Chapter 1 acronyms

a response to risk that acknowledges the risk but takes no steps to address it.

Security controls for developing and ensuring that policies and procedures are carried out; regulating the human factors of security.

A new class of attack that uses innovative attack tools to infect a system and then silently extracts data over an extended period.

Deficiencies in software due to poor design.

An item that has value.

Characteristic features of different groups of threat actors.

Security actions that ensure that data is accessible to authorized users.

A response to risk that identifies the risk and the decision is made to not engage in the risk-provoking activity.

Threat actors that launch attack against an opponents’ system to steal classified information.

Security actions that ensure that only authorized parties can view the information.

Having different groups responsible for regulating access to a system.

The out-of-the-box security configuration settings.

Creating multiple layers of security defenses through which an attacker must penetrate; also called layered security.

System for which vendors have dropped all support for security updates due to the system’s age.

The location outside an enterprise in which some threat actors perform.

An attribute of threat actors that can vary widely.

A group of threat actors that is strongly motivated by ideology.

Software that does not properly trap an error condition and provides an attacker with underlying access to the system.

Software that allows the user to enter data but does not validate or filter user input to prevent a malicious action.

Account set up for a user that might provide more access than is necessary.

Frameworks/architectures that are specific to a particular industry or market sector.

“Supporting structures” for implementing security; also called reference architectures.

Employees, contractors, and business partners who can be responsible for an attack.

Security actions that ensure that the information is correct and no unauthorized person or malicious software has altered the data.

The reasoning behind attacks made by threat actors.

The reasoning behind attacks made by threat actors.

The location within an enterprise in which some threat actors perform.

Information security framework/architectures that are worldwide.

When the company that made a device provides no support for the device.

Creating multiple layers of security defenses through which an attacker must penetrate; also called defense-in-depth.

An incorrectly configured device.

Addressing risks by making risks less serious.

State-sponsored attackers employed by a government for launching computer attacks against foes.

Information security framework/architectures that are domestic.

A threat that has not been previously identified.

Information security frameworks/architectures that are not required.

Freely available automated attack software.

Threat actors that are moving from traditional organized criminal activities to more rewarding and less risky online attacks

A software occurrence when two concurrent threads of execution access a shared resource simultaneously, resulting in unintended consequences.

“Supporting structures” for implementing security; also called industry-standard frameworks.

Information security frameworks/architectures that are required by

A situation in which a hardware device with limited resources (CPU, memory, file system storage, etc.) is exploited by an attacker who intentionally tries to consume more resources than intended.

A situation that involves exposure to danger.

Different options available when dealing with risks.

Individual who lacks advanced knowledge of computers and networks and so uses downloaded automated attack software to attack information systems.

Threat actors that have developed a high degree of complexity.

The widespread proliferation of devices across an enterprise.

Using technology that is carried out or managed by devices as a basis for controlling the access to and usage of sensitive data.

A type of action that has the potential to cause harm.

A person or element that has the power to carry out a threat.

A response to risk that allows a third party to assume the responsibility of the risk.

Devices that are not formally identified or documented in an enterprise.

Users with little or no instruction in making security decisions.

Instructing employees as to the security reasons behind security restrictions.

Using security products provided by different manufacturers.

A flaw or weakness that allows a threat agent to bypass security.

A situation in which an attacker manipulates commonplace actions that are routinely performed; also called business process compromise.

Configuration options that provide limited security choices.

An attack in which there are no days of warning.