NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms
Operations Security (OPSEC) – Systematic and proven process by which potential adversaries can be
denied information about capabilities and intentions by identifying,
controlling, and protecting generally unclassified evidence of the
planning and execution of sensitive activities. The process involves
five steps: identification of critical information, analysis of threats,
analysis of vulnerabilities, assessment of risks, and application of
appropriate countermeasures.
SOURCE: CNSSI-4009
Optional Modification – NSA-approved modification not required for universal
implementation by all holders of a COMSEC end-item. This class of
modification requires all of the engineering/doctrinal control of
mandatory modification but is usually not related to security, safety,
TEMPEST, or reliability. See mandatory modification.
SOURCE: CNSSI-4009
Organization – A federal agency, or, as appropriate, any of its operational elements.
SOURCE: FIPS 200
An entity of any size, complexity, or positioning within an
organizational structure (e.g., a federal agency, or, as appropriate, any
of its operational elements).
SOURCE: SP 800-53; SP 800-53A; SP 800-37
Organizational Maintenance – Limited maintenance performed by a user organization.
SOURCE: CNSSI-4009
Organizational Registration
Authority (ORA) –
Entity within the PKI that authenticates the identity and the
organizational affiliation of the users.
SOURCE: CNSSI-4009
Organizational User – An organizational employee or an individual the organization deems
to have equivalent status of an employee (e.g., contractor, guest
researcher, individual detailed from another organization, individual
from allied nation).
SOURCE: SP 800-53
Outside Threat – An unauthorized entity from outside the domain perimeter that has
the potential to harm an Information System through destruction,
disclosure, modification of data, and/or denial of service.
SOURCE: SP 800-32
Outside(r) Threat – An unauthorized entity outside the security domain that has the
potential to harm an information system through destruction,
disclosure, modification of data, and/or denial of service.
SOURCE: CNSSI-4009
Pg 132