NISTIR 7298 Revision 1, Glossary of Key Information Security Terms
NISTIR 7298 Revision 1, Glossary of Key Information Security Terms NISTIR 7298 Revision 1, Glossary of Key Information Security Terms
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Communications Security – (COMSEC) A component of Information Assurance that deals with measures and controls taken to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications. COMSEC includes crypto security, transmission security, emissions security, and physical security of COMSEC material. SOURCE: CNSSI-4009 Community of Interest (COI) – A collaborative group of users who exchange information in pursuit of their shared goals, interests, missions, or business processes, and who therefore must have a shared vocabulary for the information they exchange. The group exchanges information within and between systems to include security domains. SOURCE: CNSSI-4009 Community Risk – Probability that a particular vulnerability will be exploited within an interacting population and adversely impact some members of that population. SOURCE: CNSSI-4009 Comparison – The process of comparing a biometric with a previously stored reference. SOURCE: FIPS 201 Compartmentalization – A nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone. SOURCE: CNSSI-4009 Compartmented Mode – Mode of operation wherein each user with direct or indirect access to a system, its peripherals, remote terminals, or remote hosts has all of the following: (1) valid security clearance for the most restricted information processed in the system; (2) formal access approval and signed nondisclosure agreements for that information which a user is to have access; and (3) valid need-to-know for information which a user is to have access. SOURCE: CNSSI-4009 Pg 38
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Compensating Security Control – A management, operational, and/or technical control (i.e., safeguard or countermeasure) employed by an organization in lieu of a recommended security control in the low, moderate, or high baselines that provides equivalent or comparable protection for an information system. NIST SP 800-53: A management, operational, and technical control (i.e., safeguard or countermeasure) employed by an organization in lieu of the recommended control in the baselines described in NIST Special Publication 800-53 or in CNSS Instruction 1253, that provide equivalent or comparable protection for an information system. SOURCE: CNSSI-4009 Compensating Security Controls – The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the low, moderate, or high baselines described in NIST Special Publication 800-53, that provide equivalent or comparable protection for an information system. SOURCE: SP 800-37 The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described in NIST Special Publication 800-53 and CNSS Instruction 1253, that provide equivalent or comparable protection for an information system. SOURCE: SP 800-53A; SP 800-53 Comprehensive Testing – A test methodology that assumes explicit and substantial knowledge of the internal structure and implementation detail of the assessment object. Also known as white box testing. SOURCE: SP 800-53A Compromise – Disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred. SOURCE: SP 800-32 Compromise – The unauthorized disclosure, modification, substitution, or use of sensitive data (including plaintext cryptographic keys and other CSPs). SOURCE: FIPS 140-2 Pg 39
- Page 2 and 3: NIST IR 7298 Revision 1 Glossary of
- Page 4 and 5: NIST IR 7298 Revision 1, Glossary o
- Page 6 and 7: NIST IR 7298 Revision 1, Glossary o
- Page 8 and 9: NIST IR 7298 Revision 1, Glossary o
- Page 10 and 11: NIST IR 7298 Revision 1, Glossary o
- Page 12 and 13: NIST IR 7298 Revision 1, Glossary o
- Page 14 and 15: NIST IR 7298 Revision 1, Glossary o
- Page 16 and 17: NIST IR 7298 Revision 1, Glossary o
- Page 18 and 19: NIST IR 7298 Revision 1, Glossary o
- Page 20 and 21: NIST IR 7298 Revision 1, Glossary o
- Page 22 and 23: NIST IR 7298 Revision 1, Glossary o
- Page 24 and 25: NIST IR 7298 Revision 1, Glossary o
- Page 26 and 27: NIST IR 7298 Revision 1, Glossary o
- Page 28 and 29: NIST IR 7298 Revision 1, Glossary o
- Page 30 and 31: NIST IR 7298 Revision 1, Glossary o
- Page 32 and 33: NIST IR 7298 Revision 1, Glossary o
- Page 34 and 35: NIST IR 7298 Revision 1, Glossary o
- Page 36 and 37: NIST IR 7298 Revision 1, Glossary o
- Page 40 and 41: NIST IR 7298 Revision 1, Glossary o
- Page 42 and 43: NIST IR 7298 Revision 1, Glossary o
- Page 44 and 45: NIST IR 7298 Revision 1, Glossary o
- Page 46 and 47: NIST IR 7298 Revision 1, Glossary o
- Page 48 and 49: NIST IR 7298 Revision 1, Glossary o
- Page 50 and 51: NIST IR 7298 Revision 1, Glossary o
- Page 52 and 53: NIST IR 7298 Revision 1, Glossary o
- Page 54 and 55: NIST IR 7298 Revision 1, Glossary o
- Page 56 and 57: NIST IR 7298 Revision 1, Glossary o
- Page 58 and 59: NIST IR 7298 Revision 1, Glossary o
- Page 60 and 61: NIST IR 7298 Revision 1, Glossary o
- Page 62 and 63: NIST IR 7298 Revision 1, Glossary o
- Page 64 and 65: NIST IR 7298 Revision 1, Glossary o
- Page 66 and 67: NIST IR 7298 Revision 1, Glossary o
- Page 68 and 69: NIST IR 7298 Revision 1, Glossary o
- Page 70 and 71: NIST IR 7298 Revision 1, Glossary o
- Page 72 and 73: NIST IR 7298 Revision 1, Glossary o
- Page 74 and 75: NIST IR 7298 Revision 1, Glossary o
- Page 76 and 77: NIST IR 7298 Revision 1, Glossary o
- Page 78 and 79: NIST IR 7298 Revision 1, Glossary o
- Page 80 and 81: NIST IR 7298 Revision 1, Glossary o
- Page 82 and 83: NIST IR 7298 Revision 1, Glossary o
- Page 84 and 85: NIST IR 7298 Revision 1, Glossary o
- Page 86 and 87: NIST IR 7298 Revision 1, Glossary o
NIST IR <strong>7298</strong> <strong>Revision</strong> 1, <strong>Glossary</strong> <strong>of</strong> <strong>Key</strong> <strong>Information</strong> <strong>Security</strong> <strong>Terms</strong><br />
Communications <strong>Security</strong> –<br />
(COMSEC)<br />
A component <strong>of</strong> <strong>Information</strong> Assurance that deals with measures and<br />
controls taken to deny unauthorized persons information derived<br />
from telecommunications and to ensure the authenticity <strong>of</strong> such<br />
telecommunications. COMSEC includes crypto security,<br />
transmission security, emissions security, and physical security <strong>of</strong><br />
COMSEC material.<br />
SOURCE: CNSSI-4009<br />
Community <strong>of</strong> Interest (COI) – A collaborative group <strong>of</strong> users who exchange information in pursuit<br />
<strong>of</strong> their shared goals, interests, missions, or business processes, and<br />
who therefore must have a shared vocabulary for the information<br />
they exchange. The group exchanges information within and<br />
between systems to include security domains.<br />
SOURCE: CNSSI-4009<br />
Community Risk – Probability that a particular vulnerability will be exploited within an<br />
interacting population and adversely impact some members <strong>of</strong> that<br />
population.<br />
SOURCE: CNSSI-4009<br />
Comparison – The process <strong>of</strong> comparing a biometric with a previously stored<br />
reference.<br />
SOURCE: FIPS 201<br />
Compartmentalization – A nonhierarchical grouping <strong>of</strong> sensitive information used to control<br />
access to data more finely than with hierarchical security<br />
classification alone.<br />
SOURCE: CNSSI-4009<br />
Compartmented Mode – Mode <strong>of</strong> operation wherein each user with direct or indirect access to<br />
a system, its peripherals, remote terminals, or remote hosts has all <strong>of</strong><br />
the following: (1) valid security clearance for the most restricted<br />
information processed in the system; (2) formal access approval and<br />
signed nondisclosure agreements for that information which a user is<br />
to have access; and (3) valid need-to-know for information which a<br />
user is to have access.<br />
SOURCE: CNSSI-4009<br />
Pg 38