Information security terms and abbreviations

A

AAL :

Authenticator Assurance Level

ATM Adaptation Layer

Authenticator Assurance Level

AAL is a conventional measure that characterizes the security of an authentication transaction.

The higher the AAL, the more secure the process of authentication is.

More secure authentication requires that attackers possess better capabilities and expend more resources to successfully undermine the authentication process.

Authentication at higher AALs can effectively reduce the risk of attacks.

AAL1 provides some confidence that the claimant controls an Authenticator bound to the subscriber's account.

AAL1 requires either single-factor or multi-factor authentication using a broad range of available authentication technologies.

Successful authentication requires that the claimant prove possession and control of the authenticator through a secure authentication protocol.

AAL2 provides high confidence that the claimant controls the Authenticator(s) bound to the subscriber's account.

Proof of possession and control of two different authentication factors is required through secure authentication protocol(s). Approved cryptographic methods are required at AAL2 and above.

AAL3 provides very high confidence that the claimant controls the Authenticator(s) bound to the subscriber's account.

Authentication at AAL3 is based on proof of possession of a key through a cryptographic protocol.

AAL3 authentication requires a hardware authenticator and an authenticator that provides verifier impersonation resistance; the same device can meet both of these requirements.

To authenticate at AAL3, claimants must prove possession and control of two different authentication factors through secure authentication protocol(s).

Approved cryptographic methods are required.

ATM Adaptation Layer

adaptation layer ATM — rules that define the way information is prepared for transmission over an ATM network. One of the ATM layers.

The task of the AAL is to split a data stream into ATM cells and to reassemble it.

Classes:

wiki

AAL2 :

Authenticator Assurance Level 2

ATM Adaptation Layer 2

ATM Adaptation Layer 2

is the adaptation layer ATM for the Asynchronous Transfer Mode (ATM), used mainly in telecommunications.

For example, it is used for the Iu interfaces in the Universal Mobile Telecommunications System, as well as for digital voice transmission.

The standard specifications related to AAL2 are ITU standards I.363.2 and I366.1.

wiki

AC - Access Control

«Access control» — In the field of physical security and information security Access control (AC) is the selective restriction of access to a place or another resource, while access management describes the process.

The act of access may mean consumption, entry or use.

Permission to access a resource is called authorization.

Locks and login credentials are two similar access control mechanisms.

wiki

AD - Active Directory

«Active Directory» — Microsoft's directory services for the Windows Server family of operating systems.

It was originally created as a LDAP -compatible implementation of a directory service, however, starting with Windows Server 2008, it includes capabilities for integration with other authorization services, playing for them an integrating and unifying role.

It allows administrators to use Group Policy to ensure uniformity in configuring the user working environment, to deploy software on many computers through Group Policy or by means of System Center Configuration Manager (formerly Microsoft Systems Management Server), to install operating system, application and server software updates on all computers in the network using Windows Server Update Services.

It stores data and environment settings in a centralized database.

Active Directory networks can be of various sizes: from a few dozen to several million objects.

wiki

API - Application Programming Interface

Application programming interface — a description of the ways (a set of classes, procedures, functions, structures or constants) in which one computer program can interact with another program.

It is usually part of the description of some internet protocol (for example, RFC), a software framework or an operating system function call standard).

It is often implemented as a separate software library or operating system service.

It is used by programmers when writing all kinds of applications.

See also the articles: «API testing» and «Testing tutorial»

wiki

APT - Advanced Persistent Threat

«advanced persistent threat», also a targeted cyber attack — an adversary possessing a sophisticated level of special knowledge and significant resources that enable it to create opportunities for achieving its goals through various vectors of attack (for example, information, physical and deceptive ones).

These goals usually include establishing and expanding a presence inside the information technology infrastructure of the target organization in order to carry out intentions of extracting information, disrupting or interfering with critical aspects of the task, program or service being performed; or in order to take a position that allows these intentions to be carried out in the future.

APT, as an “advanced persistent threat”: achieves its goals repeatedly over a long period; adapts to the defenders' efforts to resist the threat; is set on maintaining the level of penetration into the target infrastructure required to carry out its intentions.

The term APT was originally used to describe cyber attacks on military organizations, but it is no longer limited to the military sphere.

An APT attack surpasses ordinary cyber threats, since it is aimed at breaking into a specific target and is prepared on the basis of information about it collected over a long period.

An APT breaks into the target infrastructure by exploiting software vulnerabilities and methods of “social engineering”.

wiki

ATM - Asynchronous Transfer Mode

asynchronous data transfer method) — a high-performance network technology for packet switching and multiplexing.

Packets are cells (English: cell) of a fixed size of 53 bytes, where the first 5 bytes are used for the header.

It is a variety of fast packet switching (fast packet switching).

Unlike the synchronous data transfer method ( STM — synchronous transfer mode), ATM is better suited for providing data transmission services with greatly differing or varying bitrates.

wiki

Authentication

Authentication is a procedure for verifying authenticity, for example:

verification of a user's authenticity by comparing the password entered by the user (for the specified login) with the password stored in the user login database;

confirmation of the authenticity of an email message by verifying the digital signature of the message against the sender's public key;

verification of a file's checksum against the sum declared by the author of that file.

In Russian, the term is used mainly in the field of information technology.

Given the degree of trust and the security policy of the systems, the verification performed may be one-way or mutual.

It is usually carried out using cryptographic methods.

Authentication should not be confused with authorization (the procedure of granting a subject certain rights) and identification (the procedure of recognizing a subject by its identifier).

wiki

Authorization

Authorization is the granting of rights to perform certain actions to a particular person or group of persons; as well as the process of verifying (confirming) these rights when attempting to perform these actions.

One often hears the expression that some person is “authorized” to perform this operation — this means that they have the right to it.

Authorization should not be confused with authentication — the procedure of verifying the legitimacy of a user or data, for example, verifying that the password entered by the user for an account matches the password in the database, or verifying the digital signature of a message against the encryption key, or verifying a file's checksum against the sum declared by the author of that file.

Authorization, however, controls access to various system resources during the work of legitimate users after they have successfully passed authentication.

wiki

AV - Anti Virus

An antivirus program (antivirus, antivirus protection tool, malicious software detection tool) is a specialized program for detecting computer viruses, as well as unwanted (considered malicious) programs, and for restoring files infected (modified) by such programs, and for prevention — preventing infection (modification) of files or the operating system by malicious code.

Example - Kaspersky

wiki

BC

BC - Backup Copy

Backup is the process of creating a copy of data on a medium (hard disk, floppy disk, etc.) intended for restoring the data in the original or a new place of their location in case of their damage or destruction.

wiki

bcrypt — an adaptive cryptographic key derivation hash function used for secure password storage.

Developers: Niels Provos and David Mazières.

The function is based on the Blowfish cipher and was first presented at USENIX in 1999.

To protect against attacks using rainbow tables, bcrypt uses a salt; in addition, the function is adaptive, its running time is easy to configure and it can be slowed down to make brute-force attacks harder.

The Blowfish cipher differs from many algorithms by its computationally expensive encryption key preparation phase.

Provos and Mazières took advantage of this feature but changed the key preparation algorithm, obtaining the “Eksblowfish” cipher (expensive key schedule Blowfish).

The number of rounds in key preparation must be a power of two; the specific power can be set when using bcrypt.

It was originally implemented in the crypt function in OpenBSD .

Implementations exist for Java , Python , Nim, C# , Ruby , Perl, PHP , Node.js , Go and some others.

wiki

BFS - Brute-force search

Exhaustive search, or the “brute force” method, is a method of solving mathematical problems.

It belongs to the class of methods that seek a solution by exhausting all possible variants.

The complexity of exhaustive search depends on the number of all possible solutions to the problem. If the solution space is very large, exhaustive search may not produce results for several years or even centuries.

Any problem in the NP class can be solved by exhaustive search. At the same time, even if the evaluation of the objective function for each particular possible solution of the problem can be carried out in polynomial time, depending on the number of all possible solutions exhaustive search may require exponential running time.

In cryptography, the assessment of the cryptographic strength of ciphers is based on the computational complexity of exhaustive search.

In particular, a cipher is considered cryptographically strong if there is no method of “breaking” it substantially faster than exhaustive search of all keys.

Cryptographic attacks based on the exhaustive search method are the most universal, but also the longest.

C

CA - Certificate Authority

In cryptography, a certification authority or certificate authority is a party (department, organization) whose honesty is indisputable and whose public key is widely known.

The task of a certification authority is to confirm the authenticity of encryption keys by means of electronic signature certificates.

Technically, a certification authority is implemented as a component of a global directory service responsible for managing users' cryptographic keys.

Public keys and other information about users are stored by certification authorities in the form of digital certificates.

wiki

Ciphertext - Ciphertext

Ciphertext — the result of the operation encryption .

It is also often used instead of the term “cryptogram”, although the latter emphasizes the very fact of transmitting a message rather than of encrypting it.

COA - Ciphertext-only attack

— one of the main methods of cryptanalysis. It is assumed that the cryptanalyst knows only a set of ciphertexts; the goal is to obtain as many plaintexts as possible corresponding to the available ciphertexts, or, even better, the key used for encryption. Ciphertexts can be obtained by simply intercepting messages over open communication channels. This type of attack is weak and inconvenient.

CPA - Chosen-plaintext attack

A chosen-plaintext attack is one of the main methods of cryptanalytic breaking.

The cryptanalyst possesses a certain number of plaintexts and the corresponding ciphertexts; in addition, they have the ability to encrypt several previously chosen plaintexts

CPNI - Customer Proprietary Network Information

Customer proprietary network information is data collected by telecommunications companies about a consumer's telephone calls.

It includes the time, date, duration and destination number of each call, the type of network to which the consumer subscribes, and any other information that appears on the consumer's telephone bill.

Telemarketers or customer service agents working on behalf of telephone companies must pass an additional level of authentication of customers (usually a PIN code or the last four saved payment methods) and request the customer's consent to obtain access to payment information or to the use or sharing of this information for any purposes, including but not limited to an upsell offer or any change of services.

This is usually done at the beginning of the telemarketer's conversation with the telephone subscriber.

wiki

CRL - Certificate Revocation List

Certificate revocation lists are a list of certificates that certification authority has marked as revoked.

Certificate revocation lists (CRLs) are used to establish whether a user's or a certification authority's certificate has been revoked due to key compromise.

An important property of a CRL is that it contains information only about certificates whose validity period has not expired.

Read more about CRL in the article Certificate Revocation List

An alternative to CRL is OCSP

CSRF - cross-site request forgery

— “cross-site request forgery”, also known as XSRF) — a type of attack on website visitors that exploits the shortcomings of the HTTP protocol.

If the victim visits a site created by an attacker, a request is secretly sent on their behalf to another server (for example, to a payment system server) that performs some malicious operation (for example, transferring money to the attacker's account).

To carry out this attack, the victim must be authenticated on the server to which the request is sent, and this request must not require any confirmation from the user that cannot be ignored or forged by the attacking script.

Contrary to a widespread misconception, this type of attack appeared quite a long time ago: the first theoretical reasoning appeared in 1988, and the first vulnerabilities were discovered in 2000. And the term itself was coined by Peter Watkins in 2001.

The main use of CSRF is forcing certain actions on a vulnerable site on behalf of the victim (changing the password, the secret question for password recovery, email, adding an administrator, etc.).

Also, with the help of CSRF, it is possible to exploit reflected XSS flaws found on another server.

CVE - Common Vulnerabilities and Exposures

a database of commonly known information security vulnerabilities. Each vulnerability is assigned an identification number of the form CVE-year-number[1], a description and a number of publicly available links with a description.

CVE is maintained by the MITRE organization.

The CVE project is funded by US-CERT.

Features:

One identifier for one vulnerability.

A standardized description of vulnerabilities.

Free download and use.

wiki

D

DAA Digest access authentication is one of the generally accepted methods used by a web server to process the credentials of a web browser user.

A similar method is used within the VoIP protocol SIP for authentication of a request by the server on the client side, i.e. the endpoint terminal. This method sends over the network a hash sum of the login, password, server address and random data, and provides a higher level of protection than basic authentication, in which the data is sent in plain text.

Technically, digest authentication is the application of the MD5 cryptographic hash function to the user's secret using random values to make cryptanalysis harder and to prevent replay attacks. It works at the HTTP protocol level.

This is a more advanced variant of HTTP Authentication.

Read more about digest authentication in the article HTTP Digest Authentication

DH . Diffie–Hellman

The Diffie-Hellman protocol is a cryptographic protocol that allows two or more parties to obtain a shared secret key using a communication channel that is not protected from eavesdropping.

The resulting key is used to encrypt further exchange using symmetric encryption algorithms.

The public key distribution scheme proposed by Diffie and Hellman produced a real revolution in the world of encryption, since it removed the main problem of classical cryptography — the problem of key distribution.

In its pure form, the Diffie-Hellman algorithm is vulnerable to modification of data in the communication channel, including an attack «Man-in-the-middle (the person in the middle)» , so schemes using it apply additional methods of one-way or two-way authentication.

DoS attack Denial-of-service attack - «denial of service»

— a hacker attack on a computing system aimed at bringing it to failure, that is, creating conditions under which bona fide users of the system cannot gain access to the provided system resources (servers), or such access is made difficult.

The failure of the attacked system may also be a step towards gaining access (if, in an emergency situation, the software discloses some critical information — for example, a version, part of the program code, etc.).

But more often it is a measure of economic pressure: the loss of a non-stop service that generates revenue, bills from the provider and measures to escape the attack deal a tangible blow to the «target's» pocket.

wiki

DDoS attack Distributed Denial-of-service attack - a distributed DoS attack

— the incoming traffic flooding the victim comes from many different sources.

This effectively makes it impossible to stop the attack simply by blocking a single source.

A DoS or DDoS attack is similar to a group of people crowding at the entrance of a store, which makes it difficult for legitimate customers to enter and thereby disrupts trade.

Also on the topic:

Protecting a site from DDoS attacks

DDoS attack protection system - Syncookied

DDOS wikipedia

E

Encipher - to encrypt

To convert ordinary text into ciphertext by means of cryptography.

Synonyms: encode, encrypt

F

FAL - Federation Assurance Level

«Federation Assurance Level» —

FAL describes the requirements for how the assertions for a given transaction are created and protected.

These levels may be requested by the RP or required by the configuration of both the RP and the IdP for a given transaction.

Federation Assurance Levels
FAL Requirement
1 Holder of key assertion, signed by the identity provider (IdP)
2 Holder of key assertion, signed IdP and encrypted RP
3 Holder of key assertion, signed by the IdP and encrypted to RP

pages.nist.gov

FQDN - Fully Qualified Domain Name

«Fully qualified domain name» — a domain name that has no ambiguities in its definition.

It includes the names of all parent domains of the DNS hierarchy.

In DNS and, what is especially important, in zone files[en], FQDNs end with a dot (for example, example.com.), that is, they include the root domain name, which is nameless (that is, empty).

The difference between an FQDN and a domain name appears when naming second-level, third-level and so on domains.

To obtain an FQDN, higher-level domains must be specified in the name (for example, sample is a domain name, however the FQDN looks like sample.gtw-02.office4.example.com.).

DNS records of domains (for redirection, mail servers and so on) always use FQDNs.

The maximum size of an FQDN is 255 bytes, with a limit of 63 bytes per domain name.

wiki

G

GDPR - General Data Protection Regulation

General Data Protection Regulation; Regulation (European Union) 2016/679) — a regulation of the European Union with the help of which the European Parliament, the Council of the European Union and the European Commission strengthen and unify the protection of personal data of all persons in the European Union (EU). The regulation is also aimed at the export of data from the EU.

Read more in the article: GDPR

wiki

H

HSM - Hardware security module

A hardware security module (HSM) is a physical computing device that protects and manages digital keys, performs the encryption and decryption of digital signatures, strong authentication and other cryptographic functions.

These modules are traditionally supplied as a plug-in card or an external device that connects directly to a computer or network server.

A hardware security module contains one or more secure cryptoprocessor chips.

Read more in the article: HSM

wiki

HTTPS - HyperText Transfer Protocol Secure

an extension of the HTTP protocol to support encryption in order to increase security. Data in the HTTPS protocol is transmitted over cryptographic protocols TLS or the one deprecated in 2015 SSL

. Unlike HTTP with TCP port 80, HTTPS uses TCP port 443 by default.

The protocol was developed by Netscape Communications for the Netscape Navigator browser in 1994

wiki

I

IAL - Identity Assurance Level

Identity Assurance Level

pages.nist.gov

IAM , IdM , IdAM - Identity and Access Management

Identity management (English: Identity management, abbr. IdM, sometimes IDM, IdAM or IAM) — a complex of approaches, practices, technologies and special software tools for managing user credentials, access control and management systems (ACS), with the goal of improving the security and performance of information systems while simultaneously reducing costs, optimizing downtime and reducing the number of repetitive tasks.

It considers the need to ensure proper access to resources in increasingly heterogeneous technological environments and to meet increasingly stringent compliance requirements.

You can study this topic in more detail in the article

«Identity and Access Management»

wiki

ICAP - Internet Content Adaptation Protocol

The Internet Content Adaptation Protocol (ICAP) is a lightweight HTTP-like protocol specified in RFC 3507 , which is used to extend transparent proxy servers, thereby freeing up resources and standardizing the way new functions are implemented.

ICAP is usually used to implement virus scanning and content filters in transparent HTTP proxy caches.

Content adaptation refers to performing a specific value-added service (content manipulation) for the corresponding client request/response.

ICAP focuses on the use of peripheral devices (caching proxy servers) to provide value-added services.

At the heart of this process is a cache that will proxy all client transactions and process them through web servers.

These ICAP servers are focused on a specific function, for example, inserting advertisements, virus scanning, multi-AV scanning, content translation, language translation or content filtering.

Offloading additional services from web servers to ICAP servers allows the same web servers to scale according to the original HTTP throughput without the need to perform these additional tasks.

wiki

IdP , IDP - Identity Provider

An identity provider is a system entity that creates, maintains and manages identity information for principals, and also provides authentication services to relying applications within a federation or distributed network.

Identity providers offer user authentication as a service.

Relying party applications, such as web applications, delegate the step of verifying the user's authenticity to a trusted identity provider.

Such a relying party application is called federated, that is, it consumes federated identity.

An identity provider is a «trusted provider that allows you to use single sign-on (SSO) to access other websites».

SSO it improves usability by reducing password fatigue. It also provides better security by reducing the potential attack surface.

Identity providers can facilitate the connection between cloud computing resources and users, thereby reducing the need to re-authenticate users when using mobile and roaming applications.

List of IDPs for AWS

wiki

IOE - Internet of Evertything

The term more often used is IoT - Internet of Things

IoT - Internet of Things

«Internet of Things» - the concept of a data transmission network between physical objects («things») equipped with built-in tools and technologies for interacting with each other or with the external environment.

It is assumed that the organization of such networks is capable of restructuring economic and social processes and eliminating the need for human participation from part of the actions and operations.

The concept was formulated in 1999 as an understanding of the prospects for the wide use of radio frequency identification tools for the interaction of physical objects with each other and with the external environment.

Filling the concept with diverse technological content and introducing practical solutions for its implementation starting from the 2010s is considered a steady trend in information technology, primarily due to the ubiquity of wireless networks, the emergence of cloud computing, the development of machine-to-machine interaction technologies, the beginning of an active transition to IPv6 and the mastering of software-defined networks.

wiki

iPaaS - Integration Platform as a Service

A set of cloud services that allow customers to develop, run and manage integration flows between disparate applications.

Within the iPaaS cloud integration model, customers manage the development and deployment of integrations without installing or managing any hardware or middleware.

wiki

IPC - Infrastructure Protection Center

Infrastructure protection center is a term used by the Canadian government instead of

SOC

ISOC - Information Security Operations Center

A security operations center is a complex where corporate information systems ( websites , applications, databases , data centers and servers, networks, desktop computers and other endpoints) are monitored, assessed and protected.

Where this is clear from the context, instead of ISOC the abbreviation is used for brevity SOC - Security Operations Center

This term can be interpreted as follows: A SOC is a centralized corporate security monitoring team created in order to reduce the organization's risks by using technologies and processes to detect incidents, localize them, analyze and reduce damage

wiki

K

KPA - Known-plaintext attack

A known-plaintext attack is a type of cryptanalysis in which the ciphertext contains standard fragments whose meaning is known to the analyst in advance. During World War II, English cryptanalysts called such fragments “cribs” (crib — a hint, a cheat sheet)

L

LDAP - Lightweight Directory Access Protocol

«lightweight directory access protocol» — an application-layer protocol for accessing the X.500 directory service, developed by the IETF as a lightweight version of the DAP protocol developed by ITU-T.

LDAP is a relatively simple protocol that uses TCP/IP and allows authentication (bind), search and compare operations, as well as operations to add, modify or delete records.

Usually an LDAP server accepts incoming connections on port 389 over TCP or UDP.

For LDAP sessions encapsulated in SSL, port 636 is usually used.

Every entry in the LDAP directory consists of one or more attributes and has a unique name (DN — Distinguished Name).

The unique name may look, for example, as follows:

«cn=Ivan Petrov,ou=Employees,dc=example,dc=com».

The unique name consists of one or more relative distinguished names (RDN — Relative Distinguished Name), separated by a comma. A relative distinguished name has the form AttributeName=value.

At one level of the directory there cannot exist two entries with identical relative distinguished names. Because of this structure of the unique name, entries in an LDAP directory can easily be represented as a tree.

An entry can consist only of those attributes that are defined in the description of the entry class (object class), which, in turn, are combined into schemas (schema). The schema defines which attributes are mandatory for a given class and which are optional. The schema also defines the type and comparison rules of the attributes. Each attribute of an entry can store several values.

wiki

M

MFA - Multi-factor authentication

Multi-factor authentication (MFA) is an extended authentication, a method of access control to a computer in which the user, in order to gain access to information, must present more than one “authentication mechanism evidence”.

The categories of such evidence include:

Knowledge — information that the subject knows. For example, a password, a PIN code.

Possession — a thing that the subject possesses. For example, an electronic or magnetic card, a token, flash memory.

A property that the subject possesses. For example, biometrics, natural unique distinguishing features: face, fingerprints, iris, capillary patterns, DNA sequence.

wiki

MITM - Man-in-the-middle attack

A man-in-the-middle attack, or “person in the middle” attack, is a type of attack in cryptography and computer security where an attacker secretly relays and, if necessary, alters the communication between two parties who believe that they are communicating directly with each other.

It is a method of compromising a communication channel in which the cracker, having connected to the channel between the counterparties, interferes with the transmission protocol, deleting or distorting information.

One example of man-in-the-middle attacks is active eavesdropping, in which the attacker establishes independent connections with the victims and transmits messages between them.

Thereby it makes the victims believe that they are talking directly to each other over a private connection, while in fact the whole conversation is controlled by the attacker.

The attacker must be able to intercept all messages transmitted between the two victims and also to inject new ones.

In most cases this is quite simple, for example, an attacker can act as a “person in the middle” within the reception range of a wireless access point (Wi-Fi).

This attack is aimed at bypassing mutual authentication or its absence and can succeed only when the attacker is able to impersonate each endpoint or to remain undetected as an intermediate node.

Most cryptographic protocols include some form of endpoint authentication specifically to prevent MITM attacks.

For example, TLS can verify the authenticity of one or both parties using a mutually trusted certification authority.

wiki

MS - Managed Services

Managed services — the practice of transferring ongoing management activities outside the organization.

The term is close in meaning to the word “outsourcing”.

The person or organization that owns or is directly responsible for the managed organization or system is called the client or customer.

The person or organization that provides the remotely managed service is the service provider.

Usually the client remains responsible for the operation and work of the remotely managed service and does not relinquish overall management responsibility for the organization or system being transferred to management.

wiki

MSP - Managed Services Provider

A company providing managed services (Managed Services)

MSSP - Managed Security Services Provider

A company providing managed services (Managed Services) in the field of cybersecurity.

N

NAS - Network-attached storage

is a server for storing data at the file level.

In essence, it is a computer with some disk array connected to a network (usually a local one) and supporting operation over the protocols accepted in it.

Several such computers can be combined into a single system.

wiki

NLA - Network Level Authentication

this is a function of Remote Desktop Services (RDP server) or Remote Desktop Connection (RDP client) that requires the connecting user to authenticate before a session is established with the server.

Initially, if a user opened an RDP session (remote desktop) on a server, it loaded the login screen from the server for the user.

This would require resources on the server and was a potential area for attacks such as "denial of service" (DoS) , as well as remote code execution attacks (see BlueKeep).

Network Level Authentication delegates the user's credentials from the client through a client-side security support provider and prompts the user to authenticate before a session is established on the server.

wiki

O

OAuth

OAuth is an open authorization protocol (scheme) that allows a third party to be granted limited access to a user's protected resources without the need to transfer the login and password to it (the third party).

Read more about the principle of authorization with OAuth in the article OAuth

RFC6849 RFC8252

wiki

OCSP

Online Certificate Status Protocol

The Online Certificate Status Protocol is an internet protocol used to obtain the revocation status of an X.509 digital certificate.

The protocol mechanism is described in RFC 6960 and is one of the de-facto standards of the Internet. It was created as an alternative to lists of certificate revocation (CRL) , in particular to solve some problems related to the use of CRL in public key infrastructure (PKI).

OCSP messages are encoded in ASN.1 and are usually transmitted over HTTP. The “request/response” dialogues of these messages allow OCSP servers to be called OCSP responders.

Not all web browsers use OCSP to check certificates SSL / TLS of the protocol HTTPS .

OIDC

OpenID Connect is a standardized identity layer for authentication that uses OAuth2 (not to be confused with OpenID, which provides authentication only, or pure OAuth2, which provides authorization only).

While OIDC uses OAuth2 for authorization, it also uses (some would say abuses) OAuth2 authorization to perform authentication tasks.

OSINT

Open source intelligence - intelligence based on open sources.

An intelligence discipline that includes the search, selection and collection of intelligence information from publicly available sources, as well as its analysis.

In the intelligence community, the term “open information source” is used, which indicates the public availability of the source (as opposed to secret sources and sources with limited use), but it is not related to the concept of “just a source of information” (open source information; OSIF), meaning any information located in the media space.

This concept is not identical to “public intelligence”. It should also not be confused with the concept of “open-source software”.

According to statements by CIA analyst Sherman Kent in 1947, policymakers receive from open sources up to 80 percent of the information they need to make decisions in peacetime.

Later, Lieutenant General Samuel Wilson, who was the head of the US DIA in 1976-1977, noted that “90 percent of intelligence comes from open sources and only 10 — through the work of agents”.

OWASP

Open Web Application Security Project — an open project for ensuring the security of web applications

The OWASP community includes corporations, educational organizations and individuals from all over the world. The community works on creating articles, tutorials, documentation, tools and technologies that are freely available.

The OWASP Foundation is a charitable organization that provides support and manages OWASP projects and infrastructure. In addition, the Foundation has been registered as a non-profit organization in Europe since June 2011.

OWASP is not affiliated with any technology development company, but it supports the competent use of security technologies. The project avoids affiliation because it believes that freedom from the influence of other organizations can facilitate the dissemination of impartial, useful and inexpensive information about application security.

OWASP community members make applications safer by taking into account the human factor and the technological level.

The most in-demand documents published by OWASP include: the OWASP Guide, the OWASP Code Review Guide and the widely used OWASP Top 10 Project.

The most common OWASP tools are the training environment, the WebScarab proxy analyzer and .NET tools. OWASP consists of approximately 190 local chapters located around the world and thousands of participants in the project's mailing lists.

OWASP has organized a series of AppSec conferences to further build a community dedicated to application security.

OWASP creates standards, the first of which was published under the name OWASP Application Security Verification Standard (ASVS)).

The main goal of OWASP ASVS is the standardization of the scope and level of rigor of security applications available on the market. The goal of OWASP ASVS was also to create a set of commercially successful open standards adapted for specialized web technologies. The Web Application edition has already been published. The Web Services edition is in the process of development.

OWASP Secure Coding Practices Quick Reference Guide wiki

P

PACS - Physical Access Control System

An access control and management system (ACS) is a set of software and hardware technical control and management tools aimed at restricting and recording the entry and exit of objects (people, vehicles) to a given territory through “checkpoints”: doors, gates, checkpoints.

The main task is to control access to a given territory:

whom to let in

at what time

to what territory

Including also:

Additional tasks:

At particularly critical facilities, the network of ACS devices is made physically disconnected from other information networks.

wiki

PAM - Privileged Account Management

it is part of the identity and access management system ( IAM ), which deals exclusively with the protection of privileged accounts in the enterprise, including the accounts of operating systems, databases, servers, applications, virtual machines and network devices.

PKI - Public key infrastructure

Public key infrastructure (PKI) is a set of tools (technical, material, human, etc.), distributed services and components, collectively used to support cryptographic tasks based on private and public keys.

PKI is based on the use of a public key cryptographic system and several basic principles:

  1. the private key is known only to its owner;
  2. the certification authority creates an electronic document — a public key certificate, thereby certifying the fact that the private (secret) key is known exclusively to the owner of this certificate, while the public key is freely transmitted in the certificate;
  3. nobody trusts each other, but everyone trusts the certification authority;
  4. the certification authority confirms or refutes that the public key belongs to the given person who owns the corresponding private key.

Read more about PKI in the article «Public key infrastructure»

PoLP - Principle of Least Privilege

The principle of least privilege, also known as the principle of minimal privileges ( Principle of least privilege), or simply least privilege, in information security, computer science and other fields, is the principle of organizing access to resources whereby, at any given level of abstraction from the computing environment, each module (such as a process, user or program that we are considering) must have access to such information and resources as are minimally necessary for the successful achievement of its work goal.

This means giving the user only those privileges that are absolutely necessary to do their job. For example, a user who is engaged in backup does not need to install any other software besides what is necessary for their work. Any other privileges, such as installing software and so on, must be blocked. The principle also applies to home personal computer users, who should work in a regular user account and open their administrator account (password-protected) only when the situation requires it.

With respect to users, the principle of least access means granting users only the minimally necessary capabilities when working with the operating system and applications.

wiki

PTH - Pass the hash

one of the types of replay attack. It allows an attacker to log on to a remote server where authentication is performed using the NTLM or LM protocol.

This method can be used against any server/service that uses the NTLM or LM authentication protocol, regardless of the operating system used on the victim's computer.

Q

qop - Quality of Protection

An option for HTTP Digest Authentication. It can take the values "auth" or "auth-int". It affects how the hash is created.

If set to "auth", only the requested URI will be used. If set to "auth-int", then the request body will also be used.

rfc2617

R

RA - Replay Attack

A replay attack is an attack on an authentication system by recording and then replaying previously sent correct messages or parts of them. Any unchanging information, such as a password or biometric data, can be recorded and used later to imitate authenticity.

RC - Race Condition

A race condition — also concurrency or concurrency nondeterminism — is a design error of a multithreaded system or application in which the operation of the system or application depends on the order in which parts of the code are executed.

The error got its name from a similar design error of electronic circuits (see Race conditions in signals ).

The term race condition refers to engineering jargon and appeared as a result of an inaccurate literal translation of the English equivalent.

In a stricter academic environment it is customary to use the term concurrency nondeterminism.

A race condition is a «floating» error (heisenbug) that manifests itself at random moments in time and «disappears» when one tries to localize it.

wiki

RP - Relying Party

A relying party is a computer term used to denote a server that provides access to a protected software application.

Claims-based applications, where a claim is a statement that a subject makes about itself to establish access, are also called relying party applications (RP).

An RP can also be called a "claims-aware application" or a "claims-based application", and web applications and services can be RPs

Using the security token service (STS), the RP redirects clients to the STS, which authenticates the client and issues it a security token containing a set of claims about the client's identity that it can present to the RP.

Instead of the application authenticating the user directly, the RP can extract these claims from the token and use them for identity-related tasks.

The OpenID standard defines a situation in which a cooperating site can act as an RP, allowing the user to log in to several sites using one set of credentials.

The user benefits from not having to share their login credentials with several sites, and the operators of the cooperating site avoid the need to develop their own login mechanism.

An application demonstrating the relying party concept is software running on mobile devices that can be used not only to give the user access to software applications, but also for secure access to a building, without the need to enter their credentials every time.

wiki

RT - Rainbow Table

A rainbow table is a special variant of lookup tables for reversing cryptographic hash functions, using a mechanism of a reasonable trade-off between the time of searching the table and the memory occupied (time-memory tradeoff).

Rainbow tables are used to crack passwords transformed by means of a hard-to-reverse hash function, as well as for attacks on symmetric ciphers based on a known plaintext.

The use of a key derivation function with a salt makes this attack unfeasible.

Rainbow tables are a development of an earlier and simpler algorithm proposed by Martin Hellman .

wiki

Banner image

S

SAC - Security Analytics Center

Security analytics center is an alternative name for

SOC

SCIM - System for Cross-domain Identity Management

This is a standard for automating the exchange of user identity information between identity domains or IT systems.

One example may be that as a company hires new employees and separates from existing employees, they are added to and removed from the company's electronic employee directory.

SCIM can be used to automatically add/remove (or provision/deprovision) accounts for these users in external systems such as Google Workspace, Office 365 or Salesforce.com. Then a new user account will exist in the external systems for each new employee, and user accounts for former employees may no longer exist in these systems.

In addition to simple user record management (creation and deletion), SCIM can also be used for exchanging information about user attributes, the attribute schema and group membership.

Attributes can range from user contact information to group membership. Group membership or other attribute values are usually used to manage user permissions. Attribute values and group assignments can change, which complicates the task of keeping the corresponding data consistent in several identity domains.

The popularity and importance of the SCIM standard have grown as organizations use more and more SaaS tools. A large organization may have hundreds or thousands of hosted applications (internal and external) and associated servers, databases and shared file resources that require user provisioning.

Without a standard connection method, companies have to write custom software connectors to connect these systems with their own system IdM.

SCIM uses a standardized API over REST with data formatted in JSON or XML.

SDC - Security Defence Center

Security protection center is another alternative name for

SOC

SEM - Security event management

a computer security discipline that uses data inspection tools to centralize the storage and interpretation of logs or events generated by other software running in the network

wiki

SIEM - Security information and event management

a combination of two terms denoting the scope of the software: SIM (Security information management) — management of security information, and SEM (Security event management) — management of security events.

SIEM technology provides real-time analysis of security events (alerts) coming from network devices and applications, and allows responding to them before substantial damage occurs.

wiki

SIM - Security Information Management

it is a cyclical process that includes:

wiki

SOC - Security Operations Center

A security operations center is a centralized unit that deals with security issues at the organizational and technical level.

A SOC in a building or facility is the central place from which personnel control the facility using data processing technology.

As a rule, a SOC is equipped to control access and manage lighting, alarms and vehicle barriers.

A narrower term relating directly to IT is ISOC

Analogous and similar terms:

wiki

SSH - Secure Shell

«secure shell» — a network application-layer protocol that allows remote control of an operating system and tunneling of TCP connections (for example, for file transfer ).

It is similar in functionality to the Telnet and rlogin protocols, but, unlike them, it encrypts all traffic, including the passwords being transmitted.

SSH allows the choice of various encryption algorithms. SSH clients and SSH servers are available for most network operating systems.

SSH allows virtually any other network protocol to be transmitted securely in an unprotected environment.

Thus, one can not only work remotely on a computer through a command shell, but also transmit an audio stream or video over an encrypted channel (for example, from a webcam).

SSH can also use compression of the transmitted data for its subsequent encryption, which is convenient, for example, for remotely launching clients X Window System .

Most hosting providers provide clients with access to their home directory over SSH for a certain fee.

This can be convenient both for working in the command line and for remotely launching programs (including graphical applications).

SSH is an application-layer protocol. An SSH server usually listens for connections on TCP port 22. The specification of the SSH-2 protocol is contained in RFC 4251.

To authenticate the server in SSH, a party authentication protocol based on RSA or DSA digital signature algorithms is used, but authentication by means of a password (Telnet backward compatibility mode) and even by the host ip address (rlogin backward compatibility mode) is also allowed.

Password authentication is the most widespread. With each connection, similar to https, a shared secret key is generated for encrypting traffic. In key pair authentication, a pair of public and private keys is generated in advance for a specific user.

The machine from which the connection is to be made stores the private key, and the remote machine stores the public one.

These files are not transmitted during authentication; the system only checks that the owner of the public key also owns the private one.

With this approach, as a rule, automatic login to the OS as a specific user is configured. Authentication by ip address is insecure; this capability is most often disabled.

To create a shared secret (session key), the Diffie-Hellman algorithm (DH) is used.

To encrypt the transmitted data, symmetric encryption is used, with the AES, Blowfish or 3DES algorithms.

The integrity of data transmission is checked using CRC32 in SSH1 or HMAC-SHA1/HMAC-MD5 in SSH2.

To compress the data to be encrypted, the LempelZiv algorithm (LZ77) can be used, which provides the same compression level as the ZIP archiver.

SSH compression is enabled only at the client's request and is rarely used in practice.

The first version of the protocol, SSH-1, was developed in 1995 by the researcher Tatu Ylönen from the Helsinki University of Technology (Finland). SSH-1 was written to provide greater confidentiality than the rlogin, telnet and rsh protocols.

In 1996, a more secure version of the protocol, SSH-2, incompatible with SSH-1, was developed. The protocol gained even greater popularity, and by 2000 it had about two million users.

At present, the term “SSH” usually means SSH-2, since the first version of the protocol is practically not used now due to significant shortcomings.

In 2006, the protocol was approved by the IETF working group as an Internet standard.

Two implementations of SSH are widespread: a private commercial one and a free open one. The free implementation is called OpenSSH. By 2006, 80 % of computers on the Internet used OpenSSH. The private implementation is developed by the organization SSH Communications Security, which is a wholly owned subsidiary of the Tectia corporation[3]; it is free for non-commercial use. These implementations contain practically the same set of commands.

The SSH-1 protocol, unlike the telnet protocol, is resistant to traffic eavesdropping attacks (“sniffing”), but not resistant to attacks «man in the middle» .

The SSH-2 protocol is also resistant to session hijacking attacks, since it is impossible to join an already established session or intercept it.

To prevent man-in-the-middle attacks when connecting to a host whose key is not yet known to the client, the client software shows the user a “key fingerprint”. It is recommended to carefully compare the “key fingerprint” shown by the client software with the server's key fingerprint, preferably obtained through reliable communication channels or in person.

SSH support is implemented in all UNIX‑like systems, and on most of them the ssh client and server are present among the standard utilities. There are many implementations of SSH clients for non-UNIX OSes as well. The protocol gained great popularity after the widespread development of traffic analyzers and methods of disrupting the operation of local networks, as an alternative to the insecure Telnet protocol for managing important nodes.

To work over SSH, an SSH server and an SSH client are needed. The server listens for connections from client machines and, when a connection is established, performs authentication, after which it begins servicing the client. The client is used to log in to a remote machine and execute commands.

To connect, the server and client must create key pairs — public and private — and exchange public keys. Usually a password is also used.

SSL - Secure Sockets Layer

Secure Sockets Layer — a deprecated cryptographic protocol that implies more secure communication.

It uses asymmetric cryptography for authentication of exchange keys, symmetric encryption to preserve confidentiality, and message authentication codes for message integrity.

The protocol was widely used for instant messaging and voice over IP (English: Voice over IP — VoIP) in applications such as email, internet fax, etc. In 2014, the US government reported a vulnerability in the current version of the protocol. SSL should be excluded from use in favor of TLS

SSL was originally developed by Netscape Communications to add the HTTPS protocol to its Netscape Navigator web browser.

Subsequently, on the basis of the SSL 3.0 protocol, an RFC standard was developed and adopted, which received the name TLS .

In colloquial speech, people sometimes mean TLS but say SSL.

See also:

Connecting SSL to a site

Issuing and installing Let's Encrypt SSL certificates on a VPS

wiki

SSO - Single sign-on

Single sign-on technology is a technology in which the user moves from one section of the portal to another, or from one system to another system not connected with the first system, without re-authentication.

For example, if a web portal has several extensive independent sections (forum, chat, blog, etc.), then, having passed the authentication procedure in one of the services, the user automatically gains access to all the others, which saves them from repeatedly entering their account data.

wiki

STM - Synchronous Transfer Mode

Synchronous data transfer method

Symmetric-key algorithm -

Symmetric cryptosystems (also symmetric encryption, symmetric ciphers) — a method of encryption in which the same cryptographic key is used for encryption and decryption.

Before the invention of the asymmetric encryption scheme, the only existing method was symmetric encryption.

The algorithm's key must be kept secret by both parties; measures must be taken to protect access to the channel along the entire path of the cryptogram, or by the interacting parties through cryptographic objects and messages, if this interaction channel is marked “Not for use by third parties”.

The encryption algorithm is chosen by the parties before the exchange of messages begins.

T

TISAX

- Trusted Information Security Assessment Exchange - an assessment and information exchange mechanism for ensuring the information security of enterprises, developed by the ENX Association and published by Verband der Automobilindustrie (the German Association of the Automotive Industry or VDA).

TISAX concerns the secure handling of information from business partners, the protection of prototypes and data protection in accordance with the General Data Protection Regulation (GDPR) for potential business operations between automobile manufacturers and their service providers. VDA established TISAX in 2017 together with the ENX association.

Tests in accordance with TISAX, especially for service providers, are carried out by "TISAX test service providers". The ENX association acts as the managing organization in the system. It approves the testing service providers and controls the quality of performance and the assessment results.

This is done to guarantee that both the final results correspond to the desired quality and objectivity, and that the rights and obligations of the participants are protected. This allows the company to decide whether the final level of maturity of the provider (service providers and subcontractors) meets the buyer's requirements.

The testing requirements have been revised several times. In October 2020, status 5.0 was published. Background information, scopes of application, execution processes and testing requirements are briefly set out in the guide.

TLS - Transport Layer Security), as well as its predecessor SSL — cryptographic protocols that provide secure data transmission between nodes on the Internet.

TLS and SSL use asymmetric encryption for authentication, symmetric encryption for confidentiality and message authentication codes to preserve message integrity.

This protocol is widely used in applications that work with the Internet, such as web browsers, email, instant messaging and IP telephony (VoIP).

The TLS protocol is based on the specification of the SSL version 3.0 protocol. At present, the development of the TLS standard is handled by the IETF. The last update of the protocol was in RFC 5246 (August 2008) and RFC 6176 (March 2011).

SSL and TLS protocols
ProtocolPublication dateStatus
SSL 1.0not publishednot published
SSL 2.01995Declared obsolete in 2011 (RFC 6176)
SSL 3.01996Declared obsolete in 2015 (RFC 7568)
TLS 1.01999Declared obsolete in 2020
TLS 1.12006Declared obsolete in 2020
TLS 1.22008
TLS 1.32018

TOFU - Trust on First Use

TUFU - Trust upon First Use

Trust on first use is a scheme of authentication , used by client software that must establish a trust relationship with an unknown or not yet trusted endpoint.

In the TOFU model, the client will try to find the endpoint's identifier, usually either the endpoint's public identity key or the fingerprint of that identity key, in its local trust database.

If no identifier yet exists for the endpoint, the client software will either prompt the user to confirm that they have verified the authenticity of the expected identifier, or, if manual verification is assumed to be impossible in the protocol, the client simply trusts the given identifier and records the trust relationship in its trust database.

If a different identifier is received from the opposite endpoint in a subsequent connection, the client software will consider it untrusted.

TOTP - Time-based One-Time Password

Time-based one-time password

an OATH algorithm for generating one-time passwords for secure authentication, which is an improvement of HOTP (HMAC-Based One-Time Password Algorithm).

It is a one-way authentication algorithm — the server verifies the authenticity of the client.

The main difference between TOTP and HOTP is that the password is generated on the basis of time, that is, time is a parameter.

In this case, usually not the exact time is used, but the current interval with pre-established boundaries (usually 30 seconds).

TOTP MFA - Time-based One-Time Password Multifactor Authentication

Multi-Factor Authentication with a Time-based One-Time Password

See also:

MFA

TOTP

U

UKM - Universal Key Manager

Proprietary software for managing keys SSH across the lifecycle for enterprises, developed by the company SSH Security Systems

ssh.com

V

VPC - Virtual private cloud

A virtual private cloud is a configurable on-demand pool of shared computing resources allocated in a public cloud environment, providing a certain level of isolation between different organizations (hereinafter referred to as users) that use these resources.

Isolation between one VPC user and all other users of the same cloud (other VPC users, as well as other public cloud users) is usually achieved by allocating a private IP subnet and a virtual communication construct (such as a VLAN or a set of encrypted communication channels) for each user.

In a VPC, the previously described mechanism providing isolation in the cloud is accompanied by a VPN function (again, dedicated to each VPC user), which provides, by means of authentication and encryption, the organization's remote access to its VPC resources.

With the introduction of the described levels of isolation, the organization using this service effectively operates in a «virtually private» cloud (that is, as if the cloud infrastructure were not shared by other users), and hence the name VPC.

VPC is most often used in the context of cloud infrastructure as a service.

In this context, the infrastructure provider that provides the underlying infrastructure of the public cloud and the provider that implements the VPC service through that infrastructure may be different providers.

wiki

VPN - Virtual Private Network

«Virtual private network» — a generalized name for technologies that allow one or more network connections (a logical network) to be provided over another network (for example, the Internet).

Despite the fact that communications are carried out over networks with a lower or unknown level of trust (for example, over public networks), the level of trust in the constructed logical network does not depend on the level of trust in the underlying networks thanks to the use of cryptography (encryption, authentication, public key infrastructure, tools for protection against replay and modification of messages transmitted over the logical network).

Depending on the protocols used and the purpose, a VPN can provide connections of three types: node-to-node, node-to-network and network-to-network.

wiki

Other dictionaries:

Mathematics dictionary

Nuclear power abbreviations

RFID industry terms - in English

Physics dictionary

Automotive industry terms

Article author: Andrei Olegovich