Applications are the software elements that are directly touched and felt by end users.

Individual or group responsible for the administration of the application. This role is similar to a System Administrator.

The seventh layer of the Open Systems Interconnection (OSI) model. This layer deals with how applications access the network and describes application functionality, such as file transfer and messaging.

UCSF employee responsible for routine management of application, may also perform application administrator functions, such as adding/deleting users.

An abstract interface to the services and protocols provided by an operating system.

A device or software that recognizes application-specific commands and offers granular control over them.

Accepting commands unrelated to a program and running them on the host machine within a shell, or command interpreter.

An approach to security that involves using a control framework to focus on the foundational infrastructure.

A virus that is protected in a way that makes disassembling it difficult. The difficulty makes it “armored” against antivirus programs that have trouble getting to, and understanding, its code.

More commonly known as ARP poisoning, this involves the MAC (Media Access Control) address of the data being faked.

An algorithm that uses two keys.

Encryption in which two keys must be used. One key is used to encrypt data, and the other is needed to decrypt the data. Asymmetric encryption is the opposite of symmetric encryption, where a single key serves both purposes.

Any unauthorized intrusion into the normal operations of a computer or computer network. The attack can be carried out to gain access to the system or any of its resources.

The area of an application that is available to users—those who are authenticated and, more importantly, those who are not.

Minimizing the possibility of exploitation by reducing the amount of code and limiting potential damage.

The act of tracking resource usage by users.

The means of verifying that someone is who they say they are.

A header used to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays.

A type of certificate technology that allows ActiveX components to be validated by a server.

A utility used with Windows 7 and 8 for creating a copy of the configuration settings necessary to reach the present state after a disaster.

An opening left in a program application (usually by the developer) that allows additional access to data. Typically, a backdoor is created for debugging purposes and is not documented. Before the product ships, the backdoors are closed; when they aren’t closed, security loopholes exist.

A reversion, or roll back to a previous state, from a change that had negative consequences.

A usable copy of data made to media. Ideally, the backup is made to removable media and stored for recovery should anything happen to the original data.

A generator that can supply power in the event the primary provider is unable to deliver it.

A documented plan governing backup situations. It can include alternate or secondary plans as well.

A written policy detailing the frequency of backups and the location of storage media.

Looking at the banner, or the header information messages sent with data, to find out about a system(s).

Comparing performance to a historic metric.

A host with multiple network interface cards so that it can reside on multiple networks.

A set of rules governing basic operations.

Data that is too large to be dealt with by traditional database management means.

A probability method of finding collision in hash functions.

A Microsoft utility used to encrypt a drive.

A method of encryption that processes blocks of data rather than streams.

A type of symmetric block cipher created by Bruce Schneier.

The sending of unsolicited messages over a Bluetooth connection.

The gaining of unauthorized access through a Bluetooth connection.

A router used to translate from LAN framing to WAN framing.

An automated software program (network robot) that collects information on the Web. In the malicious form, a bot is a compromised computer being controlled remotely.

A trust model in which a peer-to-peer relationship exists among the root certificate authorities.

A type of attack that relies purely on trial and error and tries all possible combinations.

A type of denial-of-service (DoS) attack that occurs when more data is put into a buffer than it can hold, thereby overflowing it (as the name implies).

the creation and validation of a practiced plan for how an organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster or extended disruption.

A study of the possible impact if a disruption to a business’s vital resources were to occur.

UCSF employee responsible for business purpose of application, typically a senior manager or faculty member.

A physical security deterrent used to protect a computer.

An access point that requires users to agree to some condition before they use the network or Internet.

A type of symmetric block cipher defined by RFC 2144.

A digital entity that establishes who you are and is often used with e-commerce. It contains your name and other identifying data and usually includes the public key in PKI.

An issuer of digital certificates (which are then used for digital signatures or key pairs). A certificate authority is occasionally referred to as a certification authority.

A messaging protocol used between PKI entities. This protocol is used in some PKI environments.

The principles and procedures employed in the issuing and managing of certificates.

The act of making a certificate invalid.

A list of digital certificate revocations that must be regularly downloaded to stay current.

A protocol that challenges a system to verify identity. CHAP is an improvement over Password Authentication Protocol (PAP), in which one-way hashing is incorporated into a three-way handshake.

Management included in the making of a change in the scope of any particular item.

An algorithm, also known as a cryptographic algorithm, used to encrypt and decrypt data.

A role responsible for security functions throughout a Location, including assisting in the interpretation and application of UCOP IS-3.

The part of a client-server network where the computing is usually done. In a typical setting, a client uses the server for remote storage, backups, or security (such as a firewall).

A surveillance camera used for physical-access monitoring.

Moving the execution of an application to the cloud on an as-needed basis.

A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources.

A method of balancing loads and providing fault tolerance.

The storage and conditions for release of source code provided by a vendor, partner, or other party.

Looking at all custom written code for holes that may exist.

Server room aisles that blow cold air from the floor.

A physical site that can be used if the main site is inaccessible (destroyed) but that lacks all the resources necessary to enable an organization to use it immediately. Commonly, plans call for turning to a cold site within a certain number of hours after the loss of the main site.

An agreement between individuals to commit fraud or deceit.

A standard identification card used by the Department of Defense (DoD) and other employers. It is used for authentication as well as identification.

A document of specifications detailing security evaluation methods for IT products and systems.

Cloud delivery model in which the infrastructure is shared by organizations with something in common.

A virus that creates a new program that runs in place of an expected program of the same name.

Gap controls that fill in the coverage between other types of vulnerability mitigation techniques (where there are holes in coverage, we compensate for them).

If audited or investigated, gaps in compliance could expose UCSF to regulatory fines and administrative action from the Office for Civil Rights(OCR). These can include areas such as undocumented policies and procedures, lack of recurring training programs, or lack of encryption for systems hosting ePHI. To be fully compliant to HIPAA, FERPA, & SB1386, all controls must be implemented.

A formalized or an ad hoc team you can call upon to respond to an incident after it arises.

Type of communications between two hosts that have a previous session established for synchronizing sent data. The receiving PC acknowledges the data. This method allows for guaranteed delivery of data between PCs. Within the TCP/IP suite, TCP is used for connection-oriented communications.

A plan that allows a business to keep running in the event of a disruption to vital resources.

Processes or actions used to respond to situations or events.

Technical or administrative measures in place to assist with resource management.

A plain-text file stored on your machine that contains information about you (and your preferences) and is used by a server.

A wrapper that uses 128-bit AES encryption with a 48-bit initialization vector.

Functions on which the livelihood of the company depends.

A form of web-based attack in which unauthorized commands are sent from a user that a website trusts.

Running a script routine on a user’s machine from a website without their permission.

The study and practice of finding weaknesses in ciphers.

A person who does cryptanalysis.

A person who participates in the study of cryptographic algorithms.

An algorithm, also known as a cipher, used to encrypt and decrypt data.

The field of mathematics focused on encrypting and decrypting data.

Getting rid of/destroying media no longer needed.

The primary standard used in government and industry until it was replaced by AES.

Any systems that identify, monitor, and protect data to prevent it from unauthorized use, modification, or destruction.

A policy dealing with some aspect of data (usage, destruction, retention, etc.).

while the gaps above may result in fines if identified, it is more critical to the organization to be aware that lack of security controls could result in loss of data and additional penalties or cost for notification and remediation. Typically from a HIPAA perspective, organizations are investigated by OCR only if they have reported a breach or have had a whistleblower inform OCR of possible non-compliant actions. Therefore, as a good steward of data and to present a proactive stance to prevent data loss, additional actions may be recommended.

A response that fools the attacker into thinking that the attack is succeeding while the system monitors the activity and potentially redirects the attacker to a system that is designed to be broken.

An area for placing web and other servers outside the firewall. The purpose for so doing is not specifically to protect them but to protect the internal network.

A type of attack that prevents any users—even legitimate ones—from using a system.

Reviewing the security design, including examining the ports and protocols used, the rules, segmentation, and access control.

Controls that are intended to identify and characterize an incident in progress (for example, sounding the alarm and altering the administrator).

The act of attempting to crack passwords by testing them against a list of dictionary words. With today’s powerful computers, an attacker can combine one of many available automated password-cracking utilities with several large dictionaries or “wordlists” and crack huge numbers of passwords in a matter of minutes. Any password based on any dictionary word is vulnerable to such an attack.

A type of backup that includes only new files or files that have changed since the last full backup. Differential backups differ from incremental backups in that they don’t clear the archive bit upon their completion.

An asymmetric standard for exchanging keys. This cryptographic algorithm is used primarily to send secret keys across public networks. The process isn’t used to encrypt or decrypt messages; it’s used merely for the transmission of keys in a secure manner.

An asymmetrically encrypted signature whose sole purpose is to authenticate the sender.

An attack that involves navigating to other directories and gaining access to files/directories that would be otherwise restricted.

The act of recovering data following a disaster that has destroyed it.

A plan outlining the procedure by which data is recovered after a disaster.

A method of restricting access to objects based on the identity of the subjects or the groups to which they belong. The user can assign permissions to data and assets at their discretion.

Technology that uses two controllers and two disks to keep identical copies of data to prevent the loss of data if one disk fails.

Technology that keeps identical copies of data on two disks to prevent the loss of data if one disk fails.

Technology that enables writing data to multiple disks simultaneously in small portions called stripes. These stripes maximize use by having all of the read/write heads working constantly. Different data is stored on each disk and isn’t automatically duplicated. (This means that disk striping in and of itself doesn’t provide fault tolerance.)

A fault-tolerance solution of writing data across a number of disks and recording the parity on another (also known as disk striping with a parity disk). In the event that any one disk fails, the data on it can be re-created by looking at the remaining data and computing parity to figure out the missing data.

A derivative of a DoS attack in which multiple hosts in multiple locations all focus on one target to reduce its availability to the public. This can be accomplished through the use of compromised systems, botnets, etc.

An attack method in which a daemon caches DNS reply packets, which sometimes contain other information (data used to fill the packets). The extra data can be scanned for information useful in a break-in or man-in-the-middle attack.

The DNS server is given information about a name server that it thinks is legitimate when it isn’t.

The network service used in TCP/IP networks that translates hostnames to IP addresses.

A host that resides on more than one network and possesses more than one physical network card.

Looking through trash for clues—often in the form of paper scraps—to find users’ passwords and other pertinent information.

A protocol used on a TCP/IP network to send client configuration data, including IP address, default gateway, subnet mask, and DNS configuration, to clients. DHCP uses a four-step process: Discover, Offer, Request, and Acknowledgment.

The IEEE standard that defines port-based security for wireless network access control. It offers a means of authentication and defines the Extensible Authentication Protocol (EAP) over IEEE 802, and it is often known as 802.1x.

Dynamic provisioning of resources as needed.

The interference that can occur during transmissions over copper cable because of electromagnetic energy outside the cable. The result is degradation of the signal.

A device that identifies you electronically in the same way as the cards you carry in your wallet.

A type of public key cryptosystem that requires a shorter key length than many other cryptography systems (including the de facto industry standard, RSA).

A header used to provide a mix of security services in IPv4 and IPv6. ESP can be used alone or in combination with the IP Authentication Header (AH).

The process of enclosing data in a packet.

The process of converting data into a form that makes it less likely to be usable to anyone intercepting it if they can’t decrypt it.

A string of alphanumeric characters used to decrypt encrypted data.

The process of luring someone.

The process of encouraging an attacker to perform an act, even if they don’t want to do it.

A key that exists only for that session.

The act of moving something up in priority. Often, when an incident is escalated, it’s brought to the attention of the next-highest supervisor.

A level of assurance, expressed as a numeric value, based on standards set by the Common Criteria Recognition Agreement (CCRA).

Any noticeable action or occurrence.

A statement that differs from the norm.

An authentication protocol used in wireless networks and point-to-point connections.

The process of reconstructing a system or switching over to other systems when a failure is detected.

An event that should be flagged but isn’t.

A flagged event that isn’t really an event and has been falsely triggered.

An electrically conductive wire mesh or other conductor woven into a “cage” that surrounds a room and prevents electromagnetic signals from entering or leaving the room through the walls.

The ability to withstand a fault (failure) without losing data.

A networking protocol that is not routable at the IP layer and thus cannot work across large networks.

A set of guidelines for U.S. federal government information systems.

A means of linking a user’s identity with their privileges in a manner that can be used across business boundaries.

A collection of computer networks that agree on standards of operation, such as security standards.

A high-speed networking technology.

Microsoft’s earliest filesystem.

TCP/IP and software that permit transferring files between computer systems and use cleartext passwords. Because FTP has been implemented on numerous types of computer systems, files can be transferred between disparate computer systems.

The act of stopping a fire and preventing it from spreading.

A combination of hardware and software that protects a network from attack by hackers who could gain access through public networks, including the Internet.

A system that is up and running at least 99.999 percent of the time.

The process of systematically identifying the network and its security posture. This is typically a passive process.

In terms of security, the act of looking at all the data at your disposal to try to figure out who gained unauthorized access and the extent of that access.

A property of any key exchange system that ensures that if one key is compromised, subsequent keys will not also be compromised.

A secure form of FTP.

A concept that works on the assumption that any information created on any system is stored forever.

A backup that copies all data to the archive medium.

An information classification stating that the data so classified is available to anyone.

A technique of penetration testing. It can include providing unexpected values as input to an application in order to make it crash.

Vulnerability possible when the interconnection between the WAP server and the Internet isn’t encrypted and packets between the devices may be intercepted.

One of the most popular methods of backup tape rotation. Three sets of tapes are rotated in this method. The most recent backup after the full backup is the Son. As newer backups are made, the Son becomes the Father, and the Father, in turn, becomes the Grandfather. At the end of each month, a full backup is performed on all systems. This backup is stored in an offsite facility for a period of one year. Each monthly backup replaces the monthly backup from the previous year. Weekly or daily incremental backups are performed and stored until the next full backup occurs. This full backup is then stored offsite, and the weekly or daily backup tapes are reused.

Virtual machines running on a physical machine.

Rules, policies, or procedures that are advisory or nonmandatory.

The process of making certain that an entity (such as an operating system or application) is as secure as it can be.

A system that bases actions on the heuristics it observes. It is used in intrusion detection and prevention systems and coupled with if-then analysis.

A newer backup type that provides continuous online backup by using optical or tape jukeboxes. It appears as an infinite disk to the system, and it can be configured to provide the closest version of an available real-time backup.

A trust model, also known as a tree, in which a root CA at the top provides all of the information.

A clustering solution to provide resource reliability and availability.

“A mechanism for message authentication using cryptographic hash functions,” per the draft of the Federal Information Processing Standard (FIPS) publication. Addressed in RFC 2104.

Typically an email message warning of something that isn’t true, such as an outbreak of a new virus. A hoax can send users into a panic and cause more harm than the virus.

A bogus system set up to attract and slow down a hacker. A honeypot can also be used to learn about the hacking techniques and methods that hackers employ.

Any network device with a TCP/IP network address or physical machines running virtual machines.

An intrusion detection system that is host based. An alternative is an intrusion detection system that is network based.

A server room aisle that removes hot air.

A location that can provide operations within hours of a failure.

Another word for a patch. When Microsoft rolls a bunch of hotfixes together, they become known as a service pack.

A cryptoprocessor chip (or circuit mounted within the computer) that can be used to enhance security and is commonly used with PKI systems.

A combination of HTTP with Secure Sockets Layer (SSL) that results in a secure connection. It uses port 443 by default.

A password attack that uses a combination of dictionary entries and brute force.

Cloud delivery model that combines other types.

A trust model that can use the capabilities of any or all of the structures of other trust models.

A set of codes used to format text and graphics that will be displayed in a browser. The codes define how data will be displayed.

The protocol used for communication between a web server and a web browser.

Also known as HTTPS and HTTP Secure. A combination of HTTP with Secure Sockets Layer (SSL) to make for a secure connection. It uses port 443 by default.

The software that allows virtual machines to exist.

The process of proofing invoked when a person claims that they are the user but cannot be authenticated, such as when they lose their password.

Pretending to be another to gain information.

A condition that states that unless otherwise given, the permission will be denied.

An attempt to violate a security policy, a successful penetration, a compromise of a system, or unauthorized access to information.

How an organization responds to an incident.

A policy that defines how an organization will respond to an incident.

A type of backup in which only new files or files that have changed since the last full backup or the last incremental backup are included. Incremental backups clear the archive bit on files upon their completion.

The process of determining what information is accessible to what parties and for what purposes.

A model of cloud computing that utilizes virtualization; clients pay an outsourcer for the resources used.

Immediate communication that can be sent back and forth between users who are currently logged on. From a security standpoint, there are risks associated with giving out information via IM that can be used in social engineering attacks; in addition, attachments sent can contain viruses.

An international organization that sets standards for various electrical and electronics issues.

A term that broadly describes all data and information created, received and/or collected by UC.

Putting too much information into too small of a space that has been set aside for numbers.

An obstruction to the signal.

An information classification stating that the data so classified is limited to internal employees only.

An algorithm that uses a 128-bit key. This product is similar in speed and capability to Digital Encryption Standard (DES), but it’s more secure. IDEA is used in Pretty Good Privacy (PGP).

Organization responsible for communications standards, spectrum management, and the development of communications infrastructures in underdeveloped nations.

The organization responsible for governing IP addresses; its website is www.iana.org.

A message and management protocol for TCP/IP. The Ping utility uses ICMP.

An international organization that works under the Internet Architecture Board to establish standards and protocols relating to the Internet.

The network layer responsible for routing, IP addressing, and packaging.

A protocol with a store-and-forward capability. It can also allow messages to be stored on an email server instead of downloaded to the client.

The protocol in the TCP/IP suite responsible for network addressing.

A set of protocols that enable encryption, authentication, and integrity over IP. IPSec is commonly used with virtual private networks (VPNs) and operates at Layer 3.

A professional membership group composed primarily of Internet experts. It oversees a number of committees and groups, including the Internet Engineering Task Force (IETF).

The act of entering a system without authorization to do so.

Tools that identify and respond to attacks using defined rules or logic. An IDS can be network based or host based.

Penetration-type testing that involves trying to break into the network.

Making the data look as if it came from a trusted host when it didn’t (thus spoofing the IP address of the sending host).

A protocol that enables the creation of storage area networks (SANs) and is used in sending storage-related commands over IP networks.

A term that broadly describes IT infrastructure, software and/or hardware with computing and networking capability. These include, but are not limited to: personal and mobile computing systems and devices, mobile phones, printers, network devices, industrial control systems (SCADA, etc.), access control systems, digital video monitoring systems, data storage systems, data processing systems, backup systems, electronic and physical media, biometric and access tokens and other devices that connect to any UC network. This includes both UC-owned and personally owned devices while they store Institutional Information, are connected to UC systems, are connected to UC Networks or used for UC business.

An attack that involves looking at repeated results in order to crack the WEP secret key.

Purposely obstructing or interfering with a signal.

A policy of rotating employees through various jobs.

The ability of a filesystem to use a log file of all changes and transactions that have occurred within a set period of time (for example, the last few hours). If a crash occurs, the operating system can look at the log files to see what transactions have been committed and which ones have not.

An authentication scheme that uses tickets (unique keys) embedded within messages. Named after the three-headed guard dog that stood at the gates of Hades in Greek mythology.

A principle that states that the security of an algorithm should depend only on the secrecy of the key and not on the secrecy of the algorithm itself.

An organization or facility that generates keys for users and is a part of Kerberos.

An agency that stores keys for the purpose of law-enforcement access.

A method of offering mutual authentication and establishing data encryption keys.

The act of creating keys for use by users.

The temporary deferment of a key for a period of time (such as for a leave of absence).

The wait time between the call for an action or activity and the actual execution of that action.

The concept that access differs at different levels. Often used in discussion with various access models as well as with cryptography to differentiate between security levels based on user/group labels.

A tunneling protocol often used with virtual private networks (VPNs). L2F was developed by Cisco.

A tunneling protocol that adds functionality to the Point-to-Point Protocol (PPP). This protocol was created by Microsoft and Cisco, and it is often used with virtual private networks (VPNs).

Exploiting weaknesses in LDAP (Lightweight Directory Access Protocol) implementations by not properly filtering input. The result can be executed commands, modified content, or results returned to unauthorized queries.

A permission method in which users are granted only the privileges necessary to perform their job function.

The policy of giving a user only the minimum permissions needed to do the work that must be done.

A set of protocols that was derived from X.500 and operates at port 389.

An authentication protocol created by Cisco as an extension to EAP. LEAP is being phased out in favor of PEAP.

Assigning a quantitative number to the chance that something will occur.

Describes information that isn’t intended for release to the public. This category of information isn’t secret, but it’s private.

The protocol used to establish, configure, and test the link between a client and the PPP host.

Dividing a load for greater efficiency of management among multiple devices.

An authority used to identify or establish the identity of an individual for certificate issuance.

A discrete organization or entity governed by the Regents of the University of California. Locations include, but are not limited to: campuses, laboratories, medical centers and health systems, as well as satellite offices, affiliates or other offices in the United States controlled by the Regents of the University of California.

Any code that is hidden within an application and causes something unexpected to happen based on some criteria being met. For example, a programmer could create a program that always makes sure her name appears on the payroll roster; if it doesn’t, then key files begin to be erased.

Limiting network access to a list of the MAC addresses associated with known users’ computers.

A software exploitation virus that works by using the macro feature included in many applications, such as Microsoft Office.

Any code that is meant to do harm.

A threat from someone inside the organization intent on doing harm.

A security policy in which labels are used to identify the sensitivity of objects. When a user attempts to access an object, the label is checked to see if access should be allowed (that is, whether the user is operating at the same sensitivity level). This policy is “mandatory,” because labels are automatically applied to all data (and can be changed only by administrative action), as opposed to “discretionary” policies that leave it up to the user to decide whether to apply a label.

A policy requiring earned vacation time be used or lost.

An attack that occurs when someone/something that is trusted intercepts packets and retransmits them to another party. Man-in-the-middle attacks have also been called TCP/IP hijacking in the past.

A device, such as a small room, that limits access to one or a few individuals. Mantraps typically use electronic locks and other methods to control access.

The measurement of the anticipated incidence of failure of a system or component.

The measurement of the average of how long it takes a system or component to fail.

The measurement of how long it takes to repair a system or component once a failure occurs.

A sublayer of the Data Link layer of the Open Systems Interconnection (OSI) model that controls the way multiple devices use the same media channel. It controls which devices can transmit and when they can transmit.

A trust model that expands the concepts of the bridge model by supporting multiple paths and multiple root certificate authorities.

A common method of verifying integrity. The MAC is derived from the message and a secret key.

The cryptographic hash containing a string of digits within a message.

In a three-tier database model, this server accepts requests from clients, evaluates them, and then sends them on to the database server for processing.

An intrusion detection system that works by detecting misuse.

Residing on more than one network.

A virus that attacks a system in more than one way.

Whenever two or more parties authenticate each other.

An agency (formerly known as the National Bureau of Standards [NBS]) that has been involved in developing and supporting standards for the U.S. government for over 100 years. NIST has become involved in cryptography standards, systems, and technology in a variety of areas. It’s primarily concerned with governmental systems, where it exercises a great deal of influence.

The U.S. government agency responsible for protecting U.S. communications and producing foreign intelligence information. It was established by presidential directive in 1952 as a separately organized agency within the Department of Defense (DoD).

An organization with the purpose of collecting “known, traceable software applications” through their hash values and storing them in a Reference Data Set (RDS) for law enforcement.

Technology that requires a user to bring the client close to the AP in order to verify (often through RFID or Wi-Fi) that the device is present.

An early networking protocol from Microsoft.

The set of standards defined by the network for clients attempting to access it. Usually, NAC requires that clients be virus free and adhere to specified policies before allowing them on the network.

A server that acts as a go-between for clients accessing the Internet. All communications look as if they originated from a proxy server because the IP address of the user making a request is hidden.

The protocol Point-to-Point Protocol (PPP) employs for encapsulating network traffic.

An intrusion prevention system that is network based.

Another term for MAC filtering.

An approach to an intrusion detection system (IDS), it attaches the system to a point in the network where it can monitor and report on all network traffic.

Penetration/vulnerability testing that takes a passive approach rather than actually trying to break into the network.

Making sure the sender can’t repudiate (dispute) sending the data.

A database that is not a relational database and does not use SQL. These databases are less common than relational databases.

Storing data off the premise, usually in a secure location.

An antenna type that receives a signal from all directions.

A database model in which the database and the application exist on a single system.

A type of encryption in which plain text is paired with secret keys and then encrypted. This greatly increases the difficulty of cracking.

A real-time protocol that replaces CRLs to immediately verify a certificate’s authenticity.

Storing backup data at the same site as the servers on which the original data resides.

A firewall technology that accepts or rejects packets based on their content.

The process of looking through message packets to find data.

The computation of parity for a given set of data.

The correct method of extinguishing a fire with an extinguisher: pull, aim, squeeze, and sweep.

A nonactive response, such as logging. Passive response is the most common type of response to many intrusions. In general, passive responses are the easiest to develop and implement.

Attempting to ascertain a password that you should not know.

A fix for a known software problem.

Password-Based Key Derivation Function 2 applies some function (like a hash or HMAC) to the password or passphrase along with Salt to produce a derived key.

Security set up on the outside of the network or server to protect it.

Card required of federal employees and contractors to gain access (physical and logical) to government resources.

Information that can be uniquely used to identify, contact, or locate a single person. Examples include Social Security number, driver’s license number, fingerprints, and handwriting.

A virus that modifies and alters other programs and databases.

A form of redirection in which traffic intended for one host is sent to another.

A form of social engineering in which you simply ask someone for a piece of information that you are missing by making it look as if it is a legitimate request. Commonly sent via email.

A large Internet Control Message Protocol (ICMP) packet sent to overflow the remote host’s buffer. A ping of death usually causes the remote host to reboot or hang.

Standard telephone service, as opposed to other connection technologies like Digital Subscriber Line (DSL).

A cloud service model wherein the consumer can deploy but does not manage or control any of the underlying cloud infrastructure.

When portable data storage devices (such as an iPod) are plugged directly into a machine and used to bypass the network security measures and illicitly download confidential data.

A full-duplex line protocol that supersedes Serial Line Internet Protocol (SLIP). It’s part of the standard TCP/IP suite and is often used in dial-up connections.

An extension to Point-to-Point Protocol (PPP) that is used in virtual private networks (VPNs). An alternative to PPTP is L2TP.

Rules or standards governing usage. These are typically high level in nature.

An attribute of some viruses that allows them to mutate and appear differently each time they crop up. The mutations make it harder for virus scanners to detect (and react) to the viruses.

A means of translating between ports on a public and private network. Similar to Network Address Translation (NAT), which translates addresses between public and private.

Scanning a server for open ports that can be taken advantage of by sending messages to ports to see which ones are available and which ones aren’t.

Connections available within TCP/IP.

An email access program that can be used to retrieve email from an email server.

The protocol used to download email from an SMTP email server to a network client.

Anything that occurs “after the fact,” such as an audit or review.

Controls intended to prevent attacks or intrusions.

A state of security in which information isn’t seen by unauthorized parties without the express permission of the party involved.

Screens that restrict viewing of monitors to only those sitting in front of them.

A cloud delivery model owned and managed internally.

An asymmetric encryption technology in which both the sender and the receiver have different keys. A public key is used to encrypt messages and the private key is used to decrypt them. See also public key.

The result when a user obtains access to a resource they wouldn’t normally be able to access. Privilege escalation can be done inadvertently, by running a program with Set User ID (SUID) or Set Group ID (SGID) permissions or by temporarily becoming another user (via su or sudo in Unix/Linux or RunAs in Windows). It can also be done purposefully by an attacker seeking full access.

The likelihood of something occurring.

A mode wherein a network interface card (NIC) intercepts all traffic crossing the network wire and not just the traffic intended for it.

A network in which physical network security has been substituted for encryption security.

An authentication protocol that replaces LEAP and for which there is native support in Windows.

A software and hardware troubleshooting tool that is used to decode protocol information to try to determine the source of a network problem and to establish baselines.

Cards that can be read by being near a reader.

Readers capable of working with proximity cards.

A type of system that prevents direct communication between a client and a host by acting as an intermediary.

A proxy server that also acts as a firewall, blocking network access from external networks.

A type of server that makes a single Internet connection and services requests on behalf of many users.

Cameras that can pan, tilt, and zoom.

A cloud delivery model available to others.

A technology that facilitates encryption using two keys—a public key and a private key—to facilitate communication. The public key is used to encrypt a message to a receiver. See also private key.

A set of voluntary standards created by RSA security and industry security leaders.

A two-key encryption system wherein messages are encrypted with a private key and decrypted with a public key.

The Internet Engineering Task Force (IETF) working group developing standards and models for the Public Key Infrastructure (PKI) environment. The most current version is v3.

A collection of technologies that provide the ability to balance network traffic and prioritize workloads.

Used in risk management, it involves measuring the quality of something (as opposed to the quantity).

Numerically measuring the quantity of something (as opposed to the quality).

Cryptography based on changing the polarity of a photon. Quantum cryptography makes the process of interception difficult because any attempt to intercept the message changes the value of the message.

The byproduct of electrical processes, similar to electromagnetic interference. The major difference is that RFI is usually projected across a radio spectrum.

A table of hashed phrases/words that can be used in a password attack.

Software that demands payment before restoring the data or system infected.

Short Term Recommendations
Items associated with this period are typically risks where remediation can be addressed quickly with current staffing levels. Examples include defining and documenting security policies & procedures, user training, and continuation of assessment processes.

Mid-Term Recommendations
Items associated with this period are typically risks where remediation will require additional staffing or minor technology investments. These include expansion of the risk management program to include assessments of technologies or organizations that were not included in this scope or with new and expanded techniques. Examples include web application testing, mobile code analysis, complete network vulnerability analysis, and external penetration testing.
Additionally, process improvements or integrations with other organizations such as procurement will require discussion, collaboration on defining workflow, and improving staffing levels to support new services. Examples include implementing vendor risk assessment into the procurement lifecycle.

Long Term Recommendations
Items associated with this period are typically risks where remediation will require significant staffing or technology investments. Remediation activities will likely require a funded project, enterprise collaboration and involvement, and only occur after the next full capital funding cycle.

Within business continuity planning, this is the point of maximum tolerable loss for a system due to a major incident.

The maximum amount of time that a process or service is allowed to be down and the consequences still to be considered acceptable.

A configuration of multiple hard disks used to provide fault tolerance should a disk fail. Different levels of RAID exist.

An organization that offloads some of the work from a certificate authority (CA). An RA system operates as a middleman in the process. The RA can distribute keys, accept registrations for the CA, and validate identities. The RA doesn’t issue certificates; that responsibility remains with the CA.

A database technology that allows data to be viewed in dynamic ways based on the user’s or administrator’s needs.

A computer that has one or more connections installed to enable remote connections to the network.

A networking protocol that allows authentication of dial-in and other network connections. RADIUS is commonly used by Internet service providers (ISPs) and in the implementation of virtual private networks (VPNs).

A protocol used to allow remote desktop connections.

A programming interface that allows a remote computer to run programs on a local machine.

The process of sending a command to remotely clear data.

An attack that captures portions of a session to play back later to convince a host that it is still talking to the original connection.

A database or database server where the certificates are stored.

A document-creation process and a set of practices that originated in 1969 and is used for proposed changes to Internet standards.

Information that isn’t made available to all and to which access is granted based on some criteria.

A virus that attacks or bypasses the antivirus software installed on a computer.

A strategy of dealing with risk in which it is decided the best approach is simply to accept that the risk exists.

An evaluation of each risk that can be identified. Each risk should be outlined, described, and evaluated on the likelihood of it occurring.

An evaluation of how much risk you and your organization are willing to take. An assessment must be performed before any other actions—such as how much to spend on security in terms of dollars and manpower—can be decided.

A strategy of dealing with risk in which it is decided that the best approach is to avoid the risk.

The process of calculating the risks that exist.

A strategy of dealing with risk in which it is decided that the best approach is to discourage potential attackers from engaging in the behavior that leads to the risk.

A strategy of dealing with risk in which it is decided that the best approach is to lessen the risk.

A strategy of dealing with risk in which it is decided that the best approach is to offload some of the risk.

An unauthorized wireless access point on a network.

A form of malware that tries to convince the user to pay for a fake threat.

A type of control wherein the levels of security closely follow the structure of an organization. The role the person plays in the organization (accountant, salesman, and so on) corresponds to the level of security access they have to data.

Software program that has the ability to obtain root-level access and hide certain things from the operating system.

A device that connects two or more networks and allows packets to be transmitted and received between them. A router determines the best path for data packets from source to destination.

The current Microsoft server service for Windows-based clients that offers the ability to connect to remote systems.

One of the providers of cryptography systems to industry and government. RSA stands for the initials of the three founders of RSA Security Inc.: Rivest, Shamir, and Adleman. RSA maintains a list of standards for Public Key Cryptography Standards (PKCS).

Access control method that uses the settings in preconfigured security policies to make all decisions.

A separate network set up to appear as a server to the main organizational network.

Isolating applications to keep users of them from venturing to other data.

Software that tries to convince unsuspecting users that a threat exists.

The section of a guideline that provides an overview and statement of the guideline’s intent.

The portion of the policy outlining what it intends to accomplish and which documents, laws, and practices the policy addresses.

A replacement for FTP that allows secure copying of files from one host to another.

A protocol developed by Visa and MasterCard for secure credit card transactions. The protocol is becoming an accepted standard by many companies. SET provides encrypted credit card numbers over the Internet, and it’s most suited to small amounts of data transmission.

A one-way hash algorithm designed to ensure the integrity of a message.

A protocol used for secure communications between a web server and a web browser.

A protocol used for secure communications between email servers.

A replacement for rlogin in Unix/Linux that includes security. rlogin allowed one host to establish a connection with another with no real security being employed; SSH replaces it with slogin and digital certificates.

A protocol that secures messages by operating between the Application layer (HTTP) and the Transport layer.

Looking for weaknesses through interviews, examinations, and testing of systems.

Policies related to security.

A piece of data that contains the rights and access privileges of the token bearer as part of the token.

A method of isolating a system from other systems or networks.

The IDS component that collects data from the data source and passes it to the analyzer for analysis.

Operating system updates from Microsoft.

UC groups or organizations providing specific IT services to a Unit.

An agreement that specifies performance requirements for a vendor. This agreement may use mean time before failure (MTBF) and mean time to repair (MTTR) as performance measures in the SLA.

Protective coating around wiring often intended to protect it from interference.

Watching someone when they enter their username, password, or sensitive data.

The process of ignoring an attack.

A system that acts based on the digital signature it sees.

A protocol for sending email between SMTP servers.

The management protocol created for sending information about the health of the network-to-network management consoles.

The cost of a single loss when it occurs. This loss can be a critical failure, or it can be the result of an attack.

A weakness that brings a system down.

A relationship between the client and the network wherein the client is allowed to log on one time, and all resource access is based on that logon (as opposed to needing to log on to each individual server to access the resources there).

Authentication based on a single factor (a password, for example).

A database model in which the database and the application exist on a single system.

A generic site survey involves listening in on an existing wireless network using commercially available technologies. A wireless site survey, or wireless survey, is the process of planning and designing a wireless network, in particular an 802.11 network.

A physical card used for access control and security purposes. The card itself usually contains a small amount of memory that can be used to store permissions and access information.

An attack in which large volumes of ICMP echo requests (pings) are broadcast to all other machines on the network and in which the source address of the broadcast system has been spoofed to appear as though it came from the target computer. When all of the machines that received the broadcast respond, they flood the target with more data than it can handle.

Image of a virtual machine at a moment in time.

A physical device that listens in (sniffs) on network traffic and looks for items it can make sense of. There is a legitimate purpose for these devices: Administrators use them to analyze traffic. However, when they’re used by sources other than the administrator, they become security risks.

Analyzing data to look for passwords and anything else of value. Sniffing is also known as wiretapping, eavesdropping, packet sniffing, and network sniffing, among other terms.

An attack that uses others by deceiving them. It does not directly target hardware or software but instead targets and manipulates people.

A model of cloud computing in which the consumer can use the provider’s applications but they do not manage or control any of the underlying cloud infrastructure.

Unwanted, unsolicited email sent in bulk.

Filters that try to eliminate unwanted, unsolicited email sent in bulk.

A form of phishing in which the message is made to look as if it came from someone you know and trust as opposed to an informal third party.

An attempt by someone or something to masquerade as someone/something else.

Software programs that work—often actively—on behalf of a third party.

A replacement for FTP that allows secure copying of files from one host to another.

An access point’s broadcasting of the network name.

Derived from policies, a standard deals with specific issues or aspects of a business.

Inspections that occur at all levels of the network and provide additional security using a state table that tracks every communications channel.

A virus that attempts to avoid detection by masking itself from applications.

The science of hiding information within other information, such as a picture.

A method of encryption that encrypts streams of data rather than blocks.

A database language that allows queries to be configured in real time and passed to database servers.

Using subnet values to divide a network into smaller segments.

A method of encryption in which one letter or item is substituted for another.

An outline of those internal to the organization who have the ability to step into positions when they open.

An external, third-party entity that provides goods or services to UC.

A network device that can replace a router or hub in a local network and get data from a source to a destination. Switching allows for higher speeds.

The keys used when the same key encrypts and decrypts data.

A snapshot of what exists.

An exercise that involves individuals sitting around a table with a facilitator discussing situations that could arise and how best to respond to them.

Following someone through an entry point.

Controls that rely on technology.

A protocol that functions at the Application layer of the OSI model, providing terminal emulation capabilities.

A wrapper that works with wireless encryption to strengthen WEP implementations. It was designed to provide more secure encryption than the notoriously weak Wired Equivalent Privacy (WEP).

An authentication system that allows credentials to be accepted from multiple methods, including Kerberos. The TACACS client-server process occurs in the same manner as the Remote Authentication Dial-In User Service (RADIUS) process.

Any perceivable risk’s area of attack.

A database model that effectively isolates the end user from the database by introducing a middle server.

A form of trust relationship often used between domains.

Trust gained because one party (A) trusts another party (B), which then trusts another party (C). Since (B) trusts (C), then a relationship can exist where the first party (A) also may trust the third party (C).

The protocol found at the Host-to-Host layer of the Department of Defense (DoD) model. This protocol breaks data packets into segments, numbers them, and sends them in order. The receiving computer reassembles the data so that the information is readable for the user. In the process, the sender and the receiver confirm that all data has been received; if not, it’s resent. TCP is a connection-oriented protocol. See also connection-oriented protocol.

A protocol whose purpose is to verify that secure communications between a server and a client remain secure. Defined in RFC 2246. 

An encryption method that involves transposing or scrambling the letters in a certain manner.

A symmetric block cipher algorithm used for encryption.

A UDP-based protocol similar to FTP that doesn’t provide the security or error-checking features of FTP.

Any application that masquerades as one thing in order to get past scrutiny and then does something malicious. One of the major differences between Trojan horses and viruses is that Trojan horses tend not to replicate themselves.

Any operating system that meets the government’s requirements for security.

A method of using encryption and storing the passwords on a chip. The hardware holding the chip is then needed to unencrypt the data and make it readable.

The act of sending data across a public network by encapsulating it into other packets.

Using two access methods as a part of the authentication process.

A database model in which the client workstation or system runs an application that communicates with the database that is running on a different server.

Virtualization method that is independent of the operating system and boots before the OS.

Virtualization method that is dependent on the operating system.

Creating domains that are based on the misspelling of another.

A device that can provide short-term power, usually by using batteries.

A point of accountability and responsibility that results from creating/collecting or managing/possessing Institutional Information or installing/managing IT Resources. A Unit is typically a defined organization or set of departments.

A generic term for dean, vice chancellor or person in a similarly senior role who has the authority to allocate budget and is responsible for Unit performance and administration. At a particular Location or in a specific situation, the following senior roles may also be Unit Heads: department chairs, assistant/associate vice chancellor (AVC), principal investigators, directors or senior managers.

A term for the Workforce Member(s) assigned responsibility for tactical execution of information security activities including, but not limited to: implementing security controls; reviewing and updating Risk Assessments and Risk Treatment Plans; devising procedures for the proper handling, storing and disposing of electronic media within the Unit; and reviewing access rights. These activities are performed in consultation with the Unit Head.

Registering domains that are similar to those for a known entity but based on a misspelling or typographical error.

The protocol at the Host-to-Host layer of the TCP/IP Department of Defense (DoD) model, which corresponds to the Transport layer of the OSI model. Packets are divided into datagrams, given numbers, sent, and put back together at the receiving end. UDP is a connectionless protocol.

Eavesdropping on CRT and LCD displays by detecting their electromagnetic emissions.

A multialphabet substitution cipher.

A local area network (LAN) that allows users on different switch ports to participate in their own network, separate from but still connected to the other stations on the same or a connected switch.

A system that uses the public Internet as a backbone for a private interconnection (network) between locations.

Emulating one or more physical computers on the same host.

A program intended to damage a computer system.

Combining phishing with Voice over IP (VoIP).

The amount of time that you have to collect certain data before a window of opportunity is gone.

Identifying specific vulnerabilities in your network.

Markings left, often written in chalk, by those who discover a vulnerability that provides a way into the wireless network.

Driving around with a laptop looking for open wireless access points with which to communicate.

A site that provides some capabilities in the event of a disaster. The organization that wants to use a warm site will need to install, configure, and reestablish operations on systems that might already exist in the warm site.

Identifying a site that is visited by those that they are targeting, poisoning that site, and then waiting for the results.

A firewall that can look at every request between a web client and a web server and identify possible attacks.

Another term for social engineering.

Phishing only large accounts.

A wireless network operating in the 2.4 GHz or 5 GHz range.

The second version of WPA.

An authentication process that requires the user to do something in order to complete the enrollment process. Examples include pressing a button on the router within a short time period, entering a PIN, or bringing the new device close.

A Microsoft API used to interact with TCP/IP.

A security protocol for 802.11b (wireless) networks that attempts to establish the same security for them as would be present in a wired network.

A connection device used for clients in a radio frequency (RF) network.

Technology designed for use with wireless devices.

Language used for Internet displays. WAP-enabled devices can also respond to scripts using WMLScript.

The security layer of the Wireless Applications Protocol (WAP). WTLS provides authentication, encryption, and data integrity for wireless devices.

A person who supervises/manages other personnel or approves work or research on behalf of the University.

An employee, faculty, staff, volunteer, contractor, researcher, student worker, student supporting/performing research, medical center staff/personnel, clinician, student intern, student volunteer or person.

The copy of the data currently in use on a network.

An association concerned with interoperability, growth, and standardization of the World Wide Web (WWW). This group is the primary sponsor of XML and other web-enabled technologies.

The working group formed by the IETF to develop standards and models for the PKI environment.

An advanced attack that tries to get around detection and send a packet with every single option enabled.

A specification designed to allow XMLbased programs access to PKI services.

An attack that begins the very day an exploit is discovered.

Any system taking directions from a master control computer. Zombies are often used in distributed denial-of-service (DDoS) and botnet attacks.

The IEEE standard that defines port-based security for wireless network access control.