Usable Security

The Enigma

WWII code machine; example of early security, which was mostly physical security.

ARPA (Advanced Research Project Agency)

Agency that studied redundant networked communications in the 1960s.

ARPANET

Early network developed by Larry Roberts; its growth exposed security problems like no dial-up safety procedures and no user identification/authorization.

Rand Report R-609

The paper that started the study of computer security.

MULTICS (Multiplexed Information and Computing Service)

First operating system built with security as its primary goal; made by GE, Bell Labs, and MIT in the mid-1960s.

UNIX

OS created by former MULTICS players; primary purpose was text processing.

Security

The quality or state of being secure; to be free from danger.

Information Security

Protection of information and its critical elements, including the systems and hardware that use, store, and transmit it.

C.I.A. Triangle

The old security standard based on Confidentiality, Integrity, and Availability.

Access

A subject's ability to use, change, or affect another subject or object.

Asset

The organizational resource being protected.

Attack (Key Concepts)

An act that takes advantage of a vulnerability to compromise a system.

Control / Safeguard / Countermeasure

A security mechanism, policy, or procedure that counters attacks and reduces risk.

Exploit

A technique used to compromise a system; also, to take advantage of a weakness.

Exposure

A condition or state of being exposed; when a vulnerability is known to an attacker.

Loss

A single instance of an asset suffering damage, unintended modification, or disclosure.

Protection Profile / Security Posture

The entire set of controls and safeguards an organization implements to protect assets.

Risk

The probability that something unwanted will happen.

Subjects and Objects

A computer is the subject when it is used as an active tool to conduct an attack, and the object when it is the entity being attacked.

Threat (Key Concepts)

A category of objects, persons, or entities that represents a danger to an asset.

Threat Agent

The specific instance or component of a threat.

Vulnerability

A weakness or fault in a system or protection mechanism.

Availability

Information is accessible to authorized users without interference.

Accuracy

Information is free from mistakes and has the value the user expects.

Authenticity

Information is genuine or original, not a fabrication.

Confidentiality

Information is protected from disclosure to unauthorized people.

Integrity

Information is whole, complete, and uncorrupted.

Utility

Information has value for some purpose.

Possession

Ownership or control of information.

CNSS Security Model / McCumber Cube

Security model represented as a cube.

Information System (IS)

The entire set of components (software, hardware, data, people, procedures, networks) needed to use information as a resource.

Bottom-Up Approach

Grassroots security effort led by systems administrators; seldom works because it lacks participant support and organizational staying power.

Top-Down Approach

Security effort initiated by upper management that issues policy and sets goals and accountability; the more successful approach.

SDLC (Systems Development Life Cycle)

Methodology for designing and implementing an information system.

Methodology

A formal approach to problem solving based on a structured sequence of procedures.

Feasibility Analysis

Assessment of economic, technical, and behavioral feasibility, done at the end of most SDLC phases.

Make-or-Buy Decision

Evaluation in physical design of whether to build or purchase components.

Maintenance and Change (SDLC)

Longest and most expensive phase of the SDLC.

SecSDLC (Security Systems Development Life Cycle)

SDLC adapted to identify specific threats and create controls against them; a coherent program, not random actions.

EISP (SecSDLC)

The policy that the SecSDLC investigation phase begins with. (Enterprise Information Security Policy)

Maintenance and Change (SecSDLC)

Perhaps the most important SecSDLC phase because the threat environment keeps changing.

CIO (Chief Information Officer)

Senior technology officer who advises executives on strategic planning.

CISO (Roles)

Chief Information Security Officer; responsible for assessment, management, and implementation of information security; usually reports to the CIO.

Champion

Senior executive who promotes the project and ensures its support.

Team Leader

Project manager who understands project management, personnel management, and infosec requirements.

Data Owner

Responsible for the security and use of a particular set of information.

Data Custodian

Responsible for storage, maintenance, and protection of information.

Data Users

End users who work with information in their daily jobs.

Communities of Interest

Groups united by similar interests or values in an organization (infosec, IT, and organizational management and professionals).

Security as Art

View that there are no hard and fast rules or manuals for implementing security.

Security as Science

View that specific conditions cause virtually all system actions, so faults can be resolved.

Security as Social Science

View that security begins and ends with the people who interact with the system.

Data in Motion

Data being transmitted; must be protected.

Data at Rest

Stored data; must be protected.

Threat (General Terms)

An object, person, or other entity that represents a constant danger to an asset.

Intellectual Property (IP)

Ownership of ideas and control over the tangible or virtual representation of those ideas.

Software Piracy

The most common IP breach.

SIIA (Software & Information Industry Association)

Watchdog organization that investigates software abuse.

BSA (Business Software Alliance)

Watchdog organization that investigates software abuse.

Malware (Malicious Software)

Software designed to damage, destroy, or deny service to target systems.

Virus

Malicious code that attaches to and spreads through other programs.

Worm

Malicious program that replicates itself without needing another program.

Trojan Horse

Malware hidden inside software that appears legitimate.

Logic Bomb

Malicious code that activates when a specific condition is met.

Back Door / Trap Door (Malware)

A hidden access mechanism into a system.

Polymorphic Threat

Threat that changes its appearance to avoid detection.

Virus and Worm Hoaxes

Fake warnings about malware.

Deviations in Quality of Service

Situations where products or services are not delivered as expected.

Spike / Surge

Power excess; voltage increase.

Sag / Brownout

Power shortage; low voltage.

Fault / Blackout

Complete loss of power.

Espionage or Trespass

Access of protected information by unauthorized individuals.

Competitive Intelligence

Legal gathering of information about competitors.

Industrial Espionage

Illegal gathering of competitor information.

Shoulder Surfing

Watching someone access confidential information, which can happen anywhere.

Hacker

Someone who uses skill, guile, or fraud to bypass controls protecting others' information.

Expert Hacker

Develops scripts and exploits, is a master of many skills, and shares attack software.

Unskilled Hacker

Uses expertly written software without fully understanding the systems; far more numerous than expert hackers.

Cracker

Someone who removes software protection designed to prevent unauthorized duplication.

Phreaker

Someone who hacks the public telephone network.

Forces of Nature

Among the most dangerous threats; they disrupt both lives and information use.

Human Error or Failure

Acts done without malicious intent, caused by inexperience, improper training, or incorrect assumptions.

Information Extortion

Stealing information and demanding compensation for its return or nondisclosure.

Sabotage or Vandalism

Ranges from petty vandalism to organized sabotage, such as website defacing.

Hacktivist / Cyberactivist

Someone who hacks to promote a cause.

Cyberterrorism

A much more sinister form of hacking.

Theft

Illegal taking of another's physical, electronic, or intellectual property.

Technical Hardware Failure

Equipment distributed with flaws; errors can be terminal or intermittent.

Technical Software Failure

Software with unrevealed faults or bugs.

Technological Obsolescence

Outdated infrastructure that leads to unreliable systems.

Attack (General Attacks)

Act that exploits a vulnerability in a controlled system, done by a threat agent.

Malicious Code

Execution of viruses, worms, Trojan horses, and active web scripts to destroy or steal information.

Hoax (Attack)

Virus hoax sent with a real virus attached.

Back Door (Attack)

Gaining access using a known or newly discovered access mechanism.

Password Crack

Attempting to reverse calculate a password.

Brute Force

Trying every possible combination of a password.

Dictionary Attack

Targets specific accounts using commonly used passwords to guide guesses.

Denial-of-Service (DoS)

Sending a large number of requests so the target can't serve legitimate users.

Distributed Denial-of-Service (DDoS)

Coordinated DoS launched from many locations at the same time.

Spoofing

Intruder assumes a trusted IP address to gain unauthorized access.