Dictionary of Terms and List of Cybersecurity Abbreviations

A

AAL :

Authenticator Assurance Level

ATM Adaptation Layer

Authenticator Assurance Level

AAL is a conditional quantity that characterizes security of the authentication transaction.

The higher the AAL, the more secure the process is. authentication.

More secure authentication requires that attackers They had better capabilities and spent more resources to successfully detonate. The authentication process.

Authentication at higher AALs can effectively reduce the risk of attacks.

AAL1 provides some assurance that the applicant controls the authenticator, tied to a subscriber account.

AAL1 requires either single-factor or multi-factor authentication. The range of available authentication technologies.

Successful authentication requires the applicant to prove ownership and control of the authenticator. using a secure authentication protocol.

AAL2 It provides a high level of confidence that the applicant controls the Authentifier(s) linked to the subscriber’s account.

Proof of presence and control of two different authentication factors Secure authentication protocol(s). Approved cryptographic techniques are required in AAL2 and above.

AAL3 provides very high confidence that the applicant is in control of the authenticator(s), tied to a subscriber's account.

AAL3 authentication based on proof of ownership using a cryptographic protocol.

AAL3 authentication requires hardware authenticator and authenticator, providing resistance to impersonation verifier; the same device can fulfill both of these requirements.

In order to authenticate to AAL3, applicants must prove presence and control. Two different authentication factors using secure authentication protocol(s).

Approved cryptographic methods are required.

ATM Adaptation Layer

adaptation ATM Rules determining the method of preparing information for transmission over the ATM network. One of the ATM levels.

The task of AAL is to divide the data stream into ATM cells and reverse assemble it.

Classes:

• AAL-0 (backup): Direct interface to AAL level, included in the standard to enable device manufacturers to disregard AAL levels;
• AAL-1 (voice): synchronous (data delivery without buffering) at a constant speed and with support for connections;
• AAL-2 (video transfer): synchronous with variable speed and with connection support;
• AAL-3 (data transfer): asynchronous with variable speed and with connection support
• AAL-4 (IP network): asynchronous with variable speed and no connection has an additional 4-byte header in the workload area of the ATM cell;
• AAL-5 (signal information, IP over ATM, Ethernet over ATM, SMDS, LANE): asynchronous with variable speed, with support for connections, with a simplified header scheme. Takes control of the sequence of data, to indicate the last It uses the Payload Type Indicator (PTI) bit.

wiki

AAL2 :

Authenticator Assurance Level 2

ATM Adaptation Layer 2

ATM Adaptation Layer 2

This is the level of adaptation. ATM asynchronous data transfer method (ATM), It is mainly used in telecommunications.

For example, it is used for Iu interfaces in the Universal Mobile Telecommunications System, It is also used to transmit digital voice.

Standard specifications, ITU standards I.363.2 and I366.1 are related to AAL2.

wiki

AC - Access Control

«Access Control» — In the field of physical security and information security Access control is the selective restriction of access to a place or other resource. Access management describes the process.

The act of access can mean consumption, entry or use.

Permission to access a resource is called authorization.

Blocks and login credentials are two similar access control mechanisms.

wiki

AD - Active Directory

«Active directory» — Microsoft directory services for operating Windows Server family systems.

It was originally created as LDAP Compatible implementation of directory service, however, starting with Windows Server 2008 . includes integration with other authorization services, performing for them Integrative and unifying role.

Allows administrators to use group policies to ensure uniformity of customization of the user working environment, deploy software provision on multiple computers through group policies or System Center Configuration Manager (formerly Microsoft Systems Management Server) Updating the operating system, application and server software Provide on all computers on the network using Windows Server Update Service.

Stores data and environment settings in a centralized database.

Active Directory networks can be of various sizes: from a few dozen to many. several million objects.

wiki

API - Application Programming Interface

Application software interface, application programming interface Description of methods (set of classes, procedures, functions, structures, or constants) One computer program can interact with another program.

Usually included in the description of an Internet protocol (for example, RFC), software framework (framework) or standard calls of operating system functions.

Often implemented by a separate software library or operating system service.

It is used by programmers when writing all kinds of applications.

Read also the articles: «API testing» and «Textbook on testing»

wiki

APT - Advanced Persistent Threat

“Developed persistent threat” is also a targeted cyber attack. an adversary with a modern level of expertise and significant resources, They allow them to achieve their goals through different vectors. attacks (e.g. informational, physical, and deceptive).

These objectives typically include establishing and expanding its presence within the information technology industry. infrastructure of the target organization for the implementation of intentions to extract information, disruption interfere with critical aspects of the task, program or service being performed; or to take a position that allows these intentions to be realized in the future.

APT as an “Evolved, Sustainable Threat”: Achieving its Goals repeatedly over a long period of time time; adapts to the efforts of the defenders to resist the threat; has an attitude to save The level of penetration in the target infrastructure required to carry out the intentions.

The term APT was originally used to describe cyberattacks on military organizations, but is no longer limited to military sphere.

APT attack surpasses conventional cyber threats, as it is focused on hacking a specific target and is prepared based on information collected for a long time.

APT hacks into target infrastructure by exploiting software vulnerabilities and methods "social engineering."

wiki

ATM - Asynchronous Transfer Mode

asynchronous data transfer method – network high-performance Packet switching and multiplexing technology.

Packets are cells of a fixed size of 53 bytes. where the first 5 bytes are used under the heading.

It is a type of fast packet switching.

Unlike the synchronous method of data transmission ? STM Synchronous transfer mode, ATM is better equipped to provide transfer services data with a very different or changing bitrate.

wiki

Authentication

Authentication is an authentication procedure, for example:

authentication of the user by comparing the password entered by him (for the specified login) password stored in the database of user logins;

confirmation of the authenticity of the e-mail by checking the digital signature of the letter sender key;

checking the checksum of the file for compliance with the amount claimed by the author of this file.

In Russian, the term is used mainly in the field of information technology.

Given the level of trust and security policies of the systems, the authentication process can be be one-sided or reciprocal.

This is usually done using cryptographic methods.

Authentication should not be confused with authorization (a procedure for granting certain rights to the subject) and identification (the procedure for recognizing the subject by his identifier).

wiki

Authorization

Authorization – granting a certain person or group of persons the right to perform certain actions; as well as the process of verifying (confirming) these rights when trying to perform these actions.

It is often said that someone is “authorized” to do this. The operation means he has the right to it.

Authorization should not be confused with authentication, the procedure for verifying the legality of the user. or data, for example, checking the compliance of the password entered by the user with the account password recording in the database, or checking the digital signature of the letter by key encryption, or checking the checksum of the file for compliance with the declared author of this file.

Authorization controls access to various system resources in the process of operation. Legal users after successful authentication.

wiki

AV - Anti Virus

Antivirus program (antivirus, antivirus protection, malware detection tool) Specialized program for detection of computer viruses, as well as unwanted (considered malicious) programs and restore infected (modified) File and prevention programs to prevent infection (modification) of files or operating system with malicious code.

wiki

BC

BC - Backup Copy

Backup is the process of creating a copy of data on a medium (hard disk, floppy disk, etc.) designed to restore data to an original or new location. their location in case of damage or destruction.

wiki

bcrypt Adaptive cryptographic hash function of key formation, used for secure storage of passwords.

Developed by Niels Provos and David Mazières.

The feature is based on the Blowfish cipher, first introduced on USENIX in 1999.

To protect against attacks using rainbow tables, bcrypt uses salt; in addition, the function is adaptive, its running time is easy to adjust and it can be slowed down to complicate the attack by brute force.

Blowfish differs from many algorithms in the computationally complex phase of encryption key preparation.

Provos and Mazières took advantage of this feature, but changed the key preparation algorithm to obtain the cipher "Eksblowfish" (expensive key schedule Blowfish).

The number of rounds in the preparation of keys should be a degree of two; a specific degree can be given using bcrypt.

Originally implemented in the crypt function OpenBSD .

There are implementations for Java , Python , Nim, C# , Ruby , Perl, PHP , Node.js , Go And some others.

wiki

BFS - Brute-force search

Complete brute force or method is a method of solving mathematical problems.

It belongs to the class of methods for finding a solution by exhausting all possible options.

The complexity of a complete search depends on the number of all possible solutions to the problem. If the decision space is very large, then a complete search may not yield results for several years or even centuries.

Any problem in the NP class can be solved completely. However, even if the target is calculated functions from each specific possible solution of the problem can be carried out for polynomial time, depending on the number of all possible solutions, a complete search may require exponential work time.

In cryptography, the computational complexity of a complete search is based on the assessment of the crypto-resistance of ciphers.

In particular, a cipher is considered crypto-resistant, if there is no method of “hacking” significantly faster than It's a full slew of keys.

Cryptographic attacks based on the method of brute force are the most universal, but also the longest.

C

CA - Certificate Authority

In cryptography, the certification center or certification center is a party (department, organization), whose honesty is undeniable, and whose public key is widely known.

The task of the certification authority is to confirm the authenticity of encryption keys using electronic signature certificates.

Technically, the Certification Center is implemented as a component of the global directory service responsible for management of users’ cryptographic keys.

Public keys and other information about users are stored by certification centers in the form of digital certificates.

wiki

Ciphertext - Codex

Encryption, ciphertext - the result of the operation encryption .

Often used in place of the term “cryptogram”, although the latter emphasizes the fact of the transmission of the message, not encryption.

COA - Ciphertext-only attack

One of the main methods of cryptanalysis. It is assumed that the cryptanalyst knows only a set of ciphertexts, the goal is to obtain as many open texts as possible corresponding to the existing ciphertexts, or even better, the key used in encryption. Encryptors can be obtained by simply intercepting messages over open communication channels. This type of attack is weak and uncomfortable.

CPA - Chosen-plaintext attack

An attack based on selected open text is one of the main methods of cryptanalytic opening.

A crypto analyst has a certain number of open texts and corresponding ciphertexts, in addition, he has the ability to encrypt several pre-selected open texts.

CPNI - Customer Proprietary Network Information

Information about the customer’s own network is data collected by telecommunications Companies about consumer phone calls.

It includes the time, date, duration and destination number of each call, the type of network to which the consumer subscribes, and any other information that appears in the consumer’s phone account.

Telemarketers or customer service agents working from Telephone companies must pass an additional level. authentication clientele (usually a PIN or the last four saved payment methods) request the customer’s consent to access payment information, or before using or sharing this information for any purpose, including, but not limited to an offer or any modification of services.

This is usually done at the beginning of a telemarketer’s conversation with a telephone subscriber.

wiki

CRL - Certificate Revocation List

Revoked certificates are a list of certificates that certification centre Marked as withdrawn.

Lists of revoked certificates (OS) are used to determine whether a certificate has been issued. The user or certifying center is withdrawn due to compromise of keys.

An important feature of the SAS is that it contains information only about certificates that have not expired.

Details about CRL read the article Certificate Revocation List

The alternative to CRL is OCSP

CSRF - cross-site request forgery

Cross-site query forgery, also known as XSRF, is a type of attack on website visitors that exploits flaws. HTTP protocol.

If a victim accesses a site created by an attacker, a request to another server is secretly sent from her person. (for example, to the server of the payment system), carrying out some malicious operation (for example, transferring money to the account of an attacker).

To carry out this attack, the victim must be authenticated on the server to which the request is sent. shall not require any confirmation from the user that cannot be ignored or It's faked with an attack script.

This type of attack, contrary to popular misconception, appeared quite a long time ago: the first theoretical reasonings appeared in Russia. In 1988, the first vulnerabilities were discovered in 2000. The term was introduced by Peter Watkins in 2001.

The primary use of CSRF is forcing a victim to do something on a vulnerable site. (change password, secret question to recover password, email, add administrator, etc.)

CSRF can also be used to exploit XSS images found on another server.

CVE - Common Vulnerabilities and Exposures

Database of well-known information security vulnerabilities. Each vulnerability is assigned an identification number of the CVE-year-number[1] type, a description and a number of publicly available references with a description.

CVE is supported by MITRE.

The CVE project is funded by US-CERT.

Features:

One identifier for one vulnerability.

Standardized description of vulnerabilities.

Free download and use.

wiki

D

DAA Access Digest authentication is one of the generally accepted methods used by a web server to process the credentials of a web browser user.

A similar method is used within the SIP VoIP protocol for authentication by the server of a request from the client, i.e. the terminal. This method sends a hash amount of login, password, server address and random data over the network, and provides a greater level of protection than basic authentication, in which data is sent in plain form.

Technically, digest authentication is the application of a cryptographic hash function MD5 to a user’s secret using random values to complicate cryptanalysis and prevent replay attacks. It works at the HTTP protocol level.

This is a more advanced version of HTTP authentication.

Read more about digest authentication in the article HTTP Digest Authentication

DH . Diffie–Hellman

The Diffie-Hellman protocol is a cryptographic protocol that allows two or more parties to obtain a common secret key using an unprotected communication channel.

The resulting key is used to encrypt further exchange using symmetric encryption algorithms.

The public key distribution scheme proposed by Diffie and Hellman revolutionized the world of encryption, as it solved the main problem of classical cryptography – the problem of key distribution.

In its pure form, the Diffie-Hellman algorithm is vulnerable to modification of data in the communication channel, including for attack. «Man-in-the-middle (the man in the middle)» Therefore, schemes using it use additional methods of unilateral or bilateral authentication.

DoS attack Denial-of-service attack - «denial of service»

A hacker attack on a computer system in order to bring it to failure, In other words, it is necessary to create conditions under which conscientious users Systems will not be able to access system resources n servers, or this access will be difficult.

Failure of the attacked system can also be a step towards gaining access. (If in an emergency the software provides any critical information) For example, a version, a piece of code, etc.

But more often it is a measure of economic pressure: the loss of an ordinary revenue-generating service, provider bills and attack-mitigation measures noticeably hit the «target» in the wallet.

wiki

DDoS attack Distributed Denial-of-service attack - Distributed DoS attack

Incoming traffic flooding the victim comes from many different sources.

This effectively makes it impossible to stop an attack simply by blocking one source.

A DoS or DDoS attack is similar to a group of people crowding at the entrance to a store. It impedes access to legitimate customers and thus disrupts trade.

Also on the subject:

Protecting the site from DDoS attacks

Protection system for DDOS attacks - Syncookied

DDOS wikipedia

E

Encipher - encrypt

Convert ordinary text to codetext using cryptography.

Synonyms: encode, encrypt

F

FAL - Federation Assurance Level

«Federal Security Level» —

FAL describes the requirements for how they are created and protected approvals for this transaction.

These levels may be requested by RP or required by configuration. Both RP and IdP for this transaction.

Federation security levels

FAL	Demand
1	Confirmation of the carrier signed Identification Information Provider (IdP)
2	Confirmation of the carrier signed IdP coded RP
3	Holder of key assertion signed by IdP and encrypted to RP

pages.nist.gov

FQDN - Fully Qualified Domain Name

«A fully defined domain name»- domain name that has no ambiguity in definition.

It includes the names of all parent domains of the DNS hierarchy.

In DNS and, most importantly, in zone files, FQDNs end with a point (e.g. example.com.), i.e. include the root A domain name that is unnamed (i.e. empty).

The difference between FQDN and domain name appears when naming the domains of the second, Third level and so on.

To obtain FQDN, you must specify higher domain names. level (e.g. sample is a domain name, but FQDN name looks like a domain name) as sample.gtw-02.office4.example.com.

In DNS domain records (for redirects, mail servers, etc.) FQDNs are always used.

The maximum FQDN size is 255 bytes, with a limit of 63 bytes per domain name.

wiki

H

HSM - Hardware security module

Hardware Security Module (AMB) is a physical computing device, which protects and manages digital keys, performs encryption functions Decryption of digital signatures, strict authentication and Other cryptographic functions.

These modules traditionally come in the form of a plug-in board or an external device. It connects directly to a computer or network server.

The hardware security module contains one or more secure cryptoprocessor chips.

More in the article: HSM

wiki

HTTPS - HyperText Transfer Protocol Secure

Expand the HTTP protocol to support encryption to improve security. HTTPS data is transmitted over cryptographic protocols TLS or obsolete in 2015 SSL

. Unlike HTTP with TCP port 80, HTTPS uses TCP port 443 by default.

The protocol was developed by Netscape Communications for the Netscape Navigator browser. 1994

wiki

I

IAL - Identity Assurance Level

Level of Identity Security

pages.nist.gov

IAM , IdM , IdAM - Identity and Access Management

Account management (English). Identity management. IdM, sometimes IDM, IdAM or IAM a set of approaches, practices, technologies and special software tools for management user credentials, access control and management systems (ACS), to improve the security and productivity of information systems Simultaneously reducing costs, optimizing downtime and reducing quantity repetitive tasks.

It addresses the need to ensure adequate access to resources in increasingly heterogeneous technological environments and meeting increasingly stringent Compliance requirements.

You can explore this topic in more detail in the article.

«Identity and Access Management»

wiki

ICAP - Internet Content Adaptation Protocol

The Internet Content Adaptation Protocol (ICAP) is a lightweight HTTP-like protocol specified in RFC 3507 . It is used to expand transparent proxy servers, thereby freeing up resources and standardizing the way new features are implemented.

ICAP is commonly used to verify for viruses and content filters in transparent HTTP proxy cache.

Content adaptation refers to the performance of a specific value-added service (content manipulation) for a relevant customer request/response.

ICAP focuses on using peripheral devices (caching proxy servers) to provide value-added services.

At the heart of this process is a cache that will proxize all client transactions and process them through web servers.

These ICAP servers are focused on a specific function, such as inserting ads, scanning for viruses, scanning with multiple AVs, Content translation, language translation or content filtering.

Offloading additional services from web servers to ICAP servers allows you to scale the same web servers according to the original bandwidth. HTTP capability without having to perform these additional tasks.

wiki

IdP , IDP - Identity Provider

An identity provider is a system entity that creates, maintains and Manages identification information for principals and provides authentication services to verification applications in the Federation or a distributed network.

Identity providers offer user authentication as a service.

Verifying party applications, such as web applications, pass the verification step authenticity of the user to a trusted identity provider.

Such an application of the verifying party is called federative, that is, it consumes federal identification.

An identity provider - this is a «reliable provider that allows you to use single sign-on (SSO) to access other websites ».

SSO Increases usability by reducing password fatigue. It also provides the best Security by reducing the potential attack surface.

Identity providers can facilitate the connection between cloud computing resources and users. thereby reducing the need to re-authenticate users when using mobile and roaming applications.

IDP List for AWS

wiki

IOE - Internet of Evertything

The term is more commonly used IoT - Internet of Things

IoT - Internet of Things

«Internet of Things» is the concept of a data network between physical objects («things») equipped with built-in tools and technologies to interact with each other or with the external environment.

It is assumed that the organization of such networks is able to restructure the economic and social processes to exclude from part of actions and operations the need for participation human.

The concept was formulated in 1999 as a reflection of perspectives. wide application of radio frequency identification tools for interaction physical objects with each other and with the external environment.

Completing the concept with a variety of technological content and implementation of practical solutions for its implementation since the 2010s It is considered a steady trend in information technology, primarily due to the widespread use of wireless networks, the emergence of cloud computing, the development of machine-to-machine technologies interaction, the beginning of the active transition to IPv6 and the development of software-defined networks.

wiki

iPaaS - Integration Platform as a Service

A set of cloud services that enable customers to develop, execute and Manage integration flows between disparate applications.

Under iPaaS cloud integration model, clients manage development deployment of integrations without installing or managing any hardware or intermediate software.

wiki

IPC - Infrastructure Protection Center

Infrastructure Protection Centre - a term used by the Canadian government n instead

SOC

ISOC - Information Security Operations Center

The Information Security Operations Center is a complex, where corporate information systems ? web sites , annexes, database data centers and servers, Networks, desktops and other endpoints They are monitored, evaluated and protected.

Where it is understood from the context instead ISOC for short use the abbreviation SOC - Security Operations Center

The term can be interpreted as follows: SOC is a centralized corporate security monitoring command created by Reduce risk by using technologies and processes to detection of incidents, their localization, analysis and reduction of damage

wiki

K

KPA - Known-plaintext attack

An attack based on open texts is a type of cryptanalysis in which standard excerpts are present in the ciphertext, the meaning of which is known to the analyst in advance. During World War II, English cryptanalysts called such passages "tips" (English crib - hint, cheat sheet).

L

LDAP - Lightweight Directory Access Protocol

«lightweight protocol for accessing directories» — application layer protocol to access the X.500 directory service, developed by the IETF as a lightweight option DAP protocol developed by ITU-T.

LDAP is a relatively simple protocol that uses TCP/IP and allows authentication (bind), search (search) and Comparison (compare), as well as operations of adding, modifying or deleting records.

Typically, an LDAP server receives incoming connections to port 389 via TCP or UDP protocols.

For LDAP sessions encapsulated in SSL, port 636 is commonly used.

Each entry in the LDAP directory consists of one or more attributes and has a unique name. (DN) Distinguished Name).

A unique name may look like, for example:

«cn=Ivan Petrov,ou=Employees,dc=example,dc=com».

A unique name consists of one or more relative unique names. (RDN) Relative Distinguished Name, separated by a comma. A relative unique name has the form AttributeName=value.

At the same level of the catalog, there can be no two records with the same relative unique names. Due to this structure, the unique entries in the LDAP directory can be easily Think of it as a tree.

A record can consist only of those attributes that are defined in the description of the record class (object class), which, in turn, are combined into schemas. The scheme defines which attributes are mandatory for this class and which are optional. The scheme also defines the type and rules for comparing attributes. Each record attribute can store several values.

wiki

M

MFA - Multi-factor authentication

Multifactor Authentication (MFA) – Advanced Authentication, Control Method access to a computer in which a user accesses information More than one “evidence of an authentication mechanism” is required.

The categories of such evidence include:

Knowledge is information that the subject knows. Like a password, a PIN.

Possession is a thing the subject possesses. For example, an electronic or magnetic card, Token, flash memory.

A property the subject possesses. For example, biometrics, natural unique differences: face, fingerprints, iris, capillary patterns, DNA sequence.

wiki

MITM - Man-in-the-middle attack

A middleman attack, or a man-in-the-middle attack, is a type of cryptographic and cryptographic attack. computer security when the attacker secretly relays and the relationship between the two parties who believe, They communicate directly with each other.

It is a method of compromising the communication channel in which the attacker, connecting to the channel between counterparties, intervenes in the transfer protocol, Deleting or distorting information.

One example of a man-in-the-middle attack is active listening. in which the attacker establishes independent links with the victims and transmits messages between them.

This makes the victims believe they are talking to each other. In fact, the whole conversation is controlled by the attacker.

The attacker must be able to intercept all communications between the two victims. And also introduce new ones.

In most cases, this is quite simple, for example, an attacker can lead the way. as the “man in the middle” within the wireless range Access points (Wi-Fi).

This attack is aimed at circumventing mutual authentication or the absence of such It can only succeed if the attacker has the ability to impersonate each endpoint or go unnoticed intermediate node.

Most cryptographic protocols include some form of Endpoint authentication specifically to prevent MITM attacks.

For example, TLS can authenticate one or both parties through a mutually trusted certification authority.

wiki

MS - Managed Services

Managed services are the practice of transferring permanent management activities outside the organization.

The term is close in meaning to the word “outsourcing”.

The person or organization that owns or is directly responsible for the managed organization or system is referred to as the customer or customer.

A person or organization that performs a remotely managed service is a service provider.

Normally, the client remains responsible for the operation and operation of the remotely managed service and does not abandon the general management responsibility for the transferred organization or system.

wiki

MSP - Managed Services Provider

Company providing managed services ?Managed Services)

MSSP - Managed Security Services Provider

Company providing managed services ?Managed Services) in the field of cybersecurity.

N

NAS - Network-attached storage

It is a server for storing data at the file level.

In fact, it is a computer with a disk array, It is connected to a network (usually a local one) and supports work on the protocols adopted in it.

Several such computers can be combined into one system.

wiki

NLA - Network Level Authentication

Remote Desktop Services (RDP server) or Remote Desktop Connection (RDP client) feature that requires the connecting user to undergo authentication prior to establishing a session with the server.

Initially, if a user opened an RDP (Remote Desktop) session on a server, they loaded the login screen from the server to the user.

This would require resources on the server and be a potential area for type attacks. Denial of Service (DoS) and attacks on remote code execution (see para. BlueKeep).

Network-level authentication delegates user credentials from the client through a client-side security support provider and invites the user to authenticate before setting up a session on the server.

wiki

O

OAuth

OAuth is an open authorization protocol (scheme) that allows Provide a third party with limited access to protected User resources without the need to transfer to it (third party) login and password.

More about the principle of authorization by OAuth read the article OAuth

RFC6849 RFC8252

wiki

OCSP

Online Certificate Status Protocol

Network Certificate Status Protocol is an Internet protocol used to obtain status. Revocation of the X.509 digital certificate.

The protocol mechanism is described in RFC 6960 It is one of the de-facto standards of the Internet. It was created as an alternative to lists. withdrawal ?CRL) in particular to address some of the problems associated with the use of n CRL in public key infrastructure ?PKI).

OCSP messages are encoded in ASN.1 and are usually transmitted over HTTP. Request/response dialogues Messages allow OCSP servers to be called OCSP responders.

Not all web browsers use OCSP to verify certificates SSL / TLS protocol HTTPS .

OIDC

OpenID Connect - A standardized authentication layer using OAuth2 (Not to be confused with OpenID, which provides authentication only, or pure Oauth2, which provides only authorization).

While OIDC uses OAuth2 for authorization, it also uses OAuth2 for authorization. (some would say abuse) OAuth2 authorization to perform authentication tasks.

OSINT

Open source intelligence is open source intelligence.

Intelligence discipline involving the search, selection and collection of intelligence from public sources and their analysis.

In the intelligence community, the term “open information source” is used. which indicates the public availability of the source (as opposed to secret and restricted sources), It is not related to the concept of “open source information” (OSIF). It means any information in the media space.

This concept is not identical with “public intelligence”. Also, it should not be confused with the concept of open-source software.

According to 1947 CIA analyst Sherman Kent, politicians receive from open sources. 80% of the information they need to make decisions in peacetime.

Later, Lt. Gen. Samuel Wilson, who was the head of the DIA from 1976-1977, noted that “90 percent of the intelligence comes from open sources and only 10 percent comes from agents.”

OWASP

The Open Web Application Security Project is an open source web application security project.

The OWASP community includes corporations, educational organizations and individuals from around the world. The community works to create articles, tutorials, documentation, tools and technologies that are freely available.

The OWASP Foundation is a charitable organization that supports and manages OWASP projects and infrastructure. The Foundation has been registered as a non-profit organization in Europe since June 2011.

OWASP is not affiliated with any technology development company, but it supports competent use. security technology. The project avoids affiliation because it believes that freedom from influence from other organizations can make it easier. Disseminating unbiased, useful and cheap information about application security.

Members of the OWASP community make applications safer by considering the human factor and technological level.

The most sought-after documents published by OWASP include: OWASP Guide, OWASP Code Review Guide and the widely used Top 10 OWASP Project.

The most common OWASP tools are the training environment, WebScarab proxy analyzer and .NET tools. OWASP consists of approximately 190 local offices located around the world and thousands of participants in the project’s mailing lists.

OWASP organized a series of AppSec conferences to further build a community dedicated to application security.

OWASP creates standards, the first of which was published under the name OWASP Application Security Verification Standard (ASVS).

The main goal of OWASP ASVS is to standardize the range of coverage and the level of rigor of security applications available on the market. The goal of OWASP ASVS was also to create a set of commercially successful open standards tailored for specialized applications. Web technologies. The collection for Web Applications has already been published. Collection for Web Services in the process of development.

OWASP Secure Coding Practices Quick Reference Guide wiki

P

PACS - Physical Access Control System

Access Control and Management System (ACS) – a set of software and hardware technical controls and controls aimed at limiting and registering entry-exit facilities (people, transport) in a given territory through the "points of passage": doors, gates, checkpoints.

The main task is to control access to a given territory:

let in

what time

territory

Also included:

• Restriction of access to a given territory;
• identification of the person having access to the specified territory.

Additional tasks:

• accounting of working time;
• Payroll calculation (when integrated with accounting systems);
• Maintaining a staff/visitor base;
• Integration with a security system, for example:
  • with a video surveillance system for combining archives of system events, transmitting notifications to the video surveillance system about the need to start recording, turning the camera to record the consequences of a recorded suspicious event;
  • with an alarm system (ASS), for example, to restrict access to premises standing on guard, or to automatically remove and place premises on guard.
  • with a fire alarm system (FAR) to obtain information on the condition of fire detectors, automatically unlock evacuation exits and close fire doors in the event of a fire alarm.

At particularly important facilities, the network of ACS devices is performed physically unrelated to other information networks.

wiki

PAM - Privileged Account Management

It is part of the identity and access management system ? IAM ), which deals exclusively with the protection of privileged accounts enterprise, including operating system accounts, databases, servers, applications, virtual machines and network devices.

PKI - Public key infrastructure

Public Key Infrastructure (PKI) – a set of tools (technical, material, human, etc.), distributed services and components used to support crypto-tasks based on private and public keys.

PKI is based on the use of a public key cryptographic system and several basic principles:

1. The private key is known only to its owner.
2. the certification center creates an electronic document - a public key certificate, certifying that the private key is known exclusive to the holder of this certificate, the public key is free transmitted in the certificate;
3. No one trusts each other, but everyone trusts the certifying center.
4. certifying center confirms or refutes the ownership of the public key The person who holds the corresponding private key.

Details about PKI read the article «Public key infrastructure»

PoLP - Principle of Least Privilege

The Principle of Least Privileges, also known as the Principle of Minimum Privileges (English) Principle of least privilege, or simply minimum privilege in information security, computer science and other fields - the principle access to resources when at some level of abstraction from a computing environment, each module (such as a process, user) or the program we are considering must have access to such information resources that are minimally necessary for the successful fulfillment of its work objective.

This means giving the user only those privileges that are absolutely necessary to do their job. For example, a backup user does not need to install any software other than what they need to work with. Any other privileges, such as software installation, etc., must be blocked. The principle also applies to users of a personal computer at home, where they must work in an ordinary user account and open their administrator account (password protected) only when the situation requires it.

For users, the principle of least tolerance means providing users with only the minimum necessary features when working with the operating system and applications.

wiki

PTH - Pass the hash

A type of replay attack. It allows an attacker to log in to a remote server that is authenticated using the NTLM or LM protocol.

This method can be used against any server/service using the NTLM or LM authentication protocol, regardless of the operating system used on the victim's computer.

Q

qop - Quality of Protection

An option for HTTP Digest Authentication. It can be defined as "auth" or "auth-int". Affects that. How the hash is created.

If you put "auth" only the requested URI will be used. If in "auth-int" it's also The request body will be used.

rfc2617

R

RA - Replay Attack

A replay attack is an attack on an authentication system by recording and replaying previously sent correct messages or parts thereof. Any immutable information, such as a password or biometric data, can be recorded and used later to simulate authenticity.

RC - Race Condition

The state of the race - also competition or uncertainty of parallelism - is a design error of the multithreaded a system or application in which the operation of the system or application depends on In what order are the parts of the code executed?

The error got its name from a similar electronic circuit design error. (see para. Racing signals ).

The term race state refers to engineering jargon and appeared due to sloppy translation of the English equivalent.

In a more rigorous academic environment, the The term concurrency uncertainty.

A race condition is a «floating» error (Heisenbug) that manifests at random moments in time and «disappears» when you try to localize it.

wiki

RP - Relying Party

The verification party is a computer term used to refer to a server. providing access to a secure software application.

Applications based on statements, where the statement is a statement that the subject makes itself available for access, also referred to as verification applications (RP).

RP can also be called “assertion-supporting applications” and “assertion-based applications.” Applications and services may be RP

Using the Security Token Service (STS), RP redirects customers to STS. which authenticates the client and issues a security token containing a set of statements about the identity of the client, which he can present RP.

Instead of authenticating the user directly, An RP can extract these statements from the token and use them for identification-related tasks.

The OpenID standard specifies the situation in which a cooperating site can act in the RP quality, allowing the user to log in to multiple sites using a single set of credentials.

The user benefits from the fact that he does not need to share his credentials to log in with The operators of the collaborating site avoid having to develop their own login mechanism.

The application demonstrating the concept of the verification party is software. mobile devices that can be used not only for providing the user with access to software applications, but also for secure access to the building, without having to enter your credentials every time.

wiki

RT - Rainbow Table

A rainbow table is a special version of the search table (English lookup table) for the circulation of cryptographic hash functions, using the mechanism of a reasonable compromise between the search time on the table and the memory occupied (English time-memory tradeoff).

Rainbow tables are used to open passwords converted using a hard-to-reversible hash function, as well as to attack symmetric ciphers based on known clear text.

Using the key forming function using salt makes this attack impossible.

Rainbow tables are the development of an earlier and simple algorithm proposed by the Martin Hellman. .

wiki

S

SAC - Security Analytics Center

Security Analytics – an alternative name for

SOC

SCIM - System for Cross-domain Identity Management

It is a standard for automating the exchange of user identification information between identity domains or IT systems.

One example is that as a company recruits new employees and separates from existing employees, They are added and removed from the electronic directory of employees of the company.

SCIM can be used to automatically add/remove (or grant/remove provision) accounts for these users on external systems such as Google Workspace, Office 365 or Salesforce.com. Then a new user account will exist in external systems for each new employee, and the accounts will exist. Former employees may no longer exist in these systems.

In addition to simple user entries management (creation and deletion), SCIM can also be used to sharing information about user attributes, attribute scheme and group membership.

Attributes can range from user contact information to group membership. Group membership or other attribute values are commonly used to manage user permissions. Attribute values and group assignments may vary, making it difficult to retain relevant data in the several identification domains.

The popularity and importance of the SCIM standard has increased as organizations use more SaaS tools. A large organization may have hundreds or thousands of hosted applications (internal and external) and associated servers. Databases and shared file resources that require user training.

Without a standard method of connection, companies have to write custom software connectors to connect these connectors. systems IdM.

SCIM uses a standardized API via REST with data formatted in JSON or XML.

SDC - Security Defence Center

Security protection is another alternative name for

SOC

SEM - Security event management

discipline of computer security, Using data verification tools to centralize storage and interpretation logs or events generated by other software running on the network

wiki

SIEM - Security information and event management

combining two terms denoting the scope of application SIM (Security Information Management) Security Information Management and Security Event Management (SEM) managing security events.

SIEM technology provides real-time analysis of security events (alarms). from network devices and applications, and allows you to respond to them before substantial damage.

wiki

SIM - Security Information Management

It is a cyclical process that includes:

• Awareness of the need to protect information task-setting
• Collection and analysis of information security data in organization
• Information risk assessment
• Planning for risk management
• Implementation and implementation of appropriate monitoring mechanisms, distribution of roles and responsibility, training and motivation of personnel, operational work protection measures
• Monitoring of mechanisms control, assessment of their effectiveness and appropriate corrective effects.

wiki

SOC - Security Operations Center

A security operations center is a centralized unit, which deals with organizational security and technical level.

The SOC in a building or facility is the central place from which the personnel control. object using data processing technology.

Typically, SOCs are equipped for access control and lighting control. alarms and barriers of vehicles.

A narrower term that refers directly to IT is ISOC

Similar and similar terms:

• IPC - infrastructure protection center
• SAC - security analytics center
• SDC - security defense center

wiki

SSH - Secure Shell

"Secure shell" is an application layer network protocol that allows remote management of the operating system and tunneling TCP connections (for example, for file ).

It is similar in functionality to Telnet and rlogin, but, unlike them, encrypts all traffic, including transmitted passwords.

SSH allows the selection of different encryption algorithms. SSH clients and SSH servers are available for most network operating systems.

SSH allows almost any other network protocol to be transmitted securely in an unprotected environment.

Thus, you can not only remotely work on the computer through the command shell, but also transmit a sound stream or video via an encrypted channel. (e.g. from a webcam).

Also, SSH can use compression of transmitted data for subsequent encryption, which is convenient, for example, for remote launch of clients. X Window System .

Majority hosting For a fee, it gives customers access to their home directory over SSH.

It can be convenient for working in the command line, and for remotely running programs (including graphical applications).

SSH is an application layer protocol. An SSH server typically listens to connections on TCP port 22. The SSH-2 protocol specification is contained in RFC 4251.

For server authentication, SSH uses a party authentication protocol based on RSA or DSA digital signature algorithms, but is also allowed. Authentication with a password (backward compatibility mode with Telnet) and even the host ip address (backward compatibility mode with rlogin).

Password authentication is the most common. With each connection, like https, a shared secret key is generated to encrypt traffic. When authenticating a key pair, a pair of public and private keys is pre-generated for a specific user.

On the machine with which you want to connect, the private key is stored, and on the remote machine - the public key.

These files are not transmitted during authentication, the system only checks that the owner of the public key also owns the private key.

With this approach, as a rule, an automatic login on behalf of a particular user is configured in the OS. IP-address authentication is not secure, this feature is often turned off.

The Diffie-Hellman algorithm (DH) is used to create a general secret (session key).

Symmetric encryption, AES, Blowfish or 3DES algorithms are used to encrypt the transmitted data.

The data integrity is verified using CRC32 in SSH1 or HMAC-SHA1/HMAC-MD5 in SSH2.

The LempelZiv algorithm (LZ77) can be used to compress encrypted data, which provides the same level of compression as the ZIP archiver.

SSH compression is enabled only at the request of the client, and is rarely used in practice.

The first version of the protocol, SSH-1, was developed in 1995. Tattoo Ulenen University of Technology Helsinki (Finland). SSH-1 was written to provide greater privacy than rlogin, telnet, and rsh.

In 1996, a more secure version of the protocol, SSH-2, was developed, which was incompatible with SSH-1. The protocol became even more popular, and by the year 2000, it had There were about two million users.

Currently, the term "SSH" usually refers to SSH-2, since the first version of the protocol is now practically not used.

In 2006, the protocol was approved by the IETF working group as an Internet standard.

Two SSH implementations are common: private commercial and free. Free implementation is called OpenSSH. By 2006, 80% of Internet computers were using OpenSSH. The private implementation is being developed by SSH Communications Security, a wholly owned subsidiary of Tectia,[3] and is free for non-commercial use. These implementations contain almost the same set of commands.

The SSH-1 protocol, unlike the telnet protocol, is resistant to traffic listening attacks ("sniffing"), but unstable to attacks. «the man in the middle» .

The SSH-2 protocol is also resistant to mid-session hijacking attacks, as it is impossible to engage or intercept an already established session.

To prevent man-in-the-middle attacks when connecting to a host whose key is not yet known to the client, the client software shows the user a key fingerprint. It is recommended to carefully check the “key cast” shown by the client software with a cast of the server key, preferably obtained through reliable communication channels or in person.

SSH support is implemented in all UNIX-like systems, and most of them include a client and an ssh server. There are many implementations of SSH clients for non-UNIX OS. The protocol became more popular after the widespread development of traffic analyzers and methods of disrupting the operation of local networks, as an alternative to the insecure Telnet protocol solution for managing important nodes.

To work on SSH, you need an SSH server and an SSH client. The server listens to the connections from the client machines and when establishing a connection, authenticates, after which it begins to service the client. The client is used to log into a remote machine and execute commands.

To connect, the server and client must create pairs of keys – public and private – and exchange public keys. A password is usually also used.

SSL - Secure Sockets Layer

Secure Socket Layer is an outdated cryptographic protocol that implies more secure communication.

It uses asymmetric cryptography to authenticate exchange keys, symmetric encryption to preserve privacy. Message authentication codes for message integrity.

The protocol was widely used for instant messaging and voice over IP. Voice over IP (VoIP) in these applications e-mail, Internet fax, etc. In 2014, the U.S. government reported a vulnerability in the current version of the protocol. SSL should be excluded from work in favor of TLS

SSL was originally developed by Netscape Communications to add HTTPS to its Netscape Navigator web browser.

Subsequently, based on the SSL 3.0 protocol, the RFC standard was developed and adopted. TLS .

In colloquial speech, TLS is sometimes referred to, and SSL is said.

Read also:

Connecting SSL to the site

Release and installation of SSL certificates from Let's Encrypt on VPS

wiki

SSO - Single sign-on

Single-input technology is a technology where the user moves from one part of the portal to another or from one system to another. not associated with the first system, without re-authentication.

For example, if there are several extensive independent sections on the web portal (forum, chat, blog, etc.) then, having passed the authentication procedure in one of the services, The user automatically accesses all other It saves him from repeatedly entering his account data.

wiki

STM - Synchronous Transfer Mode

Synchronous method of data transmission

Symmetric-key algorithm -

Symmetric cryptosystems (also symmetric encryption, symmetric ciphers) encryption method in which the same encryption and decryption are used cryptographic key.

Before the invention of asymmetric encryption scheme, the only existing method was symmetrical encryption.

The key of the algorithm should be kept secret by both parties, measures should be taken to protect access to the channel, along the entire path of the cryptogram, or the parties to interaction through crypto objects, messages, if this channel of interaction is marked “Not for use by third parties”.

The encryption algorithm is selected by the parties before the exchange of messages.

T

TISAX Trusted Information Security Assessment Exchange This is a mechanism for assessing and exchanging information to ensure the information security of enterprises, developed ENX Association and published by Verband der Automobilindustrie (German Automotive Industry Association or VDA).

TISAX deals with the secure processing of information from business partners, the protection of prototypes and the protection of data according to General Data Protection Regulation (GDPR) for potential business transactions between vehicle manufacturers and their service providers. VDA founded TISAX in 2017 with the ENX Association.

Tests in accordance with TISAX, especially for service providers, are conducted by TISAX test service providers. The ENX Association acts as the governing body in the system. He approves service providers. testing and monitoring the quality of performance and evaluation results.

This is done to ensure that, that both the end results correspond to the desired quality and objectivity, and that the rights and The obligations of the participants are protected. This allows the company to decide whether the final level is appropriate. The maturity of the supplier (service providers and subcontractors) to the requirements of the buyer.

Testing requirements have been revised several times. In October 2020, status 5.0 was published. Background information, application areas, execution processes, and testing requirements are summarized in the manual.

TLS Transport Layer Security - Transport Layer Protection Protocol, like its predecessor SSL cryptographic protocols that provide secure data transfer between nodes on the Internet.

TLS and SSL use asymmetric encryption for authentication, symmetric encryption for privacy, and authenticity codes. Messages to preserve the integrity of messages.

This protocol is widely used in applications working with the Internet, such as web browsers, email, instant messaging and IP telephony (VoIP).

The TLS protocol is based on the SSL protocol specification version 3.0. The IETF is currently developing the TLS standard. The latest protocol updates were in RFC 5246 (August 2008) and RFC 6176 (March 2011).

SSL and TLS protocols

Protocol	Date of publication	Status.
SSL 1.0	never published	never published
SSL 2.0	1995	Declared obsolete in 2011 (RFC 6176)
SSL 3.0	1996	Declared obsolete in 2015 (RFC 7568)
TLS 1.0	1999	Declared obsolete in 2020
TLS 1.1	2006	Declared obsolete in 2020
TLS 1.2	2008
TLS 1.3	2018

TOFU - Trust on First Use

TUFU - Trust upon First Use

Trust at first use is a scheme authentication Client software that must establish a trust relationship with an unknown or not yet trusted endpoint.

In the TOFU model, the client will try to find the endpoint identifier, usually either the endpoint public identification key or the fingerprint of the specified identification key, in their local trust database.

If an identifier does not already exist for the endpoint, the client software will either ask the user to confirm that he has verified the authenticity of the intended identifier, or, if manual verification in the protocol is assumed to be impossible, the client simply trusts the identifier and records the trust relationship in his trust database.

If a different identifier is received in a subsequent connection from the opposite endpoint, the client software will consider it unreliable.

TOTP - Time-based One-Time Password

Time-based one-time password

OATH-algorithm for creating one-time passwords for secure authentication, which is an improvement HOTP (HMAC-Based One-Time Password Algorithm).

It is a one-way authentication algorithm – the server verifies the authenticity of the client.

The main difference between TOTP and HOTP is time-based password generation, meaning time is a parameter.

In this case, it is usually not an exact time indication, but a current interval with predetermined boundaries. (usually 30 seconds).

TOTP MFA - Time-based One-Time Password Multifactor Authentication

Multifactor authentication with a one-time password based on time

Read also:

MFA

TOTP

U

UKM - Universal Key Manager

Proprietary key management software SSH life cycle for enterprises, Developed by SSH Security Systems

ssh.com

V

VPC - Virtual private cloud

A virtual private cloud is an on-demand customizable pool of shared computing resources allocated in a public cloud environment that provides a the level of isolation between different organizations (hereinafter referred to as users), using these resources.

Isolation between one VPC user and all other users of the same cloud (Other VPC users and other public cloud users) This is usually achieved by decoupling a private IP subnet and a virtual communications network. design (such as a VLAN or set of encrypted communication channels) for each user.

In VPC, the previously described mechanism that provides insulation in the cloud is accompanied by VPN function (again, dedicated to each VPC user) Provides through authentication and encryption remote access to the organization Her VPC resources.

With the introduction of the described isolation levels, an organization using this service actually works in a «virtually private» cloud (that is, as if the cloud infrastructure were not shared by other users), and hence the name VPC.

VPC is most commonly used in the context of cloud infrastructure as a service.

In this context, the infrastructure provider providing the basic infrastructure the public cloud, and the provider implementing the VPC service through this infrastructure, They can be different suppliers.

wiki

VPN - Virtual Private Network

«Virtual Private Network» — Generalized name of technologies that provide one or more network connections A logical network on top of another network (such as the Internet).

Although communications are carried out over networks with less An unknown level of trust (for example, over public networks) Confidence in the built logical network does not depend on the level of trust to core networks through the use of cryptography (encryption, authentication, public key infrastructure, tools for Protection against repetitions and changes of messages transmitted over the logical network.

Depending on the protocols used and the destination, a VPN can provide connections of three types: node-node, node-network and network-network.

wiki

Other dictionaries:

Dictionary of mathematics

Nuclear power abbreviations

RFID Industry Terms - in English

Physics dictionary

Automotive Industry Terms