Usable sec reviewer

Information Security

Protection of information and its critical elements, including the systems and hardware that use, store, and transmit information.

Security

The quality or state of being secure or free from danger.

CIA Triad

The three basic goals of information security: Confidentiality, Integrity, and Availability.

Confidentiality

Preventing unauthorized disclosure or exposure of information.

Integrity

Keeping information whole, complete, and uncorrupted.

Availability

Ensuring authorized users can access information when needed and in the required format.

Accuracy

Information is free from mistakes or errors and has the value expected by the user.

Authenticity

Information is genuine or original rather than fabricated or reproduced.

Utility

Information has value for a particular purpose.

Possession

Having ownership or control of information or an object.

Asset

An organizational resource that is being protected.

Threat

An object, person, or entity that represents a potential danger to an asset.

Threat Agent

A specific instance or component of a general threat.

Vulnerability

A weakness or fault that exposes information or systems to attack or damage.

Attack

An intentional or unintentional attempt to damage or compromise information or its supporting systems.

Exploit

Taking advantage of a weakness or vulnerability in a system.

Risk

The probability that something can happen.

Control / Safeguard / Countermeasure

Security mechanisms, policies, or procedures used to counter attacks, reduce risk, and resolve vulnerabilities.

Exposure

A single instance of being open to damage.

Subject

An active entity that interacts with an information system and causes information to move.

Object

A passive entity that receives or contains information.

Security Blueprint

A plan for implementing new security measures in an organization.

Security Model

A collection of specific security rules representing the implementation of a security policy.

Security Posture

The combination of policies, procedures, technologies, and programs that make up an organization's current security effort.

Information System (IS)

The complete set of software, hardware, data, people, procedures, and networks needed to use information as a resource.

McCumber Cube

A security model showing the relationship between information states, CIA objectives, and the protection methods of policy, education, and technology.

Security and Access Balance

Security must balance protection with reasonable access and availability.

Bottom-Up Approach

A grassroots approach where system administrators attempt to improve security; it often lacks management support and organizational staying power.

Top-Down Approach

A security approach initiated by upper management with policies, goals, accountability, funding, and organizational support.

SDLC

A methodology for designing and implementing an information system using a structured sequence of procedures.

SecSDLC

A variation of the SDLC used to implement information security and develop a comprehensive security posture.

Investigation

SecSDLC phase that identifies the problem, goals, scope, constraints, and feasibility.

Analysis

Phase that studies existing security policies, threats, controls, and relevant legal issues while beginning risk management.

Logical Design

Phase that creates security blueprints and plans incident response, continuity, and disaster recovery.

Physical Design

Phase that evaluates and selects the specific security technologies and solutions.

Implementation

Phase where security solutions are acquired, tested, implemented, and tested again, with personnel training.

Security as Art

Security has no single universal solution because systems, users, policies, and technologies interact in complex ways.

Security as Science

Security involves technology where specific hardware and software conditions cause faults, security holes, and system problems.

Security as Social Science

Security considers human behavior because people interacting with systems can create security risks.

Primary Mission of Information Security

To ensure systems and their contents stay protected and unchanged.

Business Need for Security

Information security protects the organization's ability to function, applications, data, and technology assets.

Four Functions of Information Security

Protect organizational operations, enable safe applications, protect data, and safeguard technology assets.

Security Responsibility

Both general management and IT management are responsible for information security.

Data at Rest

Data that is stored and needs protection.

Data in Motion

Data being transmitted between systems and needs protection.

Threat

An object, person, or entity representing a constant danger to an asset.

Attack

A deliberate act that exploits a vulnerability.

Vulnerability

An identified weakness that can be exploited by an attacker.

Exploit

A technique used to compromise a system by taking advantage of a vulnerability.

Intellectual Property (IP)

Ownership of ideas and control over their tangible or virtual representation.

Software Piracy

Illegal use or duplication of software.

Malware

Malicious software designed to damage, destroy, steal information, or deny service.

Virus

Malware that attaches itself to a legitimate file or program and spreads when the infected file is executed.

Worm

Malware that replicates and spreads automatically without requiring another program.

Trojan Horse

Malicious software disguised as legitimate or useful software.

Backdoor / Trapdoor

A hidden method that allows an attacker to gain unauthorized access to a system.

Polymorphic Threat

A threat that changes its appearance to avoid detection.

Virus/Worm Hoax

A false warning about a virus or worm that can waste time and resources.

Denial-of-Service (DoS)

An attack that overwhelms a target with requests, making it unavailable to legitimate users.

Distributed Denial-of-Service (DDoS)

A DoS attack launched from many locations at the same time.

Password Cracking

Attempting to determine or reverse-calculate a password.

Brute Force Attack

Trying every possible password combination.

Dictionary Attack

Guessing passwords using a list of commonly used words or passwords.

Spoofing

An attack where an attacker pretends to be a trusted source, such as using a trusted IP address.

Man-in-the-Middle Attack

An attacker monitors and may modify communication between two parties.

Sniffer

A program or device that monitors data traveling across a network.

Phishing

Attempting to obtain personal or financial information by pretending to be a legitimate entity.

Pharming

Redirecting legitimate web traffic to an illegitimate website to obtain private information.

Social Engineering

Using social skills or manipulation to convince people to reveal credentials or valuable information.

Human Error

Mistakes that can cause data disclosure, incorrect data entry, accidental deletion, or failure to protect information.

Information Extortion

Stealing information and demanding compensation for its return or nondisclosure.

Sabotage/Vandalism

Deliberately damaging a computer system, business, or its reputation.

Theft

Illegal taking of physical, electronic, or intellectual property.

Firewall

A security mechanism that keeps certain unwanted network traffic out of a private network.

Software Assurance (SA)

A software development approach that integrates security objectives into the development process.

Secure Software

Software developed with security considered throughout its development life cycle.

Secure Software Principle: Least Privilege

Users and programs should use only the privileges necessary to perform their tasks.

Secure Software Principle: Access Checking

Every access to every object should be checked for authorization.

Law

Rules that mandate or prohibit certain behavior and are enforced by the state.

Ethics

Principles that regulate and define socially acceptable behavior.

Cultural Mores

Fixed moral attitudes or customs of a particular group.

Law vs Ethics

Laws have authority from a governing body; ethics do not.

Liability

A legal obligation that can require an organization to compensate for wrongs committed.

Restitution

The legal obligation to compensate an injured party for wrongs committed.

Due Care

The legal standard requiring an organization to act legally and ethically and understand the consequences of its actions.

Due Diligence

The legal standard requiring an organization to maintain due care and ensure security actions remain effective.

Jurisdiction

A court's right to hear a case when the wrong occurred in its territory or involved its citizens.

Long-Arm Jurisdiction

Applying laws to people outside a court's normal jurisdiction when certain conditions are met.

Policy

A managerial directive that specifies acceptable and unacceptable employee behavior.

Policy Enforcement

Requires dissemination, review, comprehension, compliance, and uniform enforcement.

Civil Law

Governs relationships and conflicts between organizations and people.

Criminal Law

Addresses conduct harmful to society and is actively enforced by the state.

Private Law

Regulates relationships between individuals and organizations, including family, commercial, and labor matters.

Public Law

Regulates government agencies and their relationships with citizens and other governments.

Privacy

The right of individuals or groups to protect themselves and their personal information from unauthorized access.

Computer Fraud and Abuse Act (CFA Act) of 1986

A cornerstone of many U.S. federal computer-related laws and enforcement efforts.

National Information Infrastructure Protection Act of 1996

Modified computer crime laws and increased penalties for selected crimes.

USA PATRIOT Act of 2001

Gave law enforcement broader authority to combat terrorism-related activities.

Computer Security Act of 1987

Established minimum acceptable security practices for federal computer systems.

HIPAA

Protects health-care information by requiring security mechanisms, policies, procedures, and privacy protections.