Encryption

Information Protection

Measures used to protect information and information systems

CIA Triad

Confidentiality integrity and availability

Confidentiality

Only authorized people can access sensitive information

Integrity

Data stays accurate and unchanged

Availability

Systems and data are accessible when needed

Data in Use

Data currently being opened edited or processed

Data in Motion

Data moving across a network

Data in Transit

Data traveling through wired or wireless network paths

Data in Flight

Data moving wirelessly

Data at Rest

Data saved on drives folders files or storage

Hashing

One way math process used to verify integrity

Hash Value

Output used to check whether data changed

Hash Collision

When two different inputs create the same hash value

AAA Model

Authentication authorization and accounting

Identification

Information provided to claim who you are

Authentication

Verifying that the identity is real

Authorization

Assigning permissions after identity is verified

Accounting

Logging user or system activity

Non Repudiation

Prevents a sender or receiver from denying an action

Digital Signature

Technology that supports non repudiation

Policy

High level plan that says what and why

Procedure

Step by step actions that say how

Principle of Least Privilege

Only give the access needed to do the job

PoLP

Short name for Principle of Least Privilege

Security Awareness Training

Training that helps users recognize and respond to security concerns

User Agreement

Rules users accept before using a government system

PII

Information that can identify a person

PHI

Personal health information protected by HIPAA

HIPAA

Law that protects personal health information

SOX

Law focused on corporate fraud records and investigations

USA Patriot Act

Law that loosens some restrictions for terrorism investigations

ECPA

Law related to electronic communications privacy and monitoring exceptions

Risk Assessment

Testing security controls to find weaknesses

Risk Acceptance

Accepting the risk as is

Risk Avoidance

Choosing not to do the risky activity

Risk Mitigation

Reducing the chance or impact of risk

Risk Transference

Passing or sharing the risk with another party

Event

Any observable occurrence in a system or network

Incident

An event that harms or could harm CIA or violates policy

Boundary Protection

Controls traffic crossing network boundaries

Network Perimeter

Defensible edge or boundary of a network

Service Delivery Point

Single logical point where boundary traffic is controlled

Serial Configuration

Security devices placed one after another

Parallel Configuration

Security devices placed side by side

Outermost Perimeter

Untrusted area between controlled assets and outside networks

Untrusted Network

Most insecure external side of the network

DMZ

Middle network segment for limited public access

Internal Perimeter

Boundary between outside access and trusted internal assets

Innermost Perimeter

Trusted internal network with protected users servers and devices

Trusted Network

Internal network with the highest protection

Public Web Server

Common asset placed in a DMZ

Proxy Server

Middleman that forwards requests and hides the internal client

Gateway

Device that connects networks with different implementations

System Guard

Trusted device that filters data between different security levels

Firewall

Device or software that allows or blocks traffic based on rules

Encrypted Tunneling

Encapsulating traffic so it can securely cross another network

VPN

Secure private connection through a public network

Defense in Depth

Layered defense using people technology and operations

People

Defense in Depth element involving training roles and accountability

Technology

Defense in Depth element involving tools like firewalls IDS and encryption

Operations

Defense in Depth element involving daily security actions and response

Protect Detect React

Security approach used to prevent detect and respond to attacks

Internal Control

Mechanisms used to monitor and protect internal resources

VPN Concentrator

Device that creates and manages many VPN tunnels

Voice Protection System

Firewall like protection for phone lines

War Dialer

Tool that dials many phone numbers looking for modems or weak points

SRTP

Secure protocol for protecting real time voice or video traffic

IPSec

Layer 3 protocol suite that protects IP packets

IPSec Transport Mode

Encrypts only the payload

IPSec Tunnel Mode

Encrypts the entire IP packet

IDS

System that detects suspicious or unauthorized activity

IPS

System that detects and actively blocks attacks

HIDS

IDS installed on and monitoring one host

NIDS

IDS that monitors packets on a network segment

HIPS

Host based intrusion prevention system

NIPS

Network based intrusion prevention system

Signature Based Detection

Detects known attack patterns

Anomaly Based Detection

Detects behavior that looks abnormal

Policy Based Detection

Detects violations of configured security policy

Misuse Detection

Compares activity to known attack signatures

Authentication Factor

Category of proof used to verify identity

Something You Know

Password PIN or passphrase

Something You Have

CAC token key fob or mobile device

Something You Are

Biometric trait like fingerprint or face

Something You Do

Behavior like keystroke pattern or gait

Somewhere You Are

Location IP address or geographic location

Two Factor Authentication

Authentication using two different factor types

MFA

Authentication using three or more factor types

CAC

Card used with a PIN for two factor authentication

Biometrics

Authentication using physical traits

Password

Something you know used for authentication

Token

Something you have used for authentication

Permissions

Access rules for what users can do

Access Control

Granting or denying access to resources

IBAC

Access control based on identity

MAC

Mandatory access control