NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms
IT-Related Risk – The net mission/business impact considering
1) the likelihood that a particular threat source will exploit, or
trigger, a particular information system vulnerability, and
2) the resulting impact if this should occur. IT-related risks arise
from legal liability or mission/business loss due to, but not limited
to:
Unauthorized (malicious, non-malicious, or accidental)
disclosure, modification, or destruction of information;
Non-malicious errors and omissions;
IT disruptions due to natural or man-made disasters; or
Failure to exercise due care and diligence in the
implementation and operation of the IT.
SOURCE: SP 800-27
IT Security Architecture – A description of security principles and an overall approach for
complying with the principles that drive the system design; i.e.,
guidelines on the placement and implementation of specific security
services within various distributed computing environments.
SOURCE: SP 800-27
IT Security Awareness – The purpose of awareness presentations is simply to focus attention
on security. Awareness presentations are intended to allow
individuals to recognize IT security concerns and respond
accordingly.
SOURCE: SP 800-50
IT Security Awareness and Training
Program –
Explains proper rules of behavior for the use of agency IT systems
and information. The program communicates IT security policies and
procedures that need to be followed.
SOURCE: SP 800-50
Explains proper rules of behavior for the use of agency information
systems and information. The program communicates IT security
policies and procedures that need to be followed (i.e., NSTISSD 501,
NIST SP 800-50).
SOURCE: CNSSI-4009
IT Security Education – IT Security Education seeks to integrate all of the security skills and
competencies of the various functional specialties into a common
body of knowledge, adds a multidisciplinary study of concepts,
issues, and principles (technological and social), and strives to
produce IT security specialists and professionals capable of vision
and proactive response.
SOURCE: SP 800-50
Pg 103