CISSP For Dummies

In a PKI infrastructure, the CA issues certificates, maintains and publishes status information and Certificate Revocation Lists (CRLs), and maintains archives. See also PKI.

The protocol used to transmit the calling party’s telephone number to the called party’s telephone equipment during the establishment of a telephone call.

Campus area network.

One of four operating modes for DES. (See also CFB, ECB, DES, and OFB). Operates on 64-bit blocks of plaintext to produce 64-bit blocks of ciphertext. Each block is XORed (see also XOR) with the ciphertext of the preceding block creating a dependency or chain, thereby producing a more random ciphertext result. This is the most common mode of DES operation.

In biometric access control systems, the point at which the FRR equals the FAR, stated as a percentage. See also FAR, FRR.

CERT. See CIRT.

A formal methodology for comprehensive testing and documentation of information system security safeguards, both technical and nontechnical, in a given environment using established evaluation criteria.

One of four operating modes for DES. (See also CBC, DES, ECB, and OFB.) CFB is a stream cipher most often used to encrypt

individual characters. In this mode, previously generated ciphertext is used as feedback for key generation in the next key stream and the resulting ciphertext is chained together.

Provides accountability and protection for evidence throughout its entire life cycle.

The formal business process that ensures that all changes made to a system are properly requested, reviewed, approved, and implemented.

A remote access control protocol that uses a three-way handshake to authenticate both a peer and a server.

Confidentiality, integrity, and availability.

A cryptographic transformation.

A plaintext message that has been transformed (encrypted) into a scrambled message that is unintelligible.

Relevant facts that can’t be directly or conclusively connected to other events but about which a reasonable inference can be made.

A team comprising individuals properly trained in incident response and investigation.

Addresses wrongful acts committed against an individual or business, either willfully or negligently, resulting in damage, loss, injury, or death.

A formal integrity model that addresses all three goals of integrity and identifies special requirements for inputting data.

The process of assigning a document with a security label that defines how the document should be handled.

A system that uses proprietary hardware and/or software that may not be compatible with other systems or components. See also Open system.

Occurs when identical ciphertext messages are generated from a plaintext message by using the same encryption algorithm but different encryption keys.

An alternate computer facility with electricity and HVAC but no computer equipment located on site. See also HVAC.

An international effort to standardize and improve existing European and North American information systems security evaluation criteria.

Controls that are implemented as an alternative to other preventive, detective, corrective, deterrent, or recovery controls.

Actual damages to the victim including attorney/legal fees, lost profits, investigative costs, and so on.

A microprocessor instruction set architecture in which each instruction can execute several low-level operations. See also RISC.

A technique of hiding a message in plain sight. The key is knowing where the message lies.

See Hub.

Incontrovertible and irrefutable . . . you know, the smoking gun.

Prevents the unauthorized use or disclosure of information, ensuring that information is accessible only to those authorized to have access to the information.

The process of recording all changes to information systems.

A form of protection granted to the author(s) of “original works of authorship,” both published and unpublished.

Controls that remedy violations and incidents or improve existing preventive and detective controls.

Supports or substantiates other evidence presented in a case.

An unintended communications path. May be a covert storage channel or covert timing channel.

The electronic circuitry that performs a computer’s arithmetic, logic, and computing functions.

Defines those crimes committed against society, even when the actual victim is a business or individual(s). Criminal laws are enacted to protect the general public.

The part of a Business Impact Assessment that ranks the criticality of business processes and IT systems. See also Business Impact Assessment.

The science of deciphering ciphertext without the cryptographic key.

The science of encrypting and decrypting information, such as a private message, to protect its confidentiality, integrity, and/or authenticity.

The science that encompasses both cryptography and cryptanalysis.

The hardware or software implementation that transforms plaintext into ciphertext (encrypts) and back into plaintext (decrypts).

A secret value applied to the algorithm. The strength and effectiveness of the cryptosystem is largely dependent upon the secrecy and strength of the cryptovariable.

An organization that fails to follow a standard of due care in the protection of its assets may be held culpably negligent. See also Due care.

An individual with day-to-day responsibility for protecting information assets.