Annex 1. Glossary

802.11

802.11 is a set of developing IEEE standards for wireless local area networks (WLAN). The IEEE fosters the development of standards that often become national and international standards. The organization publishes a number of journals, has many local chapters, and several large societies in special areas, such as the IEEE Computer Society. For further information on the IEEE and the IEEE Computer Society, see

http://standards.ieee.org and http://www.computer.org/.

Information about definitions and functional requirements for 802.11 may be found in this document: http://grouper.ieee.org/groups/802/11/Documents/DocumentArchives/1992_docs/1192091.DOC

Access

The ability to enter a secured area and, in the case of accessing a computer, to read, write, modify, or use any of the computer’s system resources.

Access authorization

Permission granted to users, programs, or workstations.

Access control

A set of procedures performed by hardware, software, and administrators to monitor access, identify users requesting access, record access attempts, and grant or deny access. Security policies should be supported by access control, which assist in the prevention of unauthorized use of any of a company’s system resources either externally (by an intruder) or internally (by an employee who should not have access).

Accountability

Ensuring that activities on supported systems can be traced to an individual who is held responsible for the integrity of the data.

Assurance

A level of confidence that the information system architecture mediates and enforces the organization’s security policy.

Attachment

An attachment is a method by which text and images can be sent via e-mail. Any non-text file (a program or a picture or a video) is converted (“encoded”) into a printable form and inserted into the text message. Anything stored in your computer is composed of zeros and ones. Encoding, in its simplest form, would send the zeros and ones as printable characters.

Attack

An assault on system security from an intelligent threat; a deliberate attempt to evade security services and violate the security policy of a system.

Audit

The independent collection of records to access their veracity and completeness.

Audit trail

An audit trail is a documented record of events allowing an auditor (or security administrator) to reconstruct past system activities, it may be on paper or on disk. In computer security systems, it is a chronological record of when users log in, how long they are engaged in various activities, what they were doing, whether any actual or attempted security violations occurred.

Authentic signature

A signature, particularly a digital signature, that can be trusted because it can be verified.

Authenticate

In networking, to verify the identity of a user, device, or any other system entity.

Authentication

The process of establishing the legitimacy of a node or user before allowing access to requested information. During the process, the user enters a name or account number (identification) and password (authentication).

Authorization

Granting officially approved access rights to a user, process, or program in accordance with a company’s security policy. Usually authorization is completed after the user is authenticated. The user may then be authorized for various levels of access or activity.

Availability

The portion of time a system can be use for productive work.

Backdoor

A way to bypass the normal login security and gain control of a computer without necessarily obtaining the owner’s consent. If a backdoor is installed on a network-attached computer, a person anywhere on the Internet may be able to gain control of the computer without your knowledge or approval. A backdoor need not have malicious intent; e.g. operating systems are sometimes shipped by the manufacturer with privileged accounts for use by field service technicians or the vendor’s maintenance programmers. However, they may also be used for intrusion by unauthorized persons. Also known as a “trap door”.

Backup

The process of copying computer files to some other location either on the computer, or on storage devices that may be separated from the computer. Backups allow you to recover data in the event that the originals are no longer available, for reasons ranging from accidental deletion to physical damage, theft, or other loss.

Bandwidth

Capacity of a network or data connection, often measured in kilobits per second (kbps) for digital transmissions.

Buffer Overflow

A software bug that occurs when a program moves data into a space in memory, but there is not enough room in memory to store that data. The program may discard characters to try to make space for the new data. Destroying these characters can cause all sorts of problems, and often can allow things to happen which affect the integrity or security of the program. Buffer overflows can be avoided (if you are programming) by checking that there is sufficient spaced in memory before doing a move.

Bulletin board

Allows users from the Internet to write or read messages posted by other users and to exchange programs and files.

CERT

The Computer Emergency Response Team was established at Carnegie-Mellon University after the 1988 Internet worm attack named Morris.

Compromise

Violation of a company’s system security policy by an intruder that may result in the modification, destruction, or theft of data.

Computer crime

Any form of illegal act involving electronic information and computer equipment.

Computer fraud

A computer crime that an intruder commits to obtain money or something of value from a company (or individual). Often, all traces of the crime are covered up. Computer fraud typically involves modification, destruction, theft, or disclosure of data.

Confidentiality

Ensuring that sensitive data is limited to specific individuals (external and internal) or groups within an organization. The confidentiality of the information is based on the degree to which an organization must protect its information – for example, registered, proprietary, or nonproprietary.

Conflict-of-interest escalation

A preset procedure for escalating a security incident if any members of the security are suspect.

Contingency plan

A security plan to ensure that mission-critical computer resources are available to a company in the event of a disaster (such as an earthquake or flood). It includes emergency response actions, backup operations, and postdisaster recovery.

Control

A protective action that a company takes to reduce its risk of exposure.

Cookie

A file that is written to or read from your hard disk at the request of a remote web site. The web site requests that the file be written and reads it later. As a simple example, if you tell a web site what your username is, it can request that this information be written to your disk. When you go back to that web site, it reads the cookie and knows what your username is. Cookies may be used to generate profiles of web usage habits and, in some cases, may infringe on personal privacy.

Countermeasure

An action that a company takes to reduce threats to a system. A countermeasure can be a hardware device, software package, procedure, and so on.

Cracker

Someone who tries to break the security of, and gain access to, someone else’s system without being invited. (See also hacker).

Cryptography

The mathematical science that deals with transforming data to render its meaning unintelligible, prevent its undetected alteration, or prevent its unauthorized use. If the transformation is reversible, cryptography also deals with restoring encrypted data to intelligible form.

Data-driven attack

A form of attack that is encoded in innocuous-seeming data executed by a user or other software to implement an attack. Data-driven attacks are a serious concern even to protected systems because they may get through firewalls in data form and launch an attack on the system behind the firewall.

Data Encryption Standard (DES)

An encryption standard developed by EBM and then tested and adopted by the National Bureau of Standards. Published in 1977, the DES standard has proven itself over nearly 20 years of use in both government and private sectors.

Data integrity

The assurance that a company’s data has not been exposed to modification or destruction either by accident or from malicious acts.

Decode

Conversion of encoded text to plain text through the use of a code.

Decrypt

Conversion of either encoded or enciphered text into plain text.

Dedicated

A special purpose device. Although it is capable of performing other duties, it is assigned to only one.

Defense in depth

The security approach whereby each system on the network is secured to the greatest possible degree. May be used in conjunction with firewalls.

Denial of service

A Denial-of-Service attack is when computers on the Internet are bombarded with (garbage) messages to such a great extent that they spend all of their time responding to these messages. Real user traffic can no longer get through.

Domain Name Server spoofing

Assuming the Domain Name Server (DNS) name of another system by either corrupting the name service cache of a victim system or compromising a domain name server for a valid domain.

E-mail bombs

Code that when executed sends many messages to the same address for the purpose of using up disk space or overloading the e-mail or Web server.

Easy access

Breaking into a system with minimal effort by exploiting a well-known vulnerability, and gaining superuser access in less than 30 seconds (a piece of cake for an intruder).

Eavesdropping

Passive secret wiretapping i.e. without the knowledge of the originator or the intended recipients of the communication.

E-mail

The computer-based equivalent of postal mail – e(lectronic)-mail. Properly addressed e-mail can be sent and received by anyone connected to the Internet. From the perspective of the Internet, all e-mail is composed of printable text (ASCII) messages.

Encryption

The process of scrambling files or programs, changing one character string to another through an algorithm (such as the DES algorithm). Encryption is a way to disguise information so that it cannot be read easily, except by the intended recipient. In the simplest case, there is a “key” that is used to disguise that information. It can only be read after being decrypted, and to decrypt it, you would need to know the proper “key”.

End-to-end encryption

Encryption at the point of origin in a network, followed by decryption at the destination.

Environment

The aggregate of external circumstances, conditions, and events that affect the development, operation, and maintenance of a system.

Escalation

The procedure of reporting (and passing responsibility for resolving) a security breach to a higher level of command. See also, :Internal escalation,” “External escalation,” and “Conflict-of-interest escalation.”

External escalation

The process of reporting a security breach to an individual or group outside the department, division, or company in which it occurred. Once a problem is escalated, responsibility for resolving that problem is either accepted or shared with the party to whom the problem is escalated.

Extranet

Extranet refers to extending the LAN via remote or Internet access to partners outside your organization such as frequent suppliers and purchasers. Such relationships should be over authenticated link to authorized segments of the LAN and are frequently encrypted for privacy.

Fault tolerance

A design method that ensures continued systems operation in the event of individual failures by providing redundant systems elements.

File compression

File compression is a means of storing or transmitting a large quantity of text, images, or code. Even entire archives may be compressed; in fact, this is a standard backup procedure. Examples of compressed archives include “zip” and “tar” files which can contain very bulky information in a dense form. They are “unzipped” and individual files may be called up through fairly simple processes. There are a number of vendors and some freeware available for file compression.

Firewall

A security system that controls traffic flow between networks. Several configurations exist: filters (or screens), application relays, encryption, demilitarized zones (DMZ), and so on. Firewalls have two forms: a firewall may be software program running on your computer or it may be a separate piece of hardware that watches what is being sent and received over a network. Firewalls can block transmissions that are unexpected or disallowed. They can also control communications between you and the outside world.

Gateway

A bridge between two networks.

Global System for Mobile Communications (GSM) GSM is an open, non-proprietary system that is constantly evolving. GSM satellite roaming has extended service access to areas where terrestrial coverage is not available.

Global Positioning System (GPS)

Used primarily for navigation, this satellite-based system maps the location of various receivers on Earth.

Hacker

Someone with an interest in computers who enjoys experimenting with them. The term has also come to mean a person with malicious intentions who gathers information on computer security flaws and breaks into computers without the system owner’s permission, although the term cracker is more appropriate for an exclusively negative connotation. (See also Cracker).

Hacking

In general, writing code for computers. In a security context, the term often is used to mean exploiting system vulnerabilities to gain unauthorized access.

HTML

HyperText Mark-up Language tells a web browser or mail program how to display text and images. It can also give other instructions to the browser/mail program. A mark-up language allows commands or instructions embedded in the text to be displayed and printed. An example of a mark-up language is:

This sentence is <<Start Bold>>very<<End Bold>> short.

When the sentence is displayed, the words within the << >> are take as instructions on what to do. As a result, most of the sentence would be displayed as: This sentence is very short.

Identification

Recognizing users on a company’s system by using unique names.

Identity theft

Identity theft is when someone gathers enough information about you to convince others (such as banks, stores or governments) that they are you.

Incident-response procedures

Formal, written procedures that detail the steps to be taken in the event of a major security problem, such as a break-in. Developing detailed incident-response procedures before the occurrence of a problem is a hallmark of a well-designed security system.

Insider attack

An attack originating from inside a protected network.

Internal escalation

The process of reporting a security breach to a higher level of command within the department, division, or company in which the breach occurred.

Internet

A web of different, intercommunicating networks funded by both commercial and government organizations. The Internet had its roots in early 1969 when the ARPANET was formed. ARPA stands for Advanced Research Projects Agency (which was part of the U.S. Department of Defense). One of the goals of ARPANET was research in distributed computer systems for military purposes. The

first configuration involved four computers and was designed to demonstrate the feasibility of building networks using computers dispersed over a wide area. The advent of open networks in the late 1980's required a new model of communications. The amalgamation of many types of systems into mixed environments demanded better translator between these operating systems and a non-proprietary approach to networking in general. Telecommunications Protocol/Internet Protocol (TCP/IP) provided the best solutions to this.

Internet Engineering Task Force (IETF)

A public forum that develops standards and resolves operational issues for the Internet.

Internet Service Provider (ISP)

The company through which an individual or organization receives access to the Internet. Typically, ISPs provide e-mail service and home-page storage in addition to Internet access. Some ISPs also provide offsite data storage and backup services.

Intranet

A company’s internal network.

Intruder

An entity that gains or attempts to gain access to a system or system resources without having authorization to do so.

Intrusion detection

A security service that monitors and analyzes system events for the purpose of finding, and providing realtime or near real-time warning of, attempts to access system resources in an unauthorized manner.

Intrusion Detection System (IDS)

A system dedicated to the detection of break-ins or break in attempts either manually via software expert systems that operate on logs or other information available on the network.

International Standards Organization (ISO)

A group that sets standards for data communications.

ISP

The company through which an individual or organization receives access to the Internet. Typically, ISPs provide e-mail service and home-page storage in addition to Internet access. Some ISPs also provide offsite data storage and backup services.

Key

In encryption, a key is a sequence of characters used to encode and decode a file. You can enter a key in two formats: alphanumeric and condensed (hexadecimal). In the network access security market, “key” often refers to the "token," or authentication tool, a device utilized to send and receive challenges and responses during the user authentication process. Keys may be small, handheld hardware devices similar to pocket calculators or credit cards, or they may be loaded onto a PC as copyprotected software.

Keyboard logger

A program that captures everything that is typed on a keyboard. The data can be written to disk or sent to someone else via the Internet. If a keyboard logger is installed on a computer, everything that is entered on the computer, including usernames and passwords, can be captured, just as if someone was looking over your shoulder while you typed!

Least privilege

Designing operational aspects of a system to operate with a minimum amount of system privilege. This design reduces the authorization level at which various actions are performed and decreased the chance that a process or user with high privileges may be caused to perform unauthorized activities resulting in a security breach.

Local Area Network (LAN)

An interconnected system of computers and peripherals, LAN users share data stored on hard disks and can share printers connected to the network.

Logging

The process of storing information about events that occurred on the firewall or network.

Log processing

How audit logs are processed, searched for key events, or summarized.

Log retention

How long audit logs are retained and maintained.

Logic bomb

A program inserted into software by an intruder. A logic bomb lies dormant until a predefined condition is met; the program then triggers an unauthorized act.

Network computer architecture

A computing architecture in which components are dynamically downloaded from the network into the client device for execution by the client. The Java programming language is at the core of network computing.

Network-level firewall

A firewall in which traffic is examined at the network protocol packet level.

Network worm

A program or command file that uses a computer network as a means for adversely affecting a system’s integrity, reliability, or availability. A network worm may attack from one system to another by establishing a network connection. The worm is usually a selfcontained program that does not need to attach itself to a host file to infiltrate the networks.

Open Source

Programs that are distributed in source format under conditions that allow free modification and distribution. Since the source code is available, people can see how it works and are able to change it. The authors of Open Source code often encourage other programmers to participate in the further development of the programs. Open Source also includes software that is given away for free and many Open Source programs, both free and for sale, offer functionality that is similar to proprietary programs that may costs a substantial amount of money. Sometimes Open Source programs are incorporated into fee-based programs in special licensing arrangements. See www.opensource.org and www.fsf.org for additional information.

Operating system

System software that controls a computer and its peripherals. Modern operating systems, such as Unix, Linux, and Windows XP handle many of a computer’s basic functions.

Password

A secret code assigned to a user, known by the computer system. Knowledge (and entry) of the user ID and password is often used to authorize that user to access system resources

Password cracker

A software program containing whole dictionaries that tries to match user passwords.

Password sniffing

Passive wiretapping, usually on a local area network, to gain knowledge of passwords.

Penetration

Successful, repeatable, unauthorized access to a protected system resource.

Penetration test

A system test, often part of system certification, in which evaluators attempt to circumvent the security features of the system and penetrate various layers of systems resources.

Perimeter-based security

The technique of securing a network by controlling access to all entry and exit points of the network.

Permissions

The authorized actions a subject can perform with an object (i.e. read, write, modify, or delete).

Personal Identification Number (PIN) A sequence of numbers or letters that serve to authenticate a user to a system or service. A PIN is similar to a password, but generally pertains to completing financial transactions (bank or credit card accounts) or physical access to a location rather than access to computing resources.

Point of Contact (POC)

The person or persons to whom users and/or system administrators should immediately report a break-in or suspected security breach. The POC is the informationsystem equivalent of a 911 emergency line.

Policy

Organizational- level rules governing acceptable use of computing resources, security practices, and operational procedures.

Privacy

The protection of a company’s data from being read by unauthorized parties. Safe guards such as encryption can provide a level of assurance that the integrity of the data is protected from exposure.

Private Key

The element of a public/private key pair that is kept secret by the key pair owner. The private key is used to decrypt messages that have been encrypted by the corresponding public key. It is also used to construct a digital signature – the document to be signed is hashed using a secure hash algorithm and then the hashed value is encrypted using the private key; this process forms the digital signature.

Protocols

Agreed-upon methods of communications used by computers.

Public Key

The element of a public/private key pair that can be known by anyone. The public key is used to encrypt information that is to be intelligible only to the holder of the corresponding private key. It is also used to decrypt a digital signature in order to compare the decrypted digital signature and the hashed value of the signed document.

Reliability

The probability that a system will adequately accomplish its tasks for a specific period of time, under the expected operating conditions.

Remote Access

The hookup of a remote computing device via communications lines such as ordinary phone lines or wide area networks to access network applications and information.

Risk

The probability that a particular vulnerability of a system will be exploited, either intentionally or accidentally.

Risk Analysis: The analysis of an organization's information resources, existing controls and computer system vulnerabilities. It establishes a potential level of damage in dollars and/or other assets and identifies controls that need improvement.

Salami Slice

A hacker method for the acquisition of funds. A database of account information is copied. Then on a later date all accounts are charged a minimal amount, so as not to arouse suspicion.

Scalability

The ability to expand a computing solution to support large numbers of users without having an impact on performance.

Security Audit

An independent professional security review that tests and examines a company’s compliance with existing controls, the results of which enable an auditor to recommend necessary changes in security controls, policies, and procedures.

Security procedures

A set of detailed instructions, configurations, and recommendations to implement a company’s security policy.

Server

The control computer on a local area network that controls software access to workstations, printers and other parts of the network.

Smart card

A credit card-sized device with embedded microelectronics circuitry for storing information about an individual. This is not a key or token, as used in the remote access authentication process.

Snapshot

A copy of what a computer’s memory (primary storage, specific registers, etc.) contains at a specific point in time. Like a photograph. A snapshot can be used to catch intruders by recording information that the hacker may erase before the attack is completed or repelled.

Snooping tool

A program used by an intruder to capture passwords and other data.

Social engineering

An attack based on deceiving users or administrators at the target site. Social engineering attacks are typically carried out by telephoning users or operators and pretending to be an authorized user to attempt to gain access to systems illicitly.

Spam

(Used as verb, e.g. to spam someone) To indiscriminately send unsolicited, unwanted, irrelevant, or inappropriate messages, especially commercial advertising in mass quantities. (Used as a noun: spam) electronic “junk mail.”

Spoof

To gain access to a system by masquerading as an authorized user.

Stateful evaluation

Methodology using mixture of proxy or filtering technology intermittently, depending on perceived threats (or the need for speed).

Token

In authentication, a device used to send and receive challenges and responses during the user authentication process. Tokens may be small, hand-held devices similar to pocket calculators or credit cards.

Total Cost of Ownership (TCO)

A model that helps IT professionals understand and manage the budgeted (direct) and unbudgeted (indirect) costs incurred by acquiring, maintaining, and using an application or a computing system. The TCO normally includes training, upgrades, and administration as well as the original purchase price.

Threat

Any item that has the potential to compromise the integrity, confidentiality, and availability of data.

Tiger team

A group of professional security experts employed by a company to test the effectiveness of security by trying to break in.

Time bomb

A program inserted into software by in intruder that triggers when a particular time is reached or an interval has elapsed.

Trap door

A way to bypass the normal login security and gain control of a computer without necessarily obtaining the owner’s consent. If a backdoor is installed on a network-attached computer, a person anywhere on the Internet may be able to gain control of the computer without your knowledge or approval. A backdoor need not have malicious intent; e.g. operating systems are sometimes shipped by the manufacturer with privileged accounts for use by field service technicians or the vendor’s maintenance programmers. However, they may also be used for intrusion by unauthorized persons. Also known as a “back door.”

Trojan horse

A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the Trojan horse program.

Two-Factor Authentication:

Two-factor authentication is based on something a user knows (factor one) plus something the user has (factor two). In order to access a network, the user must have both “factors,” just as he/she must have an ATM card and a Personal Identification Number (PIN) to retrieve money from a bank account. In order to be authenticated during the challenge/response process, users must have this specific (private) information.

Universal Resource Locator (URL)

Universal Resource Locator – a generalized address to locate something in the Internet. Examples are http://www.infodev.org and mailto:infodev@worldbank.org

User

Any person who interacts directly with a computer system.

User ID

A unique character string that identifies a user.

User identification

User identification is the process by which a user identifies himself to the system as a valid user. This is not the same as authentication, which is the process of establishing that the user is who he says he is and has a right to use that system.

User interface

The part of an application that the user works with directly. User interfaces can be text-driven, such as DOS, or graphical, such as Windows.

Username/password

A name and a secret password that identifies a user to a computer system or a web site.

Virtual Private Network (VPN)

A Virtual Private Network (VPN) is a private connection between two machines that sends private data traffic over a shared or public network, the Internet. VPN technology lets an organization securely extend its network services over the Internet to remote users, branch offices, and partner companies.

Virus

Code that is embedded into a computer program. When the program is executed, the viral code wakes up. Once active, a virus can replicate itself, post messages, destroy data, or degrade system performance.

Virus signature

Characteristics marks of a virus that are tracked and fought by security service software vendors. Security patches are provided routinely by the most active software vendors, including McAfee, Norton (specifically their security tools including virus protection and firewalls), and Microsoft, which is working to secure flaws in its systems and programs.

Vulnerability

A flaw or weakness in a system’s design, implementation, or operation that can be exploited by an intruder to violate the system’s security policy.

Wireless Equivalent Protocol (WEP)

Wireless Equivalent Protocol. It was designed to be implemented over WLANs to offer the same security features as a physical wire: confidentiality, access control, and data integrity.

Wireless Local Area Network (WLAN)

A wireless network that corresponds to wireless laptops or other mobile devices.

Wiretapping

An attack that intercepts and accesses data and other information contained in a flow in a communication system. Originally, the term applied to a mechanical connection to an electrical conductor. It now refers to reading information from any medium used for a link or even directly from a node, gateway or switch.

Worm

A computer program that can run independently, can propagate a complete working version of itself onto other hosts on a network, and may consume computer resources destructively, leading to a denial-of-service on that network, or networks.