Security

Terms related to security management, including definitions about intrusion detection systems (IDS) and words and phrases about asset management, security policies, security monitoring, authorization and authentication.

MAL - PIN

malware - Malware, or malicious software, is any program or file that is intentionally harmful to a computer, network or server.
Malware Analysis Report (MAR) - Malware Analysis Report (MAR) is a document that relates the functionality and effects of a given piece of malware.
man-in-the-middle attack (MitM) - A man-in-the-middle attack is one in which the attacker secretly intercepts and relays messages between two parties who think they are communicating directly with each other.
managed file transfer (MFT) - Managed file transfer (MFT) is a type of software used to provide secure internal, external and ad-hoc data transfers through a network.
mandatory access control (MAC) - Mandatory access control (MAC) is a system-controlled policy restricting access to resource objects (such as data files, devices, systems, etc.
mantrap (interlocking door controller) - A mantrap is a small room with an entry door on one wall and an exit door on the opposite wall.
Massachusetts data protection law - What is the Massachusetts data protection law?The Massachusetts data protection law is legislation that stipulates security requirements for organizations that handle the private data of residents.
MD5 - The MD5 (message-digest algorithm) hashing algorithm is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length digest value to be used for authenticating the original message.
Melissa virus - Melissa is a fast-spreading macro virus that is distributed as an e-mail attachment that, when opened, disables a number of safeguards in Word 97 or Word 2000, and, if the user has the Microsoft Outlook e-mail program, causes the virus to be resent to the first 50 people in each of the user's address books.
message authentication code (MAC) - A message authentication code (MAC) is a cryptographic checksum on data that uses a session key to detect both accidental and intentional modifications of the data.
metadata security - Metadata is defined as “data about data.
MICR (magnetic ink character recognition) - MICR (magnetic ink character recognition) is a technology used to verify the legitimacy or originality of paper documents, especially checks.
micro VM (micro virtual machine) - A micro VM (micro virtual machine) is a virtual machine program that serves to isolate an untrusted computing operation from a computer's host operating system.
micro-virtualization - Micro-virtualization is technology that abstracts applications and sub-processes from hardware and runs them in isolated environments.
micropayment - A micropayment is an e-commerce transaction involving a very small sum of money in exchange for something made available online, such as an application download, a service or Web-based content.
Microsoft Active Directory Rights Management Services (AD Rights Management Services) - Active Directory Rights Management Services (AD RMS) is a security tool that provides a safeguard to prevent unauthorized access to data.
Microsoft Antigen - Microsoft Antigen is a set of programs that provides security and e-mail filtering for network servers.
Microsoft AzMan (Microsoft Authorization Manager) - Microsoft AzMan (Authorization Manager) is a role-based access and security framework for .
Microsoft Dynamic Access Control (DAC) - Microsoft Dynamic Access Control (DAC) is a data governance tool in Windows Server 2012 that lets admins control the permission of access settings in an organization.
Microsoft Network Access Protection (NAP) - Network access protection (NAP), introduced with Windows Server 2008, is Microsoft’s approach to controlling access to a network based on a determination of each device’s health.
Microsoft Network Device Enrollment Service (NDES) - Microsoft Network Device Enrollment Service (NDES) is a security feature in Windows Server 2008 R2 and later Windows Server operating versions.
Microsoft Online Services Sign-In Assistant - The Microsoft Online Services Sign-In Assistant is a software application that provides common sign-on capabilities for a suite of Microsoft online services, such as Office 365.
Microsoft Security Configuration Wizard (SCW) - Microsoft Security Configuration Wizard (SCW) is an administrative tool used to change the default security settings on a server and to apply a security policy on multiple servers.
Microsoft System Center Mobile Device Manager (MSCMDM) - Microsoft System Center Mobile Device Manager (MSCMDM) is server-based software that allows enterprise IT professionals to manage and automate tasks for Windows Mobile devices.
Microsoft Windows Server 2012 Remote Access - Remote Access is a Windows Server 2012 and Windows Server 2012 R2 feature that combines DirectAccess, Routing and Remote Access Service features.
Microsoft Windows Update Agent - Microsoft Windows Update Agent is a tool that can work in conjunction with Windows Server Update Services on each client computer in an enterprise that checks for available updates.
MITRE ATT&CK framework - The MITRE ATT&CK (pronounced 'miter attack') framework is a free, globally accessible service that provides comprehensive and up-to-date cyberthreat information to organizations looking to strengthen their cybersecurity strategies.
Mobile Active Defense (MAD) - Mobile Active Defense’s main product is the Mobile Enterprise Compliance and Security Server (MECS).
Mobile Application Management (MAM) - Mobile application management (MAM) is software that secures and enables IT control over enterprise applications on end users' corporate and personal smartphones and tablets.
mobile malware - Mobile malware is malicious software specifically written to attack mobile devices such as smartphones, tablets, and smartwatches.
mobile security certification - A mobile security certification is a formalized program that verifies the participant’s competency in tasks related to mobile security and administration.
multifactor authentication (MFA) - Multifactor authentication (MFA) is a security technology that requires more than one method of authentication from independent categories of credentials to verify a user's identity for a login or other transaction.
mutual authentication - Mutual authentication, also called two-way authentication, is a process or technology in which both entities in a communications link authenticate each other.
national identity card - A national identity card is a portable document, typically a plasticized card with digitally-embedded information, that someone is required or encouraged to carry as a means of confirming their identity.
National Vulnerability Database (NVD) - NVD (National Vulnerability Database) is a product of the National Institute of Standards and Technology (NIST) Computer Security Division and is used by the U.
NBAR (Network Based Application Recognition) - Network Based Application Recognition (NBAR) is a mechanism that classifies and regulates bandwidth for network applications to ensure that available resources are utilized as efficiently as possible.
Near Field Communication (NFC) - Near Field Communication (NFC) is a short-range wireless connectivity standard (Ecma-340, ISO/IEC 18092) that uses magnetic field induction to enable communication between devices when they're touched together, or brought within a few centimeters of each other.
Nessus - Nessus is an open-source network vulnerability scanner that uses the Common Vulnerabilities and Exposures architecture for easy cross-linking between compliant security tools.
Network Access Quarantine Control (NAQC) - Network Access Quarantine Control (NAQC) is a Resource Kit tool in Windows Server 2003 and Windows Server 2008 that allows administrators to prevent remote client computers from connecting to their network with machines that aren't secure.
network attack surface - Every point of network interaction is a part of the network attack surface.
network behavior anomaly detection (NBAD) - Network behavior anomaly detection (NBAD) is the continuous monitoring of a proprietary network for unusual events or extraordinary trends.
Network Intelligence India Pvt. Ltd. (NII Consulting) - Network Intelligence India Pvt.
network intrusion protection system (NIPS) - A network intrusion protection system (NIPS) is an umbrella term for a combination of hardware and software systems that protect computer networks from unauthorized access and malicious activity.
network perimeter - A network perimeter is the boundary between the private and locally managed-and-owned side of a network and the public and usually provider-managed side of a network.
network scanning - Network scanning is a procedure for identifying active devices on a network by employing a feature or features in the network protocol to signal devices and await a response.
Next Generation Secure Computing Base (NGSCB) - The Next Generation Secure Computing Base (NGSCB) is a part of the Microsoft Vista operating system (OS) that employs a trusted platform module (TPM), a specialized chip that can be installed on the motherboard of a personal computer (PC) or server for the purpose of hardware authentication.
Nimda - First appearing on September 18, 2001, Nimda is a computer virus that caused traffic slowdowns as it rippled across the Internet, spreading through four different methods, infecting computers containing Microsoft's Web server, Internet Information Server (IIS), and computer users who opened an e-mail attachment.
NIST 800 Series - The NIST 800 Series is a set of documents that describe United States federal government computer security policies, procedures and guidelines.
NIST Cybersecurity Framework - The NIST Cybersecurity Framework (NIST CSF) is a policy framework surrounding IT infrastructure security.
non-disclosure agreement (NDA) - A non-disclosure agreement (NDA), also known as a confidentiality agreement (CA), is a signed legally binding contract in which one party agrees to give a second party confidential information about its business or products and the second party agrees not to share this information with anyone else for a specified period of time.
nonrepudiation - Nonrepudiation ensures that no party can deny that it sent or received a message via encryption and/or digital signatures or approved some information.
nuclear option - The nuclear option, in a colloquial sense, is the most extreme solution to a given problem.
OAuth - OAuth (Open Authorization) is an open standard authorization framework for token-based authorization on the internet.
OCR (optical character recognition) - OCR (optical character recognition) is the use of technology to distinguish printed or handwritten text characters inside digital images of physical documents, such as a scanned paper document.
OCSP (Online Certificate Status Protocol) - OCSP (Online Certificate Status Protocol) is one of two common schemes for maintaining the security of a server and other network resources.
OCTAVE - OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a security framework for determining risk level and planning defenses against cyber assaults.
Office of Personnel Management (OPM) - The Office of Personnel Management (OPM) is an independent agency of the United States government that is tasked with the oversight of civil service hirings.
one-time pad - In cryptography, a one-time pad is a system in which a private key generated randomly is used only once to encrypt a message that is then decrypted by the receiver using a matching one-time pad and key.
OneID - OneID is a digital identity management service that provides a repository for usernames and passwords, eliminating the need for people to remember numerous arcane character sequences.
OODA loop - The OODA loop (Observe, Orient, Decide, Act) is a four-step approach to decision-making that focuses on filtering available information, putting it in context and quickly making the most appropriate decision while also understanding that changes can be made as more data becomes available.
Open Source Hardening Project - The Open Source Hardening Project is an initiative of the United States Department of Homeland Security, created to improve the security of open source code.
Open System Authentication (OSA) - Open System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol.
OpenID (OpenID Connect) - OpenID is an open specification for authentication and single sign-on.
OpenSSL - OpenSSL is a general purpose cryptography library that provides an open source implementation of the SSL and TLS protocols.
operational costs - Definition - In information technology, operational costs document the price of running of IT services on a day-to-day basis.
OPSEC (operations security) - OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines what is required to protect sensitive information and prevent it from getting into the wrong hands.
organizational unit (OU) - An organizational unit (OU) is a container within a Microsoft Active Directory domain which can hold users, groups and computers.
PA-DSS (Payment Application Data Security Standard) - Payment Application Data Security Standard (PA-DSS) is a set of requirements that are intended to help software vendors develop secure payment applications that support PCI DSS compliance.
PAN truncation (primary account number) - PAN (primary account number) truncation is a technology that prevents most of the digits in a credit card, debit card or bank account number from appearing on printed receipts issued to customers.
parameter tampering - Parameter tampering is a form of Web-based hacking event (called an attack) in which certain parameters in the Uniform Resource Locator (URL) or Web page form field data entered by a user are changed without that user's authorization.
passenger name record (PNR) - A passenger name record (PNR) is a collection of data pertaining to an individual air traveler or a group of individuals travelling together.
passphrase - A passphrase is a string of characters longer than the usual password (which is typically from four to 16 characters long) that is used in creating a digital signature (an encoded signature that proves to someone that it was really you who sent a message) or in an encryption or a decryption of a message.
password - A password is a string of characters used to verify the identity of a user during the authentication process.
password cracking - Password cracking is the process of using an application program to identify an unknown or forgotten password to a computer or network resource.
password hardening - Password hardening is any one of a variety of measures taken to make it more difficult for an intruder to circumvent the authentication process.
password strength meter - A password strength meter is an indicator, either in graphical or text form, of the strength of a password as entered by a user.
passwordless authentication - Passwordless authentication is a verification process that determines whether someone is, in fact, who they say they are without requiring the person to manually enter a string of characters.
pay for privacy - Pay for privacy is a business model in which customers are charged a fee to ensure that their data will not be shared and is secure from third-party access.
Payment Card Industry (PCI) - The Payment Card Industry (PCI) is the segment of the financial industry that governs the use of all electronic forms of payment.
PCI DSS (Payment Card Industry Data Security Standard) - The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.
PCI DSS 3.0 - PCI DSS 3.0 is the third major iteration of the Payment Card Industry Data Security Standard, a set of policies and procedures administered by the Payment Card Industry Security Standards Council (PCI SSC) to ensure the security of electronic payment data and sensitive authentication data.
PCI DSS merchant levels - Merchant levels are used by the payment card industry (PCI) to determine risk levels and determine the appropriate level of security for their businesses.
PCI gap assessment - A PCI gap assessment is the identification, analysis and documentation of areas of non-compliance with the Payment Card Industry Data Security Standard (PCI DSS).
PCI policy - A PCI policy is a type of security policy that covers how an organization addresses the 12 requirements of the Payment Card Industry Data Security Standard (PCI DSS).
PCI Security Standards Council - The PCI Security Standards Council is an organization created by the major credit card companies in an effort to better protect credit card holder data.
PEAP (Protected Extensible Authentication Protocol) - PEAP (Protected Extensible Authentication Protocol) is a version of EAP, the authentication protocol used in wireless networks and Point-to-Point connections.
Peltzman Effect - The Peltzman Effect is the net-zero effect on overall safety between the presence of safety precautions and people’s tendency to be less cautious in their presence.
pen testing (penetration testing) - A penetration test, also called a pen test or ethical hacking, is a cybersecurity technique organizations use to identify, test and highlight vulnerabilities in their security posture.
Pen Testing as a Service (PTaaS) - Pen testing as a service (PTaaS) is a cloud service that provides information technology (IT) professionals with the resources they need to conduct and act upon point-in-time and continuous penetration tests.
performance testing - Performance testing is a testing measure that evaluates the speed, responsiveness and stability of a computer, network, software program or device under a workload.
personal health record (PHR) - A personal health record (PHR) is a collection of health-related information that is documented and maintained by the individual it pertains to.
personal identity verification (PIV) card - A personal identity verification (PIV) card is a United States Federal smart card that contains the necessary data for the cardholder to be granted to Federal facilities and information systems and assure appropriate levels of security for all applicable Federal applications.
personally identifiable financial information (PIFI) - Personally identifiable financial information (PIFI) is any type of personally identifiable information (PII) that is linked to that person's finances.
pharming - Pharming is a scamming practice in which malicious code is installed on a personal computer or server, misdirecting users to fraudulent websites without their knowledge or consent.
phishing - Phishing is a form of fraud in which an attacker masquerades as a reputable entity or person in email or other communication channels.
phlashing - Phlashing is a permanent denial of service (PDoS) attack that exploits a vulnerability in network-based firmware updates.
phreak - A phreak is someone who breaks into the telephone network illegally, typically to make free long-distance phone calls or to tap phone lines.
physical attack surface - The physical attack surface is the totality of the security vulnerabilities in a given system that are available to an attacker in the same location as the target.
physical security - Physical security is the protection of personnel, hardware, software, networks and data from physical actions and events that could cause serious loss or damage to an enterprise, agency or institution.
ping sweep (ICMP sweep) - A ping sweep (also known as an ICMP sweep) is a basic network scanning technique used to determine which of a range of IP addresses map to live hosts (computers).

FAR - MAL

PIR - SMA