1
802.1x
A port-based authentication protocol. Wireless can use 802.1x. For example, WPA2 Enterprise mode uses an 802.1x server (implemented as a RADIUS server). Enterprise mode requires an 802.1x server. PEAP and EAP-TTLS require a certificate on the 802.1x server. EAP-TLS also uses TLS, but it requires certificates on both the 802.1x server and each of the clients.
3DES
Triple Digital Encryption Standard. A symmetric algorithm used to encrypt data and provide confidentiality. It is a block cipher that encrypts data in 64-bit blocks. It was originally designed as a replacement for DES, and is still used in some applications, such as when hardware doesn't support AES.
AAA
Authentication, Authorization, and Accounting. AAA protocols are usedin remote access systems. For example, TACACS + is an AAA protocol that uses multiple challenges and responses during a session. Authentication verifies a user's identification. Authorization determines if a user should have access. Accounting tracks a user's access with logs.
ACE
Access Control Entry. Identifies a user or group that is granted permission to a resource. ACEs are contained within a DACL in NTFS.
ACK
Acknowledge. A packet in a TCP handshake. In a SYN flood attack, attackers send the SYN packet, but don't complete the handshake after receiving the SYN/ ACK packet.
CIO
Chief Information Officer. A "C" level executive position in some organizations. A CIO focuses on using methods within the organization to answer relevant questions and solve problems.
DBA
Database administrator. A DBA administers databases on database servers.
ACL
Access control list. Routers and packet-filtering firewalls perform basic filtering using an ACL to control traffic based on networks, subnets, IP addresses, ports, and some protocols. In NTFS, a list of ACEs makes up the ACL for a resource.
AES
Advanced Encryption Standard. A symmetric algorithm used to encrypt data and provide confidentiality. AES is a block cipher and it encrypts data in 128-bit blocks. It is quick, highly secure, and used in a wide assortment of cryptography schemes. It includes key sizes of 128 bits, 192 bits, or 256 bits.
AES-256
Advanced Encryption Standard 256 bit. AES sometimes includes the number of bits used in the encryption keys and AES-256 uses 256-bit encryption keys. Interestingly, Blowfish is quicker than AES-256.
AH
Authentication Header. IPsec includes both AH and ESP. AH provides authentication and integrity using HMAC. ESP provides confidentiality, integrity, and authentication using HMAC, and AES or 3DES. AH is identified with protocol ID number 51.
ALE
Annual (or annualized) loss expectancy. The ALE identifies the expected annual loss and is used to measure risk with ARO and SLE in a quantitative risk assessment. The calculation is SLE × ARO = ALE.
CIA
Confidentiality, integrity, and availability. These three form the security triad. Confidentiality helps prevent the unauthorized disclosure of data. Integrity provides assurances that data has not been modified, tampered with, or corrupted. Availability indicates that data and services are available when needed.
DACL
Discretionary access control list. List of Access Control Entries (ACEs) in Microsoft NTFS. Each ACE includes a security identifier (SID) and a permission.
AP
Access point, short for wireless access point (WAP). APs provide accessto a wired network to wireless clients. Many APs support Isolation mode to segment wireless users from other wireless users.
API
Application Programming Interface. A software module or component that identifies inputs and outputs for an application.
APT
Advanced persistent threat. A group that has both the capability and intent to launch sophisticated and targeted attacks.
ARO
Annual (or annualized) rate of occurrence. The ARO identifies how many times a loss is expected to occur in a year and it is used to measure risk with ALE and SLE in a quantitative risk assessment. The calculation is SLE × ARO = ALE.
ARP
Address Resolution Protocol. Resolves IPv4 addresses to MAC addresses. ARP poisoning attacks can redirect traffic through an attacker's system by sending false MAC address updates. NDP is used with IPv6 instead of ARP.
CHAP
Challenge Handshake Authentication Protocol. Authentication mechanism where a server challenges a client. More secure than PAP and uses PPP. MS-CHAPv2 is an improvement over CHAP and uses mutual authentication.
DAC
Discretionary access control. An access control model where all objects have owners and owners can modify permissions for the objects (files and folders). Microsoft NTFS uses the DAC model. Other access control models are MAC and RBAC.
ASCII
American Standard Code for Information Interchange. Code used to display characters.
ASP
Application Service Provider. Provides an application as a service over a network.
AUP
Acceptable use policy. An AUP defines proper system usage. It will often describe the purpose of computer systems and networks, how users can access them, and the responsibilities of users when accessing the systems.
BAC
Business Availability Center. An application that shows availability and performance of applications used or provided by a business.
BCP
Business continuity plan. A plan that helps an organization predict and plan for potential outages of critical services or functions. It includes disaster recovery elements that provide the steps used to return critical functions to operation after an outage. A BIA is a part of a BCP and the BIA drives decisions to create redundancies such as failover clusters or alternate sites.
CERT
Computer Emergency Response Team. A group of experts who respond to security incidents. Also known as CIRT, SIRT, or IRT.
CVE
Common Vulnerabilities and Exposures (CVE). A dictionary of publicly known security vulnerabilities and exposures.
BIA
Business impact analysis. The BIA identifies systems and components that are essential to the organization's success. It identifies various scenarios that can impact these systems and components, maximum downtime limits, and potential losses from an incident. The BIA helps identify RTOs and RPOs.
BIND
Berkeley Internet Name Domain. BIND is DNS software that runs on Linux and Unix servers. Most Internet-based DNS servers use BIND.
BIOS
Basic Input/ Output System. A computer's firmware used to manipulate different settings such as the date and time, boot drive, and access password. UEFI is the designated replacement for BIOS.
BPA
Business partners agreement. A written agreement that details the relationship between business partners, including their obligations toward the partnership.
BYOD
Bring your own device. A policy allowing employees to connect personally owned devices, such as tablets and smartphones, to a company network. Data security is often a concern with BYOD policies and organizations often use VLANs to isolate mobile devices.
CCTV
Closed-circuit television. This is a detective control that provides video surveillance. Video surveillance provides reliable proof of a person's location and activity. It is also a physical security control and it can increase the safety of an organization's assets.
CTO
Chief Technology Officer. A "C" level executive position in some organizations. CTOs focus on technology and evaluate new technologies.
CA
Certificate Authority. An organization that manages, issues, and signs certificates and is part of a PKI. Certificates are an important part of asymmetric encryption. Certificates include public keys along with details on the owner of the certificate and on the CA that issued the certificate. Certificate owners share their public key by sharing a copy of their certificate.
CAC
Common Access Card. A specialized type of smart card used by the U.S. Department of Defense. It includes photo identification and provides confidentiality, integrity, authentication, and non-repudiation for the users. It is similar to a PIV.
CAN
Controller Area Network. A standard that allows microcontrollers and devices to communicate with each other without a host computer.
CAPTCHA
Completely Automated Public Turing Test to Tell Computers and Humans Apart. Technique used to prevent automated tools from interacting with a web site. Users must type in text, often from a slightly distorted image.
CAR
Corrective Action Report. A report used to document actions taken to correct an event, incident, or outage.
CCMP
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol. An encryption protocol based on AES and used with WPA2 for wireless security. It is more secure then TKIP, which was used with the original release of WPA.
CSU
Channel Service Unit. A line bridging device used with T1 and similar lines. It typically connects with a DSU as a CSU/ DSU.
CIRT
Computer Incident Response Team. A group of experts who respond to security incidents. Also known as CERT, SIRT, or IRT.
COOP
Continuity of operations planning. Continuity of operations planning(COOP) sites provide an alternate location for operations after a critical outage. A hot site includes personnel, equipment, software, and communication capabilities of the primary site with all the data up to date. A cold site will have power and connectivity needed for COOP activation, but little else. A warm site is a compromise between a hot site and a cold site. Mobile sites do not have dedicated locations, but can provide temporary support during a disaster.
CP
Contingency planning. Plans for contingencies in the event of a disaster to keep an organization operational. BCPs include contingency planning.
CRC
Cyclical Redundancy Check. An error detection code used to detect accidental changes that can affect the integrity of data.
CRL
Certification revocation list. A list of certificates that a CA has revoked. Certificates are commonly revoked if they are compromised or issued to an employee who has left the organization. The Certificate Authority (CA) that issued the certificate publishes a CRL, and a CRL is public.
CSR
Certificate signing request. A method of requesting a certificate from a CA. It starts by creating an RSA-based private/ public key pair and then including the public key in the CSR.
CSR
Control Status Register. A register in a processor used for temporary storage of data.