NISTIR 7298 Revision 1, Glossary of Key Information Security Terms
NISTIR 7298 Revision 1, Glossary of Key Information Security Terms NISTIR 7298 Revision 1, Glossary of Key Information Security Terms
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Covert Storage Channel – Covert channel involving the direct or indirect writing to a storage location by one process and the direct or indirect reading of the storage location by another process. Covert storage channels typically involve a finite resource (e.g., sectors on a disk) that is shared by two subjects at different security levels. SOURCE: CNSSI-4009 Covert Testing – Testing performed using covert methods and without the knowledge of the organization’s IT staff, but with the full knowledge and permission of upper management. SOURCE: SP 800-115 Covert Timing Channel – Covert channel in which one process signals information to another process by modulating its own use of system resources (e.g., central processing unit time) in such a way that this manipulation affects the real response time observed by the second process. SOURCE: CNSSI-4009 Credential – An object that authoritatively binds an identity (and optionally, additional attributes) to a token possessed and controlled by a person. SOURCE: SP 800-63 Credential – Evidence attesting to one’s right to credit or authority. SOURCE: FIPS 201 Credentials Service Provider – (CSP) Evidence or testimonials that support a claim of identity or assertion of an attribute and usually are intended to be used more than once. SOURCE: CNSSI-4009 A trusted entity that issues or registers subscriber tokens and issues electronic credentials to subscribers. The CSP may encompass Registration Authorities and verifiers that it operates. A CSP may be an independent third party, or may issue credentials for its own use. SOURCE: SP 800-63 Critical Infrastructure – System and assets, whether physical or virtual, so vital to the U.S. that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. [Critical Infrastructures Protection Act of 2001, 42 U.S.C. 5195c(e)] SOURCE: CNSSI-4009 Pg 50
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Critical Security Parameter (CSP) – Security-related information (e.g., secret and private cryptographic keys, and authentication data such as passwords and Personal Identification Numbers [PINs]) whose disclosure or modification can compromise the security of a cryptographic module. SOURCE: FIPS 140-2; CNSSI-4009 Criticality – A measure of the degree to which an organization depends on the information or information system for the success of a mission or of a business function. SOURCE: SP 800-60 Criticality Level – Refers to the (consequences of) incorrect behavior of a system. The more serious the expected direct and indirect effects of incorrect behavior, the higher the criticality level. SOURCE: CNSSI-4009 Cross-Certificate – A certificate used to establish a trust relationship between two Certification Authorities. SOURCE: SP 800-32; CNSSI-4009 Cross-Domain Capabilities – The set of functions that enable the transfer of information between security domains in accordance with the policies of the security domains involved. SOURCE: CNSSI-4009 Cross-Domain Solution (CDS) – A form of controlled interface that provides the ability to manually and/or automatically access and/or transfer information between different security domains. SOURCE: CNSSI-4009; SP 800-37 Cryptanalysis – 1) Operations performed in defeating cryptographic protection without an initial knowledge of the key employed in providing the protection. 2) The study of mathematical techniques for attempting to defeat cryptographic techniques and information system security. This includes the process of looking for errors or weaknesses in the implementation of an algorithm or of the algorithm itself. SOURCE: SP 800-57; CNSSI-4009 Crypto Officer – An operator or process (subject), acting on behalf of the operator, performing cryptographic initialization or management functions. SOURCE: FIPS 140-2 Cryptographic – Pertaining to, or concerned with, cryptography. SOURCE: CNSSI-4009 Pg 51
- Page 2 and 3: NIST IR 7298 Revision 1 Glossary of
- Page 4 and 5: NIST IR 7298 Revision 1, Glossary o
- Page 6 and 7: NIST IR 7298 Revision 1, Glossary o
- Page 8 and 9: NIST IR 7298 Revision 1, Glossary o
- Page 10 and 11: NIST IR 7298 Revision 1, Glossary o
- Page 12 and 13: NIST IR 7298 Revision 1, Glossary o
- Page 14 and 15: NIST IR 7298 Revision 1, Glossary o
- Page 16 and 17: NIST IR 7298 Revision 1, Glossary o
- Page 18 and 19: NIST IR 7298 Revision 1, Glossary o
- Page 20 and 21: NIST IR 7298 Revision 1, Glossary o
- Page 22 and 23: NIST IR 7298 Revision 1, Glossary o
- Page 24 and 25: NIST IR 7298 Revision 1, Glossary o
- Page 26 and 27: NIST IR 7298 Revision 1, Glossary o
- Page 28 and 29: NIST IR 7298 Revision 1, Glossary o
- Page 30 and 31: NIST IR 7298 Revision 1, Glossary o
- Page 32 and 33: NIST IR 7298 Revision 1, Glossary o
- Page 34 and 35: NIST IR 7298 Revision 1, Glossary o
- Page 36 and 37: NIST IR 7298 Revision 1, Glossary o
- Page 38 and 39: NIST IR 7298 Revision 1, Glossary o
- Page 40 and 41: NIST IR 7298 Revision 1, Glossary o
- Page 42 and 43: NIST IR 7298 Revision 1, Glossary o
- Page 44 and 45: NIST IR 7298 Revision 1, Glossary o
- Page 46 and 47: NIST IR 7298 Revision 1, Glossary o
- Page 48 and 49: NIST IR 7298 Revision 1, Glossary o
- Page 52 and 53: NIST IR 7298 Revision 1, Glossary o
- Page 54 and 55: NIST IR 7298 Revision 1, Glossary o
- Page 56 and 57: NIST IR 7298 Revision 1, Glossary o
- Page 58 and 59: NIST IR 7298 Revision 1, Glossary o
- Page 60 and 61: NIST IR 7298 Revision 1, Glossary o
- Page 62 and 63: NIST IR 7298 Revision 1, Glossary o
- Page 64 and 65: NIST IR 7298 Revision 1, Glossary o
- Page 66 and 67: NIST IR 7298 Revision 1, Glossary o
- Page 68 and 69: NIST IR 7298 Revision 1, Glossary o
- Page 70 and 71: NIST IR 7298 Revision 1, Glossary o
- Page 72 and 73: NIST IR 7298 Revision 1, Glossary o
- Page 74 and 75: NIST IR 7298 Revision 1, Glossary o
- Page 76 and 77: NIST IR 7298 Revision 1, Glossary o
- Page 78 and 79: NIST IR 7298 Revision 1, Glossary o
- Page 80 and 81: NIST IR 7298 Revision 1, Glossary o
- Page 82 and 83: NIST IR 7298 Revision 1, Glossary o
- Page 84 and 85: NIST IR 7298 Revision 1, Glossary o
- Page 86 and 87: NIST IR 7298 Revision 1, Glossary o
- Page 88 and 89: NIST IR 7298 Revision 1, Glossary o
- Page 90 and 91: NIST IR 7298 Revision 1, Glossary o
- Page 92 and 93: NIST IR 7298 Revision 1, Glossary o
- Page 94 and 95: NIST IR 7298 Revision 1, Glossary o
- Page 96 and 97: NIST IR 7298 Revision 1, Glossary o
- Page 98 and 99: NIST IR 7298 Revision 1, Glossary o
NIST IR <strong>7298</strong> <strong>Revision</strong> 1, <strong>Glossary</strong> <strong>of</strong> <strong>Key</strong> <strong>Information</strong> <strong>Security</strong> <strong>Terms</strong><br />
Covert Storage Channel – Covert channel involving the direct or indirect writing to a storage<br />
location by one process and the direct or indirect reading <strong>of</strong> the<br />
storage location by another process. Covert storage channels<br />
typically involve a finite resource (e.g., sectors on a disk) that is<br />
shared by two subjects at different security levels.<br />
SOURCE: CNSSI-4009<br />
Covert Testing – Testing performed using covert methods and without the knowledge<br />
<strong>of</strong> the organization’s IT staff, but with the full knowledge and<br />
permission <strong>of</strong> upper management.<br />
SOURCE: SP 800-115<br />
Covert Timing Channel – Covert channel in which one process signals information to another<br />
process by modulating its own use <strong>of</strong> system resources (e.g., central<br />
processing unit time) in such a way that this manipulation affects the<br />
real response time observed by the second process.<br />
SOURCE: CNSSI-4009<br />
Credential – An object that authoritatively binds an identity (and optionally,<br />
additional attributes) to a token possessed and controlled by a person.<br />
SOURCE: SP 800-63<br />
Credential – Evidence attesting to one’s right to credit or authority.<br />
SOURCE: FIPS 201<br />
Credentials Service Provider –<br />
(CSP)<br />
Evidence or testimonials that support a claim <strong>of</strong> identity or assertion<br />
<strong>of</strong> an attribute and usually are intended to be used more than once.<br />
SOURCE: CNSSI-4009<br />
A trusted entity that issues or registers subscriber tokens and issues<br />
electronic credentials to subscribers. The CSP may encompass<br />
Registration Authorities and verifiers that it operates. A CSP may be<br />
an independent third party, or may issue credentials for its own use.<br />
SOURCE: SP 800-63<br />
Critical Infrastructure – System and assets, whether physical or virtual, so vital to the U.S.<br />
that the incapacity or destruction <strong>of</strong> such systems and assets would<br />
have a debilitating impact on security, national economic security,<br />
national public health or safety, or any combination <strong>of</strong> those matters.<br />
[Critical Infrastructures Protection Act <strong>of</strong> 2001, 42 U.S.C. 5195c(e)]<br />
SOURCE: CNSSI-4009<br />
Pg 50
Change language