NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms
National Vulnerability Database –
(NVD)
Any information system (including any telecommunications system)
used or operated by an agency or by a contractor of any agency, or
other organization on behalf of an agency, the function, operation, or
use of which: I. involves intelligence activities; II. involves
cryptologic activities related to national security; III. Involves
command and control of military forces; IV. involves equipment that
is an integral part of a weapon or weapon system; or V. subject to
subparagraph (B), is critical to the direct fulfillment of military or
intelligence missions; or is protected at all times by procedures
established for information that have been specifically authorized
under criteria established by an Executive Order or an Act of
Congress to be kept classified in the interest of national defense or
foreign policy.
Subparagraph (B). Does not include a system that is to be used for
routine administrative and business applications (including payroll,
finance, logistics, and personnel management applications). (Title 44
U.S. Code Section 3542, Federal Information Security Management
Act of 2002.)
SOURCE: CNSSI-4009
The U.S. government repository of standards-based vulnerability
management data. This data enables automation of vulnerability
management, security measurement, and compliance (e.g., FISMA).
SOURCE: http://nvd.nist.gov/
Need To Know Determination – Decision made by an authorized holder of official information that a
prospective recipient requires access to specific official information
to carry out official duties.
SOURCE: CNSSI-4009
Need-To-Know – A method of isolating information resources based on a user’s need
to have access to that resource in order to perform their job but no
more. The terms ‘need-to know” and “least privilege” express the
same idea. Need-to-know is generally applied to people, while least
privilege is generally applied to processes.
SOURCE: CNSSI-4009
Needs Assessment (IT Security
Awareness and Training) –
A process that can be used to determine an organization’s awareness
and training needs. The results of a needs assessment can provide
justification to convince management to allocate adequate resources
to meet the identified awareness and training needs.
SOURCE: SP 800-50
Pg 125