NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms
TOE Security Functions (TSF) – Set consisting of all hardware, software, and firmware of the TOE
that must be relied upon for the correct enforcement of the TOE
Security Policy (TSP).
SOURCE: CNSSI-4009
TOE Security Policy (TSP) – Set of rules that regulate how assets are managed, protected, and
distributed within the TOE.
SOURCE: CNSSI-4009
Token – Something that the claimant possesses and controls (typically a key
or password) used to authenticate the claimant’s identity.
SOURCE: SP 800-63
Something that the claimant possesses and controls (such as a key or
password) that is used to authenticate a claim. See also
cryptographic token.
SOURCE: CNSSI-4009
Total Risk – The potential for the occurrence of an adverse event if no mitigating
action is taken (i.e., the potential for any applicable threat to exploit a
system vulnerability).
SOURCE: SP 800-16
Tracking Cookie – A cookie placed on a user’s computer to track the user’s activity on
different Web sites, creating a detailed profile of the user’s behavior.
SOURCE: SP 800-83
Tradecraft Identity – An identity used for the purpose of work-related interactions that
may or may not be synonymous with an individual’s true identity.
SOURCE: CNSSI-4009
Traditional INFOSEC Program – Program in which NSA acts as the central procurement agency for
the development and, in some cases, the production of INFOSEC
items. This includes the Authorized Vendor Program. Modifications
to the INFOSEC end-items used in products developed and/or
produced under these programs must be approved by NSA.
SOURCE: CNSSI-4009
Traffic Analysis – A form of passive attack in which an intruder observes information
about calls (although not necessarily the contents of the messages)
and makes inferences, e.g., from the source and destination numbers,
or frequency and length of the messages.
SOURCE: SP 800-24
Pg 193