DOCUMENT
Glossary of Key Information Security Terms
1137 definitions by National Institute of Standards and Technology

Access AuthorityAccess ControlAccess Control ListAccess Control ListsAccess Control MechanismAccess LevelAccess ListAccess PointAccess ProfileAccess TypeAccounting Legend CodeAccounting NumberAccount Management, UserAccreditation PackageAccrediting AuthorityActivation DataActive Security TestingActivitiesAdd-on SecurityAd Hoc NetworkAdministrative AccountAdministrative SafeguardsAdvanced Key ProcessorAdvanced Persistent ThreatsAdversaryAdvisoryAgencyAgency Certification AuthorityAgentAlertAllocationAlternate COMSEC CustodianAlternate Work SiteAnalysisAnomaly-Based DetectionAnti-JamAnti-SpoofAntispyware SoftwareAntivirus SoftwareApplicantApproval to operateApproved Mode of OperationApproved Security FunctionAssessment FindingsAssessment MethodAssessment ObjectAssessment ObjectiveAssessment ProcedureAssetAsset IdentificationAsset Reporting FormatAssurance CaseAssured Information SharingAssured SoftwareAsymmetric KeysAttack Sensing and WarningAttribute AuthorityAttribute-Based Access ControlAttribute-Based AuthorizationAudit DataAudit LogAudit Reduction ToolsAudit ReviewAuthentication CodeAuthentication ModeAuthentication PeriodAuthentication TagAuthentication TokenAuthenticatorAuthenticityAuthorityAuthorizationAuthorization BoundaryAuthorization (to operate)Authorized VendorAuthorized Vendor ProgramAuthorizing Official Designated RepresentativeAutomated Key TransportAutomated Password GeneratorAutomated Security MonitoringAutomatic Remote RekeyingAutonomous SystemAwareness (Information Security)BackdoorBack DoorBacktracking ResistanceBackupBannerBanner GrabbingBaselineBaseline ConfigurationBaseline SecurityBaseliningBasic TestingBastion HostBehavioral OutcomeBenign EnvironmentBiometric InformationBiometricsBiometric SystemBit Error RateBlackBlack CoreBlacklistingBlended AttackBlindingBlockBlock CipherBlock Cipher AlgorithmBlue TeamBody of EvidenceBoundaryBoundary ProtectionBrowsingBrute Force Password AttackBuffer OverflowBuffer Overflow AttackBulk EncryptionCall BackCanisterCapstone PoliciesCaptureCardholderCascadingCategoryCentral Office of RecordCentral Services NodeCertificate ManagementCertificate Management AuthorityCertificate PolicyCertificate Status AuthorityCertification AnalystCertification Authority FacilityCertification Authority WorkstationCertification PackageCertification Practice StatementCertification Test and EvaluationCertified TEMPEST Technical AuthorityCertifierChain of CustodyChain of EvidenceChallenge and Reply AuthenticationChallenge-Response ProtocolChecksumCheck WordCipher Block Chaining-Message Authentication CodeCipher SuiteCipher Text Auto-KeyCiphertext/Cipher TextCiphonyClassified Information SpillageClassified National Security InformationClearClearanceClearingClear TextClientClient (Application)Clinger-Cohen Act of 1996Closed Security EnvironmentClosed StorageCloud ComputingCodeCode BookCode GroupCode VocabularyCold StartCollisionCommand AuthorityCommercial Communications Security Evaluation ProgramCommodity ServiceCommon Access CardCommon CarrierCommon Configuration EnumerationCommon ControlCommon Control ProviderCommon CriteriaCommon Fill DeviceCommon Misuse Scoring SystemCommon Platform EnumerationCommon Vulnerability Scoring SystemCommunications CoverCommunications DeceptionCommunications ProfileCommunications SecurityCommunications Security AccountCommunications Security Account AuditCommunications Security AidCommunications Security AssemblyCommunications Security BoundaryCommunications Security Chip SetCommunications Security Control ProgramCommunications Security CustodianCommunications Security DemilitarizationCommunications Security ElementCommunications Security End-ItemCommunications Security EquipmentCommunications Security FacilityCommunications Security IncidentCommunications Security InsecurityCommunications Security ManagerCommunications Security MaterialCommunications Security Material Control SystemCommunications Security ModuleCommunications Security MonitoringCommunications Security ProfileCommunications Security SurveyCommunications Security System DataCommunications Security TrainingCommunity of InterestCommunity RiskComparisonCompartmentalizationCompartmented ModeCompensating Security ControlComprehensive TestingCompromising EmanationsComputer AbuseComputer CryptographyComputer ForensicsComputer Incident Response TeamComputer Network AttackComputer Network DefenseComputer Network ExploitationComputer Network OperationsComputer SecurityComputer Security Incident Response TeamComputer Security ObjectComputer Security Objects RegisterComputer Security SubsystemComputing EnvironmentConfiguration ControlConfiguration Control BoardContainerContaminationContent FilteringContingency KeyContingency PlanContinuity of GovernmentControl InformationControlled Access AreaControlled Access ProtectionControlled AreaControlled Cryptographic ItemControlled Cryptographic Item AssemblyControlled Cryptographic Item ComponentControlled Cryptographic Item EquipmentControlled InterfaceControlled SpaceControlled Unclassified InformationControlling AuthorityCooperative Key GenerationCooperative Remote RekeyingCorrectness ProofCountermeasureCountermeasuresCounter with Cipher Block Chaining-Message Authentication CodeCoverageCover-CodingCovert ChannelCovert Channel AnalysisCovert Storage ChannelCovert TestingCovert Timing ChannelCredential Service ProviderCritical InfrastructureCriticalityCriticality LevelCritical Security ParameterCross-CertificateCross-Domain CapabilitiesCross-Domain SolutionCross Site ScriptingCryptanalysisCryptographicCryptographic AlarmCryptographic AlgorithmCryptographic Ancillary EquipmentCryptographic BindingCryptographic BoundaryCryptographic ComponentCryptographic EquipmentCryptographic Hash FunctionCryptographic Ignition KeyCryptographic InitializationCryptographic LogicCryptographic Material – (slang CRYPTO)Cryptographic Module Security PolicyCryptographic Module Validation ProgramCryptographic NetCryptographic PeriodCryptographic ProductCryptographic RandomizationCryptographic SecurityCryptographic StrengthCryptographic SynchronizationCryptographic SystemCryptographic System AnalysisCryptographic System EvaluationCryptographic System ReviewCryptographic System SurveyCrypto OfficerCyber AttackCyber IncidentCyber InfrastructureCybersecurityCyberspaceDataData AggregationData AssetData ElementData Encryption AlgorithmData Encryption StandardData Flow ControlData LossData Origin AuthenticationData SecurityData Transfer DeviceDecertificationDecipherDecodeDecryptDedicated ModeDefault ClassificationDefense-in-BreadthDefense-in-DepthDegaussDelegated Development ProgramDeleted FileDenial of ServiceDepthDescriptive Top-Level SpecificationDesignated Approval AuthorityDeterministic Random Bit GeneratorDeterministic Random Bit Generator MechanismDevice Distribution ProfileDevice Registration ManagerDial BackDifferential Power AnalysisDigital EvidenceDigital ForensicsDigital Signature AlgorithmDirect ShipmentDisconnectionDisk ImagingDistinguished NameDistinguishing IdentifierDistributed Denial of ServiceDrop AccountabilityDual-Use CertificateDuplicate Digital EvidenceDurationDynamic SubsystemEaster EggEavesdropping AttackEducation (Information Security)E-Government (e-gov)Egress FilteringElectronically Generated KeyElectronic AuthenticationElectronic Business (e-business)Electronic CredentialsElectronic EvidenceElectronic Key EntryElectronic Key Management SystemElectronic Messaging ServicesElectronic SignatureEmanations SecurityEmbedded ComputerEmbedded Cryptographic SystemEmbedded CryptographyEncipherEnclaveEnclave BoundaryEncodeEncryptEncrypted KeyEncrypted NetworkEncryption AlgorithmEncryption CertificateEnd Cryptographic UnitEnd-Item AccountingEnd-to-End SecurityEnrollment ManagerEnterpriseEnterprise ArchitectureEnterprise Risk ManagementEnterprise ServiceEntrapmentEntropyEnvironmentEphemeral KeyErasureError Detection CodeEscrowEvaluation Assurance LevelEvaluation Products ListExaminationExamineExculpatory EvidenceExecutive AgencyExercise KeyExpected OutputExploitable ChannelExploit CodeExtensible Configuration Checklist Description FormatExternal Information System (or Component)External Information System ServiceExternal Information System Service ProviderExternal NetworkExternal Security TestingExtraction ResistanceExtranetFailoverFail SafeFail SoftFailure AccessFailure ControlFalse PositiveFederal Bridge Certification AuthorityFederal Bridge Certification Authority MembraneFederal Bridge Certification Authority Operational AuthorityFederal Enterprise ArchitectureFederal Information Processing StandardFederal Information Processing Standards-Approved Security MethodFederal Information Processing Standards PublicationFederal Information Processing Standards-Validated CryptographyFederal Information SystemFederal Information Systems Security Educators’ AssociationFederal Public Key Infrastructure Policy AuthorityFile EncryptionFile Name AnomalyFile ProtectionFile SecurityFill DeviceFireflyFirewall Control ProxyFixed COMSEC FacilityFlawFlaw Hypothesis MethodologyFloodingFocused TestingForensically CleanForensic CopyForensicsForensic SpecialistFormal Access ApprovalFormal Development MethodologyFormal MethodFormal ProofFormal Security PolicyFormatting FunctionForward CipherFrequency hoppingFull Disk EncryptionFull MaintenanceFunctional TestingGatewayGlobal Information GridGlobal Information InfrastructureGraduated SecurityGroup AuthenticatorGuard (System)Guessing EntropyHackerHandshaking ProceduresHard Copy KeyHardeningHardwareHardwired KeyHashingHash TotalHash ValueHashwordHealth Information ExchangeHigh AvailabilityHigh ImpactHoneypotHot WashHybrid Security ControlIA ArchitectureIA-Enabled Information Technology ProductIA-Enabled ProductIA InfrastructureIA ProductIdentity-Based Access ControlIdentity-Based Security PolicyIdentity BindingIdentity RegistrationIdentity TokenIdentity ValidationImageImitative Communications DeceptionImpactImpact ValueImplantInadvertent DisclosureIncident HandlingIncomplete Parameter CheckingInculpatory EvidenceIndependent Validation AuthorityIndependent Verification & Validation (IV&V)IndividualIndividual AccountabilityIndividualsIndustrial Control SystemInformal Security PolicyInformation AssuranceInformation Assurance ComponentInformation Assurance (IA) ProfessionalInformation Assurance Vulnerability AlertInformation DomainInformation EnvironmentInformation Flow ControlInformation ManagementInformation OperationsInformation ResourcesInformation Resources ManagementInformation Security ArchitectInformation Security ArchitectureInformation Security Continuous MonitoringInformation Security Continuous Monitoring ProcessInformation Security Continuous Monitoring ProgramInformation Security PolicyInformation Security Program PlanInformation Security RiskInformation SharingInformation Sharing EnvironmentInformation System Contingency PlanInformation System Life CycleInformation System OwnerInformation System Owner (or Program Manager)Information System-Related Security RisksInformation Systems SecurityInformation Systems Security EngineerInformation Systems Security Equipment ModificationInformation Systems Security ManagerInformation Systems Security ProductInformation TechnologyInformation TypeInformation ValueInitialization VectorInitializeInitiatorInside(r) ThreatInside ThreatInspectable SpaceIntegrity Check ValueInterfaceInterface Control DocumentInterim Approval to OperateInterim Approval to TestIntermediate Certification AuthorityInternal Security ControlsInternal Security TestingInternetInternet ProtocolInteroperabilityInterviewIntranetIntrusionIntrusion Detection and Prevention SystemIntrusion Detection SystemsIntrusion Detection SystemsIntrusion Detection SystemsIntrusion Prevention System(s)Inverse CipheIP Security (IPsec)IT-Related RiskIT Security ArchitectureIT Security AwarenessIT Security EducationIT Security InvestmentIT Security MetricsIT Security PolicyIT Security TrainingJoint AuthorizationKey-Auto-KeyKey BundleKey Distribution CenterKeyed-Hash Based Message Authentication CodeKey-Encryption-KeyKey Escrow SystemKey ExpansionKey Generation MaterialKeying MateriaKey ListKey LoggerKey ManagementKey Management DeviceKey Management InfrastructureKey Production KeyKey RecoveryKey StreamKeystroke MonitoringKey TagKey TapeKey TransportKey UpdatingKey WrapKMI-Aware DeviceKMI Operating AccountKMI Protected ChannelKOA AgentKOA ManagerKOA Registration ManagerLabeled Security ProtectionsLaboratory AttackLeast TrustLevel of ConcernLevel of protectionLikelihood of OccurrenceLimited MaintenanceLine ConditioningLine ConductionList-OrientedLocal AccessLocal AuthorityLocal Management Device/Key ProcessorLogical Completeness MeasureLogical PerimeterLogic BombLong TitleLow ImpactLow Probability of DetectionLow Probability of InterceptMacro VirusMagnetic RemanenceMaintenance HookMaintenance KeyMajor ApplicationMajor Information SystemMalicious AppletsMalicious CodeMalicious LogicManagement ClientManagement Security ControlsMandatory ModificationManipulative Communications DeceptionManual CryptosystemManual Remote RekeyingMaster Cryptographic Ignition KeyMatch/matchingMaximum Tolerable DowntimeMechanismsMediaMemory ScavengingMessage ExternalsMessage IndicatorMetricsMin-EntropyMinimalist CryptographyMinor ApplicationMisnamed FilesMission Assurance CategoryMission/Business SegmentMission CriticalMobile Code TechnologiesMobile DeviceMobile Software AgentModerate ImpactMultifactor AuthenticationMulti-Hop ProblemMultilevel DeviceMultilevel ModeMultilevel securityMultiple Security LevelsMulti-ReleasableMutual SuspicionNaming AuthorityNational Information Assurance PartnershipNational Information InfrastructureNational Security Emergency Preparedness Telecommunications ServicesNational Security InformationNational Vulnerability DatabaseNeeds Assessment (IT Security Awareness and Training)Need To Know DeterminationNeed To Know DeterminationNet-centric ArchitectureNetworkNetwork AccessNetwork Access ControlNetwork Address TranslationNetwork Front-EndNetwork ResilienceNetwork SniffingNetwork SponsorNetwork SystemNetwork WeavingNo-Lone ZoneNon-deterministic Random Bit GeneratorNon-Local MaintenanceNon-Organizational UserNSA-Approved CryptographyNullObject IdentifierObject ReuseOff-CardOfficial InformationOff-line AttackOff-line CryptosystemOn-CardOne-part CodeOne-time CryptosystemOne-time PadOne-time TapeOne-Way Hash AlgorithmOnline AttackOnline Certificate Status ProtocolOnline CryptosystemOpen Checklist Interactive LanguageOpen StorageOpen Vulnerability and Assessment LanguageOperating System FingerprintingOperational KeyOperational Vulnerability InformationOperational WaiverOperations CodeOperations SecurityOptional ModificationOrganizational Information Security Continuous MonitoringOrganizational MaintenanceOrganizational Registration AuthorityOrganizational UserOutside(r) ThreatOutside ThreatOvert ChannelOver-The-Air Key DistributionOver-The-Air Key TransferOver-The-Air RekeyingOvert TestingOverwrite ProcedurePacket FilterPacket SnifferParityPartitioned Security ModePassive Security TestingPassive WiretappingPassword CrackingPatchPatch ManagementPath HistoriesPayloadPeer Entity AuthenticationPer-Call KeyPerformance Reference ModelPerimeterPeriods ProcessingPerishable DataPermuterPersonal FirewallPersonal Identity VerificationPersonal Identity Verification AccreditationPersonal Identity Verification Authorizing OfficialPersonal Identity Verification CardPersonal Identity Verification IssuerPersonal Identity Verification RegistrarPersonal Identity Verification SponsorPersonnel Registration ManagerPhysically Isolated NetworkPiconetPII Confidentiality Impact LevelPlaintext KeyPlan of Action and MilestonesPolicy Approving AuthorityPolicy-Based Access ControlPolicy Certification AuthorityPolicy Management AuthorityPolicy MappingPortPortable Electronic DevicePortalPort ScanningPositive Control MaterialPractice StatementPrediction ResistancePredisposing ConditionPreproduction ModelPrimary Services NodePrincipalPrincipal Accrediting AuthorityPrincipal Certification AuthorityPrint SuppressionPrivacyPrivacy Impact AssessmentPrivacy SystemPrivilegePrivileged AccountsPrivileged CommandPrivileged ProcessPrivileged UserPrivilege ManagementProbeProduction ModelProduct Source NodeProfilingPromiscuous ModeProprietary InformationProtected Distribution SystemProtection PhilosophyProtection ProfileProtective Distribution SystemProtective PackagingProtective TechnologiesProtocolProtocol Data UnitProtocol EntityProxy AgentProxy ServerPseudorandom number generatorPublic Domain SoftwarePublic Key (Asymmetric) Cryptographic AlgorithmPublic Key CryptographyPublic Key EnablingPublic SeedPurgeQuadrantQualitative AssessmentQuality of ServiceQuantitative AssessmentQuarantineRadio Frequency IdentificationRandom Bit GeneratorRandomizerReadRead AccessReal-Time ReactionRecipient Usage PeriodRecords ManagementRecovery Point ObjectiveRecovery ProceduresRecovery Time ObjectiveRedRED/BLACK ConceptRed SignalRed TeamRed Team ExerciseRekeyRekey (a certificate)Release PrefixRemanenceRemediation PlanRemote Diagnostics/MaintenanceRemote RekeyingRenew (a certificate)Repair ActionReplay AttacksRepositoryReserve Keying MaterialResidueResource EncapsulationResponderResponsibility to ProvideResponsible IndividualRestricted DataRevoke a CertificateRijndaelRisk-Adaptable Access ControlRisk Assessment MethodologyRisk Assessment ReportRisk AssessorRisk Executive – (or Risk Executive Function)Risk Management FrameworkRisk MitigationRisk ModelRisk MonitoringRisk ResponseRisk Response MeasureRobustnessRobust Security NetworkRobust Security Network AssociationRogue DeviceRoleRoot Cause AnalysisRoot Certification AuthorityRootkitRound KeyRules of EngagementSafeguarding StatementSafeguardsSaltS-BoxScanningScatternetScavengingSecret SeedSecure Communication ProtocolSecure CommunicationsSecure DNSSecure EraseSecure Hash AlgorithmSecure/ Multipurpose Internet Mail ExtensionsSecure/Multipurpose Internet Mail ExtensionsSecure Socket LayerSecure StateSecure SubsystemSecuritySecurity AssociationSecurity Automation DomainSecurity BannerSecurity Concept of OperationsSecurity Content Automation ProtocolSecurity Control AssessorSecurity Control EffectivenessSecurity Control InheritanceSecurity ControlsSecurity Controls BaselineSecurity EngineeringSecurity Fault AnalysisSecurity Features Users GuideSecurity FilterSecurity FunctionsSecurity GoalsSecurity Impact AnalysisSecurity Information and Event Management ToolSecurity InspectionSecurity KernelSecurity LevelSecurity Management DashboardSecurity MarkingSecurity MarkingsSecurity MechanismSecurity Net Control StationSecurity ObjectiveSecurity PerimeterSecurity PlanSecurity PostureSecurity Program PlanSecurity RangeSecurity-Relevant ChangeSecurity-Relevant EventSecurity-Relevant InformationSecurity Requirements –RequirementsSecurity Requirements BaselineSecurity Requirements Traceability MatrixSecurity SafeguardsSecurity SpecificationSecurity TagSecurity TargetSecurity Test & EvaluationSecurity TestingSeed KeySemi-Quantitative AssessmentSenior Agency Information Security OfficerSensitive Compartmented InformationSensitive Compartmented Information FacilitySensitivitySensitivity LabelService-Level AgreementShared SecretShielded EnclosureShort TitleSignature CertificateSignature ValidationSigned DataSingle-Hop ProblemSingle Point KeyingSituational AwarenessSkimmingSmart CardSoftwareSoftware AssuranceSoftware-Based Fault IsolationSoftware System Test and Evaluation ProcessSpam Filtering SoftwareSpecial Access ProgramSpecial Access Program FacilitySpecial CharacterSpecificationSpillageSpread spectrumSpywareStandardStart-Up KEKStateStatic KeyStatus MonitoringStorage ObjectStrength of MechanismStrength of MechanismStriped CoreStrong AuthenticationSubassemblySubject Security LevelSubordinate Certification AuthoritySubsystemSuite ASuite BSuperencryptionSuperior Certification AuthoritySupersessionSupplementation (Assessment Procedures)Supplementation (Security Controls)Supply ChainSupply Chain AttackSuppression MeasureSyllabarySymmetric Encryption AlgorithmSynchronous Crypto-OperationSystemSystem AssetsSystem Development Life CycleSystem Development MethodologiesSystem HighSystem High ModeSystem IndicatorSystem InterconnectionSystem LowSystem of RecordsSystem OwnerSystem ProfileSystem SoftwareSystem-Specific Security ControlTabletop ExerciseTactical DataTactical EdgeTailored Security Control BaselineTailoringTailoring (Assessment Procedures)TamperingTarget of EvaluationTechnical ControlsTechnical Non-repudiationTechnical Reference ModelTechnical Security ControlsTechnical Vulnerability InformationTelecommunicationsTeleworkTempestTempestTEMPEST TestTEMPEST ZoneTestTest KeyThreat AnalysisThreat EventThreat MonitoringThreat ScenarioThreat ShiftingTime BombTime-Compliance DateTime-Dependent PasswordTOE Security FunctionsTOE Security PolicyTotal RiskTracking CookieTradecraft IdentityTraditional INFOSEC ProgramTraffic Encryption KeyTraffic-Flow SecurityTraffic PaddingTraining AssessmentTraining EffectivenessTraining Effectiveness EvaluationTraining (Information Security)TranquilityTransmissionTransmission SecurityTransport Layer Security (TLS)Trap DoorTriple DESTrojan HorseTrusted AgentTrusted CertificateTrusted ChannelTrusted Computer SystemTrusted Computing BaseTrusted DistributionTrusted FoundryTrusted Identification ForwardingTrusted Platform Module ChipTrusted ProcessTrusted RecoveryTrusted SoftwareTrusted TimestampTrust ListTrustworthy SystemTunnelingTwo-Part CodeTwo-Person ControlTwo-Person IntegrityType 1 KeyType 1 ProductType 2 KeyType 2 ProductType 3 KeyType 3 ProductType 4 KeyType 4 ProductType AccreditationType CertificationUnauthorized DisclosureUnclassifiedUnited States Government Configuration BaselineUnsigned dataUntrusted ProcessUpdate (a Certificate)Update (key)US-CERTU.S.-Controlled FacilityU.S.-Controlled SpaceUser IDUser InitializationUser Partnership ProgramUser RegistrationUser RepresentativeUser Representative (Risk Management)U.S. PersonValid Data ElementVariantVerificationVerified NameVerifier Impersonation AttackVirtual MachineVirusWeb Content Filtering SoftwareWeb Risk AssessmentWhitelistWhite TeamWi-Fi Protected Access-2WikiWired Equivalent PrivacyWireless Access PointWireless Application ProtocolWireless Local Area NetworkWireless TechnologyWorkcraft IdentityWork FactorWormWriteWrite AccessWrite-BlockerX.509 CertificateX.509 Public Key CertificateZero FillZombieZone Of Control
Loading conversations.