Cybersecurity: Module 8

The selective method by which systems specify who may use a particular resource and how they may use it.

Access controls that are implemented at the judgment or option of the data user.

Access controls that are implemented by a central authority.

A variation on mandatory access controls that assigns users a matrix of authorizations for particular areas of access, incorporating the information assets of subjects such as users and objects.

A nondiscretionary control where privileges are tied to the role or job a user performs in an organization and are inherited when a user is assigned to that role.

A nondiscretionary control where privileges are tied to a task or temporary assignment a user performs in an organization and are inherited when a user is assigned to that task.

A required, structured data classification scheme that assigns a sensitivity or classification rating to each collection of information as well as each user.

An access control approach whereby the organization specifies the use of objects based on some attribute of the user or system.

A characteristic of a subject (user or system) that can be used to restrict access to an object

The access control mechanism whereby unverified or unauthenticated entities who seek access to a resource provide a label or username by which they are known to the system.

The access control mechanism that requires the validation and verification of an entity’s unsubstantiated identity.

Mechanisms that provide authentication based on something an unauthenticated entity knows, has, and is.

A secret word or combination of characters that only the user should know; it is used to authenticate the user.

A plain-language phrase, typically longer than a password, from which a virtual password is derived.

A stream of characters generated by taking elements from an easily remembered phrase.

An authentication card that contains digital user data, such as a personal identification number, against which user input is compared.

An authentication component similar to a dumb card that contains a computer chip to verify and validate several pieces of information instead of just a personal identification number.

An authentication component in the form of a card or fob that contains a computer chip and a display that shows a computer-generated number used to support remote login authentication; the token must be calibrated with the corresponding software on a central authentication server.

An authentication component in the form of a card or fob that contains a computer chip and a display that shows a computer-generated number used to support remote login authentication; the token does not require calibration of the central authentication server but uses a challengeesponse system instead.

In access control, the use of at least two different authentication mechanisms drawn from two or more different factors of authentication; this is sometimes called multifactor or dual-factor authentication.

The access control mechanism that represents the matching of an authenticated entity to a list of information assets and corresponding access levels.

The access control mechanism that ensures all actions on a system—authorized or unauthorized—can be attributed to an authenticated identity

The use of physiological characteristics to provide authentication for a provided identification

In biometric access controls, unique points of reference that are digitized and stored in an encrypted format when the user’s system access credentials are created, and are then used in subsequent requests for access to authenticate the user’s identity.

The rate at which authentic users are denied or prevented access to authorized areas as a result of a failure in the biometric device

The rate at which fraudulent users or nonusers are allowed access to systems or areas as a result of a failure in the biometric device

The point at which the rate of false rejections equals the rate of false acceptances

Under the Trusted Computer System Evaluation Criteria (TCSEC), the combination of all hardware, firmware, and software responsible for enforcing the security policy.

Within the trusted computing base, a conceptual piece of the system that manages access controls.

Unauthorized or unintended methods of communications hidden inside a computer system.

TCSEC-defined covert channels that communicate by modifying a stored object, as in steganography.

TCSEC-defined covert channels that communicate by managing the relative timing of events.

An approach to access control in IT networks that does not rely on trusting devices or network connections; rather, it relies on mutual authentication to verify the identity and integrity of devices, regardless of their location.

In information security, a combination of hardware and software that filters or prevents specific information from moving between the outside network and the inside network.

The system of networks outside the organization over which the organization has no control, such as the Internet.

The system of networks inside the organization that contains its information assets and is under the organization’s control.

A networking device that examines the header information of data packets that come into a network and determines whether to drop them (deny) or forward them to the next network connection (allow), based on its configuration rules.

A firewall type that requires the configuration rules to be manually created, sequenced, and modified within the firewall.

A firewall type that can react to network traffic and create or modify its configuration rules to adapt.

A firewall type that keeps track of each network connection between internal and external systems using a state table and that expedites the filtering of those communications; also known as a stateful inspection firewall.

Firewall rules designed to prohibit packets with certain addresses or partial addresses from passing through the device.

A tabular record of the state and context of each packet in a conversation between an internal and external user or system; used to expedite traffic filtering.

A device capable of functioning both as a firewall and an application layer proxy server.

A device capable of functioning both as a firewall and an application layer proxy server.

A server that exists to intercept requests for information from external users and provide the requested information by retrieving it from an internal server, thus protecting and minimizing the demand on internal servers

An intermediate area designed to provide servers and firewall filtering between a trusted internal network and the outside, untrusted network.

A firewall designed to operate at the media access control sublayer of the network’s data link layer (Layer 2).

Networking devices categorized by their ability to perform the work of multiple devices, such as stateful packet inspection firewalls, network intrusion detection and prevention systems (IDPSs), content filters, spam filters, and malware scanners and filters.

A security appliance that delivers Unified Threat Management capabilities in a single integrated device.

A device placed between an external, untrusted network and an internal, trusted network

A device placed between an external, untrusted network and an internal, trusted network

A networking scheme in which multiple real, routable external IP addresses are converted to special ranges of internal IP addresses, usually on a one-to-one basis; that is, one external valid address directly maps to one assigned internal address.

A networking scheme in which multiple real, routable external IP addresses are converted to special ranges of internal IP addresses, usually on a one-to-many basis; that is, one external valid address is mapped dynamically to a range of internal addresses by adding a unique port number to the address when traffic leaves the private network and is placed on the public network.

A firewall architectural model that combines the packet-filtering router with a second, dedicated device such as a proxy server or proxy firewall.

A firewall architectural model that consists of one or more internal bastion hosts located behind a packet-filtering router on a dedicated network segment, with each host performing a role in protecting the trusted network.

A segment of the DMZ where additional authentication and authorization controls are put into place to provide services that are not available to the general public.

A software program or hardware/software appliance that allows administrators to restrict content that comes into or leaves a network.

A software program or hardware/software appliance that allows administrators to restrict content that comes into or leaves a network.

A strategy to ensure that the users of a network do not send high-value information or other critical information outside the network without authorization.

An automatic phone-dialing program that dials every number in a configured range and checks whether a person, voicemail, or modem picks up.

A computer connection system that centralizes the management of user authentication by placing the responsibility for authenticating each user on a central authentication server.

An authentication system that uses symmetric key encryption to validate an individual user’s access to various network resources by keeping a database containing the private keys of clients and servers that are in the authentication domain it supervises.

A private, secure network operated over a public and insecure network; it uses encryption to protect the data between endpoints.

Also known as a legacy VPN, a VPN implementation that uses leased circuits from a service provider who gives contractual assurance that no one else is allowed to use these circuits and that they are properly maintained and protected.

A VPN implementation that uses security protocols to encrypt traffic transmitted across unsecured public networks.

A combination of trusted and secure VPN implementations.

The recognition that there is no clear information security boundary between an organization and the outside world, meaning that the organization must be prepared to protect its information both inside and outside its digital walls.