Attachment_0013_R11_-_CNSSI_4009.pdf

Committee on National Security Systems

CNSSI No. 4009

April 6, 2015

Committee on National Security Systems

(CNSS) Glossary

THIS DOCUMENT PRESCRIBES MINIMUM STANDARDS

YOUR DEPARTMENT OR AGENCY MAY REQUIRE FURTHER

IMPLEMENTATION

National Manager

FOREWORD

1. The Committee on National Security Systems (CNSS) Glossary Working Group convened to review and update the Committee on National Security Systems (CNSS) Glossary, Committee on National Security Systems Instruction (CNSSI) No. 4009, dated April 2010. This revision of CNSSI No. 4009 incorporates many new terms submitted by the CNSS Membership.

Most of the terms from the 2010 version of the Glossary remain, but a number of terms have updated definitions in order to remove inconsistencies among the communities.

2. The Glossary Working Group set several overall objectives for itself in producing this version:

Use authoritative sources for definitions of terms. It is preferred that definitions originate from current authoritative sources, as this demonstrates both that the term is in active use and that the definition has been vetted by subject matter experts. Listing sources for terms also provides context and a reference for additional information. The glossary still contains terms where sources are not specified. For these terms, definitions will be considered organic.

The majority of unsourced terms are from the CNSSI No. 4009 (2010) version, although some are newly introduced. These new terms are primarily emerging terms judged to be valuable to include in the glossary, but for whatever reason have not yet been defined in a published authoritative source.

Continue to resolve differences between the definitions of terms used by the

Department of Defense (DoD), Intelligence Community (IC), and Civil Agencies (e.g. National

Institute of Standards and Technology (NIST)); enabling all three to use the same glossary. This will allow for use of consistent terminology in documentation, policy, and process across these communities.

Ensure consistency among related and dependent terms. These terms are linked through a suggestion to see the related term.

Ensure any acronyms used in the terms and definitions also appear in the Acronyms appendix, and remove any acronyms judged to be outside of the scope of the glossary or no longer relevant.

Ensure all documents referenced as sources in the terms and definitions also appear in the References appendix. Because of this, the number of references has grown from 29 in the

2010 version to over 150 in the current version. References not used as the source of terms and definitions were removed.

3. Many cyber terms are emerging. The Glossary Working Group has tried to include significant terms and definitions that have a useful distinction when compared to existing

Information Assurance terms. All terms currently defined in CNSS issuances were reviewed for either inclusion or to replace current definitions in the Glossary. Not all terms appearing in

CNSS issuances are within the scope of the CNSS Glossary or are relevant to a broad audience.

4. Some terms and definitions recommended by the community for inclusion were not added to this version of the glossary. The main reasons for not adding new terms or definitions were ones of scope or lack of an authoritative source, where an organic definition was not deemed appropriate.

5. Many terms that are outdated or no longer necessary were removed from the glossary.

Some of these had been labeled as Candidates for Deletion (C.F.D.) for several versions of the glossary, but continue to remain in this version. A term labeled "C.F.D." may be obsolete;

however without the term, rationale and possible linkage to a new term, users of the glossary would have no indication the term is outdated or has been replaced by a new term.

6. We recognize an effective glossary must be in a continuous state of coordination and improvement. We encourage further community review and comments as new terms become significant and old terms fall into disuse or change meaning. The goal of the Glossary Working

Group is to keep the CNSS Glossary relevant and a tool for commonality across the IA community.

7. Representatives of the CNSS may obtain copies of this instruction on the CNSS Web

Page at http://www.cnss.gov.

FOR THE NATIONAL MANAGER:

/s/

CURTIS W. DUKES

CNSS Secretariat (IE414). National Security Agency. 9800 Savage Road, STE 6716. Ft Meade, MD 20755-6716 Office: (410) 854-6805

Unclassified FAX: (410) 854-6814 CNSS@nsa.gov mailto:CNSS@nsa.gov

THIS PAGE INTENTIONALLY LEFT BLANK

Table of Contents

Terms and Definitions

Annex A: Acronyms

Annex B: References

National Information Assurance (IA) Glossary

Terms and Definitions

This instruction applies to all U.S. Government Departments, Agencies, Bureaus and Offices;

supporting contractors and agents; that collect, generate process, store, display, transmit or receive classified or controlled unclassified information or that operate, use, or connect to National Security

Systems (NSS), as defined herein.

Term

Definition access Ability to make use of any information system (IS) resource.

Source: NIST SP 800-32 access authority An entity responsible for monitoring and granting access privileges for other authorized entities.

access control The process of granting or denying specific requests: 1) for obtaining and using information and related information processing services; and 2) to enter specific physical facilities (e.g., Federal buildings, military establishments, and border crossing entrances).

Source: FIPS PUB 201-1 (adapted) access control list

(ACL)

A list of permissions associated with an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object.

access control mechanism

Security safeguards (i.e., hardware and software features, physical controls, operating procedures, management procedures, and various combinations of these) designed to detect and deny unauthorized access and permit authorized access to an information system.

access cross domain solution

A type of cross domain solution (CDS) that provides access to a computing platform, application, or data residing on different security domains from a single device.

Source: CNSSI No. 1253F Attachment 3 access level A category within a given security classification limiting entry or system connectivity to only authorized persons.

access list Roster of individuals authorized admittance to a controlled area.

access profile Association of a user with a list of protected objects the user may access.

access type Privilege to perform action on an object. Read, write, execute, append, modify, delete, and create are examples of access types.

accountability 1. The principle that an individual is entrusted to safeguard and control equipment, keying material, and information and is answerable to proper authority for the loss or misuse of that equipment or information.

Source: NSA/CSS Manual Number 3-16 (COMSEC)

2. The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity. This supports non-repudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action recovery and legal action.

Source: NIST SP 800-27 Rev A accounting legend code (ALC)

A numeric code used to indicate the minimum accounting controls required for items of accountable COMSEC material within the COMSEC material control system (CMCS).

accounting number A number assigned to an individual item of COMSEC material to facilitate its handling and accounting.

accreditation (C.F.D.) Formal declaration by a designated accrediting authority (DAA) or principal accrediting authority (PAA) that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural safeguards.

See authorization to operate (ATO).

Rationale: The Risk Management Framework uses a new term to refer to this concept, and it is called authorization.

accreditation boundary (C.F.D.)

1. Identifies the information resources covered by an accreditation decision, as distinguished from separately accredited information resources that are interconnected or with which information is exchanged via messaging. Synonymous with Security

Perimeter.

2. For the purposes of identifying the Protection Level for confidentiality of a system to be accredited, the system has a conceptual boundary that extends to all intended users of the system, both directly and indirectly connected, who receive output from the system.

See authorization boundary.

Rationale: The Risk Management Framework uses a new term to refer to the concept of accreditation, and it is called authorization. Extrapolating, the accreditation boundary would then be referred to as the authorization boundary.

accreditation package

(C.F.D.)

Product comprised of a system security plan (SSP) and a report documenting the basis for the accreditation decision.

Rationale: The RMF uses a new term to refer to this concept, and it is called RMF security authorization package.

accrediting authority

Synonymous with designated accrediting authority (DAA). See also authorizing official.

and it is called authorizing official (AO).

acquirer Stakeholder that acquires or procures a product or service.

Source: NIST IR 7622, ISO/IEC 15288 (adapted) activation data A pass-phrase, personal identification number (PIN), biometric data, or other mechanisms of equivalent authentication robustness used to protect access to any use of a private key, except for private keys associated with System or Device certificates.

Source: CNSSI No. 1300 active attack An attack on the authentication protocol where the Attacker transmits data to the

Claimant, Credential Service Provider, Verifier, or Relaying Party. Examples of active attacks include man-in-the middle, impersonation, and session hijacking.

Source: NIST SP 800-63-2 active content Electronic documents that can carry out or trigger actions automatically on a computer platform without the intervention of a user.

Source: NIST SP 800-28 active cyber defense Synchronized, real-time capability to discover, detect, analyze, and mitigate threats and vulnerabilities.

Source: DSOC 2011 activities

(assessment)

An assessment object that includes specific protection related pursuits or actions supporting an information system that involve people (e.g., conducting system backup operations, monitoring network traffic).

Source: NIST SP 800-53A Rev 1 add-on security

Incorporation of new or additional hardware, software, or firmware safeguards in an operational information system.

adequate security Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.

Source: OMB Circular A-130 administrative incident (COMSEC)

A violation of procedures or practices dangerous to security that is not serious enough to jeopardize the integrity of a controlled cryptographic item (CCI), but requires corrective action to ensure the violation does not recur or possibly lead to a reportable COMSEC incident.

Source: CNSSI No. 4001 (adapted) advanced encryption standard

(AES)

A U.S. Government-approved cryptographic algorithm that can be used to protect electronic data. The AES algorithm is a symmetric block cipher that can encrypt

(encipher) and decrypt (decipher) information.

Source: FIPS PUB 197 (adapted) advanced key processor (AKP)

A cryptographic device that performs all cryptographic functions for a management client node and contains the interfaces to 1) exchange information with a client platform,

2) interact with fill devices, and 3) connect a client platform securely to the primary services node (PRSN).

advanced persistent threat (APT)

An adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception) to generate opportunities to achieve its objectives, which are typically to establish and extend footholds within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.

Source: NIST SP 800-39 adversary Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.

Source: NIST SP 800-30 Rev 1 advisory (C.F.D.) Notification of significant new trends or developments regarding the threat to the information systems of an organization. This notification may include analytical insights into trends, intentions, technologies, or tactics of an adversary targeting information systems.

Rationale: General definition of a commonly understood term.

agency Any executive department, military department, government corporation, government controlled corporation, or other establishment in the executive branch of the government

(including the Executive Office of the President), or any independent regulatory agency, but does not include -

(i) the General Accounting Office;

(ii) Federal Election Commission;

(iii) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or

(iv) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities.

See also executive agency.

Source: 44 U.S.C., Sec. 3502 air gap An interface between two systems at which (a) they are not connected physically and (b) any logical connection is not automated (i.e., data is transferred through the interface only manually, under human control).

Source: IETF RFC 4949 Ver 2 alert Notification that a specific attack has been directed at an organization’s information systems.

allied nation A nation allied with the U.S. in a current defense effort and with which the U.S. has certain treaties. For an authoritative list of allied nations, contact the Office of the

Assistant Legal Adviser for Treaty Affairs, Office of the Legal Adviser, U.S. Department of State, or see the list of U.S. Collective Defense Arrangements at www.state.gov.

Source: CNSSI No. 4005 (COMSEC) allocation The process an organization employs to determine whether security controls are defined as system-specific, hybrid, or common.

The process an organization employs to assign security controls to specific information system components responsible for providing a particular security capability (e.g., router, server, remote sensor).

Source: NIST SP 800-37 Rev 1 all-source intelligence

Intelligence products and/or organizations and activities that incorporate all sources of information, most frequently human resources intelligence, imagery intelligence, measurement and signature intelligence, signals intelligence, and open source data in the production of finished intelligence.

Source: DoD JP 1-02 (adapted); NIST SP 800-53 Rev 4 (adapted) alternate COMSEC account manager

The primary alternate COMSEC Account Manager is an individual designated by proper authority to perform the duties of the COMSEC Account Manager during the temporary authorized absence of the COMSEC Account Manager. Additional alternate COMSEC

Account Managers may be appointed, as necessary, to assist the COMSEC Account

Manager and maintain continuity of operations.

alternate COMSEC custodian (C.F.D.)

Individual designated by proper authority to perform the duties of the COMSEC custodian during the temporary absence of the COMSEC custodian.

analysis approach The approach used to define the orientation or starting point of the risk assessment, the level of detail in the assessment, and how risks due to similar threat scenarios are treated.

anti-jam The result of measures to resist attempts to interfere with communications reception.

Source: CNSSI No. 1200 anti-signal fingerprint Result of measures used to resist attempts to uniquely identify a particular transmitter based on its signal parameters.

anti-signal spoof Result of measures used to resist attempts to achieve imitative or manipulative communications deception based on signal parameters.

anti-spoof Countermeasures taken to prevent the unauthorized use of legitimate identification & authentication (I&A) data, however it was obtained, to mimic a subject different from the attacker.

anti-tamper (AT) Systems engineering activities intended to deter and/or delay exploitation of critical technologies in a U.S. defense system in order to impede countermeasure development, unintended technology transfer, or alteration of a system.

See tampering.

Source: DoDI 5200.39 application A software program hosted by an information system.

application-specific integrated circuits

(ASICs)

Custom-designed and/or custom-manufactured integrated circuits.

Source: CNSSD No. 505 approval to operate

(ATO) (C.F.D.)

The official management decision issued by a designated accrediting authority (DAA) or principal accrediting authority (PAA) to authorize operation of an information system and to explicitly accept the residual risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals. See authorization to operate (ATO).

Rationale: Term has been replaced by the term “authorization to operate (ATO)”.

assembly An item forming a portion of an equipment, that can be provisioned and replaced as an entity and which normally incorporates replaceable parts and groups of parts.

Source: DoD 4140.1-R; CNSSI No. 4033 assessment See security control assessment or risk assessment.

assessment approach The approach used to assess risk and its contributing risk factors, including quantitatively, qualitatively, or semi-quantitatively.

assessment findings Assessment results produced by the application of an assessment procedure to a security control or control enhancement to achieve an assessment objective; the execution of a determination statement within an assessment procedure by an assessor that results in either a satisfied or other than satisfied condition.

assessment method One of three types of actions (i.e., examine, interview, test) taken by assessors in obtaining evidence during an assessment.

assessment object The item (i.e., specifications, mechanisms, activities, individuals) upon which an assessment method is applied during an assessment.

assessment objective A set of determination statements that expresses the desired outcome for the assessment of a security control or control enhancement.

assessment procedure A set of assessment objectives and an associated set of assessment methods and assessment objects.

assessor See security control assessor or risk assessor.

asset A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems.

asset reporting format A format for expressing the transport format of information about assets and the relationships between assets and reports.

Source: NIST SP 800-126 Rev 2 assurance The grounds for confidence that the set of intended security controls in an information system are effective in their application.

Source: NIST SP 800-27 Rev A (adapted) assurance case A structured set of arguments and a body of evidence showing that an information system satisfies specific claims with respect to a given quality attribute.

Source: NIST SP 800-39; NIST SP 800-53 Rev 4 assured information sharing

The ability to confidently share information with those who need it, when and where they need it, as determined by operational need and an acceptable level of security risk.

assured software Computer application that has been designed, developed, analyzed and tested using processes, tools, and techniques that establish a level of confidence in it.

asymmetric cryptography

See public key cryptography (PKC).

asymmetric key Two related keys, a public key and a private key that are used to perform complementary operations, such as encryption and decryption or signature generation.

Source: FIPS PUB 201-1; NIST IR 7298 Rev 2 attack Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.

attack sensing and warning

(AS&W)

Detection, correlation, identification, and characterization of intentional unauthorized activity with notification to decision makers so that an appropriate response can be developed.

attack signature A specific sequence of events indicative of an unauthorized access attempt.

Source: NIST SP 800-12 attack tree A branching, hierarchical data structure that represents a set of potential approaches to achieving an event in which system security is penetrated or compromised in a specified way.

attended Under continuous positive control of personnel authorized for access or use.

Source: CNSSI No. 4005 (COMSEC); NSA/CSS Manual Number 3-16 (COMSEC) attribute An attribute is any distinctive feature, characteristic, or property of an object that can be identified or isolated quantitatively or qualitatively by either human or automated means.

Source: ISO/IEC 27000 attribute-based access control (ABAC)

Access control based on attributes associated with and about subjects, objects, targets, initiators, resources, or the environment. An access control rule set defines the combination of attributes under which an access may take place.

See also identity, credential, and access management (ICAM).

attribute-based authorization

A structured process that determines when a user is authorized to access information, systems, or services based on attributes of the user and of the information, system, or service.

audit Independent review and examination of records and activities to assess the adequacy of system controls and ensure compliance with established policies and operational procedures.

audit log A chronological record of system activities. Includes records of system accesses and operations performed in a given period.

audit record An individual entry in an audit log related to an audited event.

Source: NIST SP 800-53 Rev 4 audit reduction tools Preprocessors designed to reduce the volume of audit records to facilitate manual review.

Before a security review, these tools can remove many audit records known to have little security significance.

Source: NIST SP 800-12 audit trail 1. A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security relevant transaction from inception to final result.

2. A record showing who has accessed an information technology (IT) system and what operations the user has performed during a given period.

Source: NIST SP 800-47 authenticate To confirm the identity of an entity when that identity is presented.

authentication 1. Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.

Source: FIPS PUB 200; NIST SP 800-27 Rev A

2. A security measure designed to protect a communications system against acceptance of fraudulent transmission or simulation by establishing the validity of a transmission, message, originator, or a means of verifying an individual's eligibility to receive specific categories of information.

authentication mechanism

Hardware or software-based mechanisms that force users to prove their identity before accessing data on a device.

Source: NIST SP 800-72 authentication period The period between any initial authentication process and subsequent re-authentication processes during a single terminal session or during the period data is being accessed.

protocol

1. A well specified message exchange process between a claimant and a verifier that enables the verifier to confirm the claimant’s identity.

2. A defined sequence of messages between a Claimant and a Verifier that demonstrates that the Claimant has possession and control of a valid token to establish his/her identity, and optionally, demonstrates to the Claimant that he or she is communicating with the intended Verifier.

authenticator The means used to confirm the identity of a user, process, or device (e.g., user password or token).

authenticity The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator. See authentication.

Source: NIST SP 800-53 Rev 4; NIST SP 800-53A Rev 1; NIST SP 800-39 authority (C.F.D.) Person(s) or established bodies with rights and responsibilities to exert control in an administrative sphere.

Rationale: General definition of a commonly understood term.

authorization Access privileges granted to a user, program, or process or the act of granting those privileges.

authorization boundary

All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected.

Source: NIST SP 800-53 Rev 4; NIST SP 800-53A Rev 1; NIST SP 800-37 Rev 1 authorization package See security authorization package authorization to operate (ATO)

The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls.

Source: NIST SP 800-53 Rev 4; NIST SP 800-53A Rev 1; NIST SP 800-37 Rev 1 authorize processing See authorization.

Source: NIST SP 800-53 Rev 4; NIST SP 800-37 Rev 1 authorized ID The key management entity (KME) authorized to order against a traditional short title.

authorized user Any appropriately cleared individual with a requirement to access an information system

(IS) for performing or assisting in a lawful government purpose.

Source: DoDD 8570.01 (adapted) authorized vendor Manufacturer of information security (INFOSEC) equipment authorized to produce quantities in excess of contractual requirements for direct sale to eligible buyers. Eligible buyers are typically U.S. Government organizations or U.S. Government contractors.

authorizing official A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

Source: NIST SP 800-37 Rev 1; NIST SP 800-53 Rev 4 authorizing official designated representative

An organizational official acting on behalf of an authorizing official in carrying out and coordinating the required activities associated with security authorization.

Source: NIST SP 800-37 Rev 1; DoDI 8510 automated security monitoring

Use of automated procedures to ensure security controls are not circumvented or the use of these tools to track actions taken by subjects suspected of misusing the information system.

See information security continuous monitoring.

automatic remote rekeying

Procedure to rekey distant cryptographic equipment electronically without specific actions by the receiving terminal operator. See manual remote rekeying.

availability 1. Ensuring timely and reliable access to and use of information.

Source: 44 U.S.C. Sec 3542

2. Timely, reliable access to data and information services for authorized users.

backdoor An undocumented way of gaining access to computer system. A backdoor is a potential security risk.

Source: NIST SP 800-82 Rev 1 backup A copy of files and programs made to facilitate recovery, if necessary.

Source: NIST SP 800-34 Rev 1 banner Display on an information system that sets parameters for system or data use.

baseline Hardware, software, and relevant documentation for an information system at a given point in time.

baseline configuration

A documented set of specifications for an information system, or a configuration item within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures.

basic testing A test methodology that assumes no knowledge of the internal structure and implementation detail of the assessment object. Also known as black box testing.

bastion host A special purpose computer on a network where the computer is specifically designed and configured to withstand attacks.

behavior analysis The act of examining malware interactions within its operating environment including file systems, the registry (if on Windows), the network, as well as other processes and

Operating System components.

Source: CNSSI No. 1011 benign environment A non-hostile location protected from external hostile elements by physical, personnel, and procedural security countermeasures.

bi-directional (CDS) A cross domain device or system with the capability to provide both the transmission and reception of information or data between two or more different security domains (e.g., between TS/SCI and Secret or Secret and Unclassified).

binding Process of associating two related elements of information.

biometric 1. Measurable physical characteristics or personal behavioral traits used to identify, or verify the claimed identity of, an individual. Facial images, fingerprints, and handwriting samples are all examples of biometrics.

Source: FIPS PUB 201-1 (adapted)

2. A physical or behavioral characteristic of a human being.

bit A binary digit having a value of 0 or 1.

Source: FIPS PUB 180-4 bit error rate Ratio between the number of bits incorrectly received and the total number of bits transmitted through a communications channel. Also applies to storage.

BLACK 1. Designation applied to encrypted information and the information systems, the associated areas, circuits, components, and equipment processing that information. See also RED.

Note: Includes BLACK data.

2. Designation applied to information systems, and to associated areas, circuits, components, and equipment, in which national security information is encrypted or is not processed.

Source: CNSSAM TEMPEST/01-13; NSTISSI No. 7002 (adapted) black box testing See basic testing.

black core A communication network architecture in which user data traversing a global internet protocol (IP) network is end-to-end encrypted at the IP layer. Related to striped core.

BLACK data Data that is protected by encryption so that it can be transported or stored without fear of compromise. Also known as encrypted data.

blacklist A list of discrete entities, such as hosts or applications that have been previously determined to be associated with malicious activity.

Also known as dirty word list.

Source: NIST SP 800-94 blacklisting The process used to identify: (i) software programs that are not authorized to execute on an information system; or (ii) prohibited universal resource locators (URL)/websites.

blended attack A type of attack that combines multiple attack methods against one or more vulnerabilities.

Blue Team 1. The group responsible for defending an enterprise’s use of information systems by maintaining its security posture against a group of mock attackers (i.e., the Red Team).

Typically the Blue Team and its supporters must defend against real or simulated attacks

1) over a significant period of time, 2) in a representative operational context (e.g., as part of an operational exercise), and 3) according to rules established and monitored with the help of a neutral group refereeing the simulation or exercise (i.e., the White Team).

2. A group of individuals that conduct operational network vulnerability evaluations and provide mitigation techniques to customers who have a need for an independent technical review of their network security posture. The Blue Team identifies security threats and risks in the operating environment, and in cooperation with the customer, analyzes the network environment and its current state of security readiness. Based on the Blue Team findings and expertise, they provide recommendations that integrate into an overall community security solution to increase the customer's cybersecurity readiness posture.

Often times a Blue Team is employed by itself or prior to a Red Team employment to ensure that the customer's networks are as secure as possible before having the Red Team test the systems.

body of evidence

(BoE)

The set of data that documents the information system’s adherence to the security controls applied.

boundary Physical or logical perimeter of a system.

boundary protection Monitoring and control of communications at the external boundary of an information system to prevent and detect malicious and other unauthorized communications, through the use of boundary protection devices (e.g. gateways, routers, firewalls, guards, encrypted tunnels).

boundary protection device

A device with appropriate mechanisms that: (i) facilitates the adjudication of different interconnected system security policies (e.g., controlling the flow of information into or out of an interconnected system); and/or (ii) provides information system boundary protection.

browsing Act of searching through information system storage or active content to locate or acquire information, without necessarily knowing the existence or format of information being sought.

buffer overflow A condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information. Attackers exploit such a condition to crash a system or to insert specially crafted code that allows them to gain control of the system.

Source: CNSSI No. 1011; NIST SP 800-28 bulk encryption Simultaneous encryption of all channels of a multi-channel telecommunications link.

business continuity plan (BCP)

The documentation of a predetermined set of instructions or procedures that describe how an organization’s mission/business processes will be sustained during and after a significant disruption.

business impact analysis (BIA)

An analysis of an information system’s requirements, functions, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption.

call back Procedure for identifying and authenticating a remote information system terminal, whereby the host system disconnects the terminal and reestablishes contact.

canister (COMSEC)

Type of physical protective packaging used to contain and dispense keying material in punched or printed tape form.

Rationale: Although being phased out, canisters are still in circulation. However term is being marked C.F.D. in anticipation of removal in the future.

cascading (Cross

Domain)

The downward flow of information through a range of security levels greater than the accreditation range of a system, network, or component without passing through an isolated device that implements the enforcement of all applicable approved policy decisions for each domain transfer.

Source: DoDI 8540.01 categorization See security categorization.

Source: NIST SP 800-137 category (C.F.D.) Restrictive label applied to classified or unclassified information to limit access.

central facility (or

Tier 0)

See Tier 0.

Source: CNSSI No. 4032 central office of record (COR)

The entity that keeps records of accountable COMSEC material held by COMSEC accounts subject to its oversight.

central services node

(CSN)

The Key Management Infrastructure core node that provides central security management and data management services.

certificate A digitally signed representation of information that 1) identifies the authority issuing it,

2) identifies the subscriber, 3) identifies its valid operational period (date issued / expiration date). In the information assurance (IA) community, certificate usually implies public key certificate and can have the following types:

A digital representation of information which at least (1) identifies the certification authority (CA) issuing it, (2) names or identifies its subscriber, (3) contains the subscriber’s public key, (4) identifies its operational period, and (5) is digitally signed by the certification authority issuing it.

Source: NIST SP 800-32; CNSSI No. 1300

See cross certificate, encryption certificate, and identity certificate.

certificate authority workstation

(CAW)

The computer system or systems that process certification authority (CA) software and/or have access to the CA private keys, end entity keys, or end entity public keys prior to certification.

Source: NIST CP-1 certificate management

Process whereby certificates (as defined above) are generated, stored, protected, transferred, loaded, used, and destroyed.

certificate policy

(CP)

1. A specialized form of administrative policy tuned to electronic transactions performed during certificate management. A certificate policy addresses all aspects associated with the generation, production, distribution, accounting, compromise recovery, and administration of digital certificates. Indirectly, a certificate policy can also govern the transactions conducted using a communications system protected by a certificate-based security system. By controlling critical certificate extensions, such policies and associated enforcement technology can support provision of the security services required by particular applications.

2. A named set of rules that indicates the applicability of a certificate to a particular community and/or class of application with common security requirements. For example, a particular CP might indicate applicability of a type of certificate to the authentication of parties engaging in business-to-business transactions for the trading of goods or services within a given price range.

certificate revocation list (CRL)

1. A list of revoked public key certificates created and digitally signed by a Certificate

Authority.

Source: NIST SP 800-63-2; FIPS PUB 201-1

2. These are digitally signed “blacklists” of revoked certificates. Certification authorities

(CAs) periodically issue certificate revocation lists (CRLs), and users can retrieve them on demand via repositories.

certificate status authority (CSA)

A trusted entity that provides on-line verification to a relying party of a subject certificate's trustworthiness, and may also provide additional attribute information for the subject certificate.

certificate status server (CSS)

An authority that provides status information about certificates on behalf of the CA through online transactions (e.g., an online certificate status protocol (OCSP) responder).

certificate-related information

Information, such as subscriber’s postal address, that is not included in a certificate. May be used by a certification authority (CA) managing certificates.

certification Comprehensive evaluation of an information system component that establishes the extent to which a particular design and implementation meets a set of specified security requirements.

certification analyst

The independent technical liaison for all stakeholders involved in the certification and accreditation (C&A) process responsible for objectively and independently evaluating a system as part of the risk management process. Based on the security requirements documented in the security plan, performs a technical and non-technical review of potential vulnerabilities in the system and determines if the security controls

(management, operational, and technical) are correctly implemented and effective.

certification authority

(CA)

An entity authorized to create, sign, issue, and revoke public key certificates.

Source: CNSSI No. 1300 (adapted) certification authority workstation (CAW)

(C.F.D.)

Commercial-off-the-shelf (COTS) workstation with a trusted operating system and special purpose application software that is used to issue certificates.

Rationale: Term has been replaced by the term “certificate authority workstation

(CAW)”.

certification package

Product of the certification effort documenting the detailed results of the certification activities.

and it is called security assessment report (SAR).

certification practice statement (CPS)

A statement of the practices that a certification authority (CA) employs in issuing, suspending, revoking, and renewing certificates and providing access to them, in accordance with specific requirements (i.e., requirements specified in this Certificate

Policy, or requirements specified in a contract for services).

certification test and evaluation

(CT&E)

Software and hardware security tests conducted during development of an information system component.

certified TEMPEST technical authority (CTTA)

An experienced, technically qualified U.S. Government employee who has met established certification requirements in accordance with CNSS approved criteria and has been appointed by a U.S. Government Department or Agency to fulfill CTTA responsibilities.

Source: CNSSAM TEMPEST/01-13 certifier (C.F.D.) Individual responsible for making a technical judgment of the system’s compliance with stated requirements, identifying and assessing the risks associated with operating the system, coordinating the certification activities, and consolidating the final certification and accreditation packages.

Rationale: Term has been replaced by the term “security control assessor”.

chain of custody A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.

Source: NIST SP 800-72 chain of evidence

A process and record that shows who obtained the evidence; where and when the evidence was obtained; who secured the evidence; and who had control or possession of the evidence. The “sequencing” of the chain of evidence follows this order: collection and identification; analysis; storage; preservation; presentation in court; return to owner.

Rationale: Sufficiently covered under chain of custody.

chaining Direct or relayed connections from a higher accredited domain to a series of lower accredited domains without passing through an isolated device that implements the enforcement of all applicable approved policy decisions for each domain transfer.

challenge and reply

Prearranged procedure in which a subject requests authentication of another and the latter establishes validity with a correct reply.

check word Cipher text generated by cryptographic logic to detect failures in cryptography.

checksum A value that (a) is computed by a function that is dependent on the contents of a data object and (b) is stored or transmitted together with the object, for detecting changes in the data.

chief information officer (CIO)

Agency official responsible for: (1) providing advice and other assistance to the head of the executive agency and other senior management personnel of the agency to ensure that information systems are acquired and information resources are managed in a manner that is consistent with laws, Executive Orders, directives, policies, regulations, and priorities established by the head of the agency; (2) developing, maintaining, and facilitating the implementation of a sound and integrated information system architecture for the agency; and (3) promoting the effective and efficient design and operation of all major information resources management processes for the agency, including improvements to work processes of the agency.

Note: Organizations subordinate to federal agencies may use the term Chief Information

Officer to denote individuals filling positions with similar security responsibilities to agency-level Chief Information Officers.

Source: 40 U.S.C. Sec. 1425 (b); NIST SP 800-53 Rev 4 chief information security officer

(CISO)

See senior agency information security officer (SAISO).

Source: FIPS PUB 200 cipher 1. Any cryptographic system in which arbitrary symbols or groups of symbols, represent units of plain text, or in which units of plain text are rearranged, or both.

2. Series of transformations that converts plaintext to ciphertext using the Cipher Key.

Source: FIPS PUB 197 cipher text auto-key

(CTAK)

Cryptographic logic that uses previous cipher text to generate a key stream.

cipher text/ciphertext Data in its encrypted form.

See BLACK.

Source: NIST SP 800-57 Part 1 Rev 3 claimant A party whose identity is to be verified using an authentication protocol.

Source: FIPS PUB 201-1; NIST SP 800-63-2 classified information See classified national security information.

classified information spillage (C.F.D.)

Security incident that occurs whenever classified data is spilled either onto an unclassified information system or to an information system with a lower level of classification or different security category.

Rationale: Spillage encompasses this term.

classified national security information

Information that has been determined pursuant to Executive Order (E.O.) 13526 or any predecessor order to require protection against unauthorized disclosure and is marked to indicate its classified status when in documentary form.

Source: E.O. 13526 clean word list List of words that have been pre-defined as being acceptable for transmission and may be used in conjunction with a dirty word list to avoid false positives (e.g., secret within secretary). See white list.

clear text Intelligible data, the semantic content of which is available.

Source: ISO/IEC 7498-2

Note: Clear text data is, by definition, not encrypted.

clearance A formal security determination by an authorized adjudicative office that an individual is authorized access, on a need to know basis, to a specific level of classified information

(TOP SECRET, SECRET, or CONFIDENTIAL).

clear A method of sanitization that applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques; typically applied through the standard Read and Write commands to the storage device, such as by rewriting with a new value or using a menu option to reset the device to the factory state (where rewriting is not supported).

Source: NIST SP 800-88 Rev 1 client node Enables customers to access primary services nodes (PRSNs) to obtain key management infrastructure (KMI) products and services and to generate, produce, and distribute traditional (symmetric) key products. The management client (MGC) configuration of the client node allows customers to operate locally, independent of a PRSN.

closed security environment

Environment providing sufficient assurance that applications and equipment are protected against the introduction of malicious logic during an information system life cycle. Closed security is based upon a system's developers, operators, and maintenance personnel having sufficient clearances, authorization, and configuration control.

closed storage The storage of classified information in properly secured General Services

Administration-approved security containers.

Source: ICS 700-1 cloud computing A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

Source: NIST SP 800-145 coalition partner A nation in an ad hoc defense arrangement with the U.S.

code 1. A set of instructions for a computer.

Source: www.merrianwebster.com

2. System of communication in which arbitrary groups of letters, numbers, or symbols represent units of plain text of varying length.

Source: NSTISSI No. 7002 code analysis The act of reverse-engineering the malicious program to understand the code that implements the software behavior. For example, when looking at compiled programs, the process involves using a disassembler, a debugger, and perhaps a decompiler to examine the program’s low-level assembly or byte-code instructions. A disassembler converts the instructions from their binary form into the human-readable assembly form. A decompiler attempts to recreate the original source code of the program. A debugger allows the analyst to step through the code, interacting with it, and observing the effects of its instructions to understand its purpose.

Source: CNSSI No. 1011 codebook Document containing plain text and code equivalents in a systematic arrangement, or a technique of machine encryption using a word substitution technique.

code group (C.F.D.) Group of letters, numbers, or both in a code system used to represent a plain text word, phrase, or sentence.

code vocabulary

Set of plain text words, numerals, phrases, or sentences for which code equivalents are assigned in a code system.

cognizant security officer/authority

1. An entity charged with responsibility for physical, technical, personnel, and information security affecting that organization.

2. The single principal designated by a Senior Official of the Intelligence Community

(SOIC) to serve as the responsible official for all aspects of security program management concerning the protection of national intelligence, sources and methods, under SOIC responsibility.

cold site A backup facility that has the necessary electrical and physical components of a computer facility, but does not have the computer equipment in place. The site is ready to receive the necessary replacement computer equipment in the event that the user has to move from their main computing location to an alternate site.

collateral information National security information (including intelligence information) classified Top Secret, Secret, or Confidential that is not in the Sensitive Compartmented Information (SCI) or

Special Access Program (SAP) category.

com…