Browse Definitions :

Security

Terms related to security management, including definitions about intrusion detection systems (IDS) and words and phrases about asset management, security policies, security monitoring, authorization and authentication.

802 - CLO

  • 802.11x - 802.11x refers to a group of evolving wireless local area network (WLAN) standards that are under development as elements of the IEEE 802.
  • AAA server (authentication, authorization, and accounting) - An AAA server is a server program that handles user requests for access to computer resources and, for an enterprise, provides authentication, authorization, and accounting (AAA) services.
  • acceptable use policy (AUP) - An acceptable use policy (AUP) is a policy that a user must agree to follow in order to be provided with access to a network or to the Internet.
  • access control - Access control is a security technique that regulates who or what can view or use resources in a computing environment.
  • access governance (AG) - Access governance (AG) is an aspect of information technology (IT) security management that seeks to reduce the risks associated with excessive access rights, inactive users and orphan accounts.
  • access list (AL) - An access list (AL) is a list of permissions used in physical and information technology (IT) security to control who is allowed contact with a corporate asset.
  • access recertification - Access recertification is an information technology (IT) control that involves auditing user access rights to determine if they are correct and adhere to the organization’s internal policies and compliance regulations.
  • ACF2 or CA-ACF2 (Access Control Facility) - ACF2 (more formally, CA-ACF2; the ACF stands for Access Control Facility) is a set of programs from Computer Associates that enable security on mainframes.
  • Active Directory Certificate Services (AD CS) - Active Directory Certificate Services (AD CS) is an Active Directory tool that lets administrators customize services in order to issue and manage public key certificates.
  • Active Directory domain (AD domain) - An Active Directory domain is a collection of objects within a Microsoft Active Directory network.
  • Active Directory tree (AD tree) - An Active Directory tree is a collection of domains within a Microsoft Active Directory network.
  • active man-in-the-middle attack (MitM) - Active man-in-the-middle (MitM) is an attack method that allows an intruder to access sensitive information by intercepting and altering communications between the user of a public network and a requested website.
  • air gapping (air gap attack) - Air gapping is a security measure that involves physically isolating a computer or network and preventing it from establishing an external connection.
  • alert fatigue - Alert fatigue, also called alarm fatigue, is an instance where an overwhelming number of alerts causes an individual to become desensitized to them.
  • Amazon Inspector - Amazon Inspector is an AWS tool that automatically assesses a customer's AWS cloud deployment for security vulnerabilities and deficiencies.
  • Amazon Web Services (AWS) Identity and Access Management (IAM) - Amazon Web Services (AWS) Identity and Access Management (IAM) is a directory service designed for tracking system users and providing ways of keeping track of information about how they get authenticated.
  • Anna Kournikova virus VBS.SST - The Anna Kournikova VBS.
  • antimalware (anti-malware) - Antimalware is a type of software program created to protect IT systems and individual computers from malicious software, or malware.
  • antivirus software (antivirus program) - Antivirus software is a class of program designed to prevent, detect and remove malware infections on individual computing devices, networks and IT systems.
  • application blacklisting - Application blacklisting, sometimes just referred to as blacklisting, is a network administration practice used to prevent the execution of undesirable programs.
  • application whitelisting - Application whitelisting is the practice of specifying an index of approved software applications or executable files that are permitted to be present and active on a computer system.
  • attack surface - An attack surface is the total sum of the vulnerabilities that can be used to carry out a security exploit.
  • attack vector - An attack vector is a path or means by which an attacker or hacker can gain access to a computer or network server in order to deliver a payload or malicious outcome.
  • authentication - Authentication is the process of determining whether someone or something is, in fact, who or what it declares itself to be.
  • authentication server - An authentication server is an application that facilitates authentication of an entity that attempts to access a network.
  • authentication ticket or ticket-granting ticket (TGT) - An authentication ticket, also known as a ticket-granting ticket (TGT), is a small amount of encrypted data that is issued by a server in the Kerberos authentication model to begin the authentication process.
  • authentication, authorization, and accounting (AAA) - Authentication, authorization, and accounting (AAA) is a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to bill for services.
  • authorization - Authorization is the process of giving someone permission to do or have something.
  • Automated Fingerprint Identification System (AFIS) - The Automated Fingerprint Identification System (AFIS) is a biometric identification (ID) methodology that uses digital imaging technology to obtain, store, and analyze fingerprint data.
  • Automatic Identification and Data Capture (AIDC) - Automatic Identification and Data Capture (AIDC) is a broad set of technologies used to collect information from an object, image or sound without manual data entry.
  • AV storm - An AV storm is the performance degradation that occurs when antivirus software simultaneously scans multiple virtual machines (VMs) on a single physical host.
  • backdoor (computing) - A backdoor is a means to access a computer system or encrypted data that bypasses the system's customary security mechanisms.
  • Bayesian filter - A Bayesian filter is a program that uses Bayesian logic, also called Bayesian analysis, to evaluate the header and content of an incoming e-mail message and determine the probability that it constitutes spam.
  • behavior-based security - Behavior-based security software scans for deviations from the norm and decides whether an anomaly poses a threat or can simply be ignored.
  • bimodal IAM (bimodal identity access management) - Bimodal identity and access management (IAM) uses two forms of credentials, internal and external, as a method of authentication.
  • biometric payment - Biometric payment is a point of sale technology in which a customer submits biometric data, such as a fingerprint, to authorize the deduction of funds from a bank account.
  • biometric verification - Biometric verification is any means by which a person can be uniquely identified by evaluating one or more distinguishing biological traits.
  • BIOS attack - A BIOS attack is an exploit that infects the BIOS with malicious code and is persistent through reboots and attempts to reflash the firmware.
  • BIOS rootkit - A BIOS-level rootkit is programming that exists in a system's memory hardware to enable remote administration.
  • BitLocker - BitLocker is an operating system-level extension to Vista that combines on-disk encryption and special key management techniques.
  • black hat - Black hat refers to a hacker who breaks into a computer system or network with malicious intent.
  • blended threat - A blended threat is an exploit that combines elements of multiple types of malware and perhaps takes multiple attack vectors to increase the severity of damage and the speed of contagion.
  • block cipher - A block cipher is a method of encrypting data in blocks to produce ciphertext using a cryptographic key and algorithm.
  • Blowfish - Blowfish is an encryption algorithm that can be used as a replacement for the DES or IDEA algorithms.
  • blue pill rootkit - The blue pill rootkit is malware that executes as a hypervisor to gain control of computer resources.
  • BlueKeep (CVE-2019-0708) - BlueKeep (CVE-2019-0708) is a vulnerability in the Remote Desktop (RDP) protocol that affects Windows 7, Windows XP, Server 2003 and 2008.
  • bluesnarfing - Bluesnarfing is the theft of information from a wireless device through a Bluetooth connection.
  • bot worm - A bot worm is a self-replicating malware program that resides in current memory, turns infected computers into zombies (or bots) and transmits itself to other computers.
  • botnet - A botnet is a collection of internet-connected devices, which may include personal computers (PCs), servers, mobile devices and internet of things (IoT) devices, that are infected and controlled by a common type of malware, often unbeknownst to their owner.
  • breach detection system (BDS) - Breach detection systems (BDS) are a category of applications and security devices designed to detect the activity of malware inside a network after a breach has occurred.
  • Bring Your Own Authentication (BYOA) - Bring Your Own Authentication (BYOA) is a computing concept in which employee-owned devices are used as authentication credentials within the enterprise.
  • browser hijacker (browser hijacking) - A browser hijacker is a malware program that modifies web browser settings without the user's permission and redirects the user to websites the user had not intended to visit.
  • browser virtualization (in desktop virtualization) - Virtualizing a browser helps companies run mission-critical applications in legacy browsers.
  • brute force attack - Brute force (also known as brute force cracking) is a trial and error method used by application programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort (using brute force) rather than employing intellectual strategies.
  • buffer overflow - A buffer overflow occurs when a program or process attempts to write more data to a fixed-length block of memory, or buffer, than the buffer is allocated to hold.
  • Bugbear - Bugbear is a computer virus that spread in early October, 2002, infecting thousands of home and business computers.
  • business continuity management (BCM) - Business continuity management (BCM) is a framework for identifying an organization's risk of exposure to internal and external threats.
  • business counterintelligence (business CI) - Business counterintelligence (business CI) is the collective efforts designed to protect an organization’s sensitive information from unauthorized access.
  • business event management - Business event management is the practice of incorporating business logic into labeling events, communicating events and handling events.
  • business risk - A risk, in a business context, is anything that threatens an organization's ability to generate profits at its target levels.
  • BYOE (bring your own encryption) - BYOE (bring your own encryption) is a cloud computing security model that allows cloud service customers to use their own encryption software and manage their own encryption keys.
  • cache poisoning (DNS poisoning, web cache poisoning) - Cache poisoning is an attack vector that exploits the way domain name system (DNS) clients and web servers improve performance by saving old responses for a specified period of time in a temporary storage area called cache.
  • canvas fingerprinting (CPF) - Canvas fingerprinting (CPF) is a surreptitious online user tracking technique that relies on minute differences in text or images drawn on command by users’ browsers.
  • captive portal - A captive portal is a Web page that the user of a public-access network is obliged to view and interact with before access is granted.
  • cardholder data environment (CDE) - A cardholder data environment or CDE is a computer system or networked group of IT systems that processes, stores and/or transmits cardholder data or sensitive payment authentication data, as well as any component that directly connects to or supports this network.
  • CCTV (closed circuit television) - CCTV (closed-circuit television) is a television system in which signals are not publicly distributed but are monitored, primarily for surveillance and security purposes.
  • Center for Internet Security (CIS) - The Center for Internet Security (CIS) is a nonprofit organization focused on improving public- and private-sector cybersecurity readiness and response.
  • CERT-In (the Indian Computer Emergency Response Team) - CERT-In (the Indian Computer Emergency Response Team) is a government-mandated information technology (IT) security organization.
  • certificate authority (CA) - A certificate authority (CA) is a trusted entity that issues Secure Sockets Layer (SSL) certificates.
  • certificate revocation list (CRL) - A certificate revocation list (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their actual or assigned expiration date.
  • certification - In information technology as in other fields such as teaching, accounting, and acupuncture, certification is a formal process of making certain that an individual is qualified in terms of particular knowledge or skills.
  • Certified in Risk and Information Systems Control (CRISC) - Certified in Risk and Information Systems Control (CRISC) is a certification program that recognizes knowledge and training in the field of risk management for IT.
  • Certified in the Governance of Enterprise IT (CGEIT) - Certified in the Governance of Enterprise IT (CGEIT) is a vendor-neutral certification for experienced tech professionals looking to expand their knowledge and skills in enterprise information technology (IT) governance.
  • Certified Information Security Manager (CISM) - Certified Information Security Manager (CISM) is an advanced certification which indicates that an individual possesses the knowledge and experience required to develop and manage an enterprise information security (infosec) program.
  • Certified Information Systems Auditor (CISA) - The Certified Information Systems Auditor (CISA) is a certification and globally recognized standard for appraising an IT auditor's knowledge, expertise and skill in assessing vulnerabilities and instituting IT controls in an enterprise environment.
  • Certified Information Systems Security Professional (CISSP) - Certified Information Systems Security Professional (CISSP) is an information security certification developed by the International Information Systems Security Certification Consortium, also known as (ISC)².
  • CESG Good Practice Guides (GPG) - Good Practice Guides (GPG) are documents created by the CESG, which provides guidance on aspects of information assurance (IA) to help organisations manage risk effectively.
  • channel partner portal - A channel partner portal is a web-based application that provides a vendor's established partners (usually distributors, resellers, service providers or other strategic partners) with access to deal registration, marketing resources, pricing and sales information for products and services, as well as technical details and support that are unavailable to other end users.
  • Chernobyl virus - The Chernobyl virus is a computer virus with a potentially devastating payload that destroys all computer data when an infected file is executed.
  • chief integration officer (CIO) - A chief integration officer (CIO) is a corporate executive in charge of ensuring the coordination of all interacting systems within the enterprise and its extended environments.
  • chief risk officer (CRO) - The chief risk officer (CRO) is the corporate executive tasked with assessing and mitigating significant competitive, regulatory and technological threats to an enterprise's capital and earnings.
  • Chip and PIN - Chip and PIN is a UK government-backed initiative to implement the EMV (Europay, Mastercard and Visa) standard for smart card payment authorization.
  • cipher - In cryptology, the discipline concerned with the study of cryptographic algorithms, a cipher is an algorithm for encrypting and decrypting data.
  • cipher block chaining (CBC) - Cipher block chaining (CBC) is a mode of operation for a block cipher -- one in which a sequence of bits are encrypted as a single unit, or block, with a cipher key applied to the entire block.
  • CipherCloud - CipherCloud is a vendor that provides a cloud access security broker (CASB) platform, along with a number of security services, aimed at helping organizations secure their cloud-based applications.
  • ciphertext - Ciphertext is encrypted text transformed from plaintext using an encryption algorithm.
  • ciphertext feedback (CFB) - Ciphertext feedback (CFB) is a mode of operation for a block cipher.
  • Cisco Certified Security Professional (CCSP) - A Cisco Certified Security Professional (CCSP) is an IT (Information Technology) professional who has received formal training from Cisco Systems in network-related security hardware, software and management.
  • CISO (chief information security officer) - The CISO (chief information security officer) is a senior-level executive responsible for developing and implementing an information security program, which includes procedures and policies designed to protect enterprise communications, systems and assets from both internal and external threats.
  • CISO as a service (vCISO, virtual CISO, fractional CISO) - A CISO as a service (CISOaaS) is the outsourcing of CISO (chief information security officer) and information security leadership responsibilities to a third-party provider.
  • Class C2 - Class C2 is a security rating established by the U.
  • clean desk policy (CDP) - A clean desk policy (CDP) is a corporate directive that specifies how employees should leave their working space when they leave the office.
  • clickjacking (user-interface or UI redressing and IFRAME overlay) - Clickjacking (also known as user-interface or UI redressing and IFRAME overlay) is an exploit in which malicious coding is hidden beneath apparently legitimate buttons or other clickable content on a website.
  • cloak of invisibility - A cloak of invisibility is a method of rendering physical objects undetectable or invisible.
  • closed circuit television (CCTV) - CCTV (closed-circuit television) is a TV system in which signals are not publicly distributed but are monitored, primarily for surveillance and security purposes.
  • cloud access security broker (CASB) - A cloud access security broker (CASB) is a software tool or service that sits between an organization's on-premises infrastructure and a cloud provider's infrastructure.
  • cloud encryption (cloud storage encryption) - Cloud encryption is a service offered by cloud storage providers whereby a customer's data is transformed using encryption algorithms into ciphertext and stored in the cloud.
  • Cloud Security Alliance (CSA) - The Cloud Security Alliance (CSA) is a nonprofit organization that promotes research into best practices for securing cloud computing and the use of cloud technologies to secure other forms of computing.
  • cloud security architecture - Cloud security architecture is a security strategy designed around securing an organization's data and applications in the cloud.
  • CloudAudit - CloudAudit is a specification for the presentation of information about how a cloud computing service provider addresses control frameworks.
SearchCompliance
  • OPSEC (operations security)

    OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines ...

  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

SearchSecurity
  • COBIT

    COBIT is an IT governance framework for businesses wanting to implement, monitor and improve IT management best practices.

  • email spam

    Email spam, also known as junk email, refers to unsolicited email messages, usually sent in bulk to a large list of recipients.

  • security policy

    A security policy is a document that states in writing how a company plans to protect its physical and information technology (IT...

SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

SearchStorage
  • bare-metal restore

    A bare-metal restore (also referred to as bare-metal recovery or bare-metal backup) is a data recovery and restoration process ...

  • mSATA SSD (mSATA solid-state drive)

    An mSATA SSD is a solid-state drive (SSD) that conforms to the mSATA interface specification developed by the Serial ATA (SATA) ...

  • network-attached storage (NAS)

    Network-attached storage (NAS) is dedicated file storage that enables multiple users and heterogeneous client devices to retrieve...

Close