Chapter 11: Cybersecurity Maintenance Key Terms

configuration and change management (CCM)

The approach that uses policies, procedures, techniques, and tools to manage and evaluate proposed changes, track changes through completion, and maintain system inventories and documentation.

configuration management (CM)

An approach to implementing system changes using policies, procedures, techniques, and tools to evaluate proposed changes, track completion, and maintain inventories and documentation.

auditing

The review of a system’s use to determine whether misuse or malfeasance has occurred.

external monitoring domain

The maintenance model component focused on evaluating external threats to an organization’s information assets.

internal monitoring domain

The maintenance model component focused on identifying, assessing, and managing the configuration and status of an organization’s information assets.

difference analysis

A procedure that compares the current state of a network segment to a previous baseline to identify changes.

planning and risk assessment domain

The maintenance model component focused on identifying and planning cybersecurity activities and managing risks introduced through IT and cybersecurity projects.

vulnerability assessment and remediation domain

The maintenance model component focused on documenting vulnerabilities and remediating them in a timely manner.

vulnerability assessment

The process of identifying and documenting provable flaws in an organization’s information asset environment.

penetration testing

The investigation, assessment, and evaluation of a system by authorized individuals emulating an attack.

pen testing

The investigation, assessment, and evaluation of a system by authorized individuals emulating an attack.

Internet vulnerability assessment

An assessment designed to find and document vulnerabilities present in an organization’s public network.

intranet vulnerability assessment

An assessment designed to find and document selected vulnerabilities present on an organization’s internal network.

platform security validation (PSV)

An assessment approach used to find and document vulnerabilities caused by misconfigured systems inside an organization.

wireless vulnerability assessment

An assessment approach designed to find and document vulnerabilities present in an organization’s wireless local area networks.