M

MAC (mandatory access control system)

Access policy is determined by the system rather than by the owner. See also DAC.

Maintenance hook

A backdoor that allows a software developer or vendor to bypass access control mechanisms in order to perform maintenance. These backdoors are often well known and pose a significant security threat if not properly secured.

Malware

Malicious software that typically damages, takes control of, or collects information from, a computer. This classification of software broadly includes viruses, worms, Trojan horses, logic bombs, spyware, and (to a lesser extent) adware.

MAN

Metropolitan area network.

Mandatory access control (MAC)

A system-determined access policy.

Man-in-the-middle attack

A type of attack in which an attacker intercepts messages between two parties and forwards a modified version of the original message.

Mantrap

A physical access control method consisting of a double set of locked doors or turnstiles.

Manual controls

Controls that must be performed manually by persons.

Maximum Tolerable Downtime (MTD)

An extension of a Criticality Assessment that specifies the maximum period of time that a given business process can be inoperative before the organization’s survival is at risk. See also Criticality Assessment.

Media controls

Controls that are used to manage information classification and physical media.

Meet-in-the-middle attack

A type of attack in which an attacker encrypts known plaintext with each possible key on one end, decrypts the corresponding ciphertext with each possible key, and then compares the results in the middle.

Memory addressing

The method used by the CPU to access the contents of memory.

Memory space

The amount of memory available in a computer system.

Message digest

A condensed representation of a message using a one-way hash function.

Metadata

“Data about data” that may present a security risk by revealing private information about a document or its history.

Misdemeanor

Less serious crimes, normally resulting in fines or jail/prison terms of less than one year. See also Felony.

Mission

A statement that defines an organization’s reason for existence.

Monitoring

Activities that verify processes, procedures, and systems.

Monoalphabetic substitution

A cryptographic system that uses a single alphabet to encrypt and decrypt an entire message.

MOSS (MIME Object Security Services)

Provides confidentiality, integrity, identification and authentication, and non-repudiation by using MD2 or MD5, RSA asymmetric keys, and DES. See also RSA, DES.

MPLS (Multi-Protocol Label Switching)

An extremely fast method for forwarding packets through a network by using labels inserted between Layer 2 and Layer 3 headers in the packet.

Multi-level system

A single computer system that handles multiple classification levels between subjects and objects.

Multiprocessing

A system that executes multiple programs on multiple processors simultaneously.

Multiprogramming

A system that alternates execution of multiple programs on a single processor.

Multitasking

A system that alternates execution of multiple subprograms or tasks on a single processor.