P

Packet filtering firewall

A type of firewall that examines the source and destination address of an incoming packet and either permits or denies the packet based on an access control list (ACL). See also ACL.

Packet (or password) sniffing

A type of attack in which an attacker uses a sniffer to capture network packets and analyze their contents.

PAN

Personal Area Network.

PAP (Password Authentication Protocol)

A remote access control protocol that uses a two-way handshake to authenticate a peer to a server when a link is initially established.

Password

A string of characters (a word or phrase) that a subject provides to an authentication mechanism in order to authenticate to a system.

Patent

As defined by the U.S. Patent and Trademark Office (PTO), a patent is “the grant of a property right to the inventor.”

Patriot Act

A U.S. law that expanded the authority of law enforcement agencies for the purpose of combating terrorism.

PEAP (Protected EAP, or Protected Extensible Authentication Protocol)

An open standard used to transmit authentication information in a protected manner.

PEM (Privacy Enhanced Mail)

Provides confidentiality and authentication using 3DES for encryption, MD2 or MD5 message digests, X.509 digital certificates, and the RSA asymmetric system for digital signatures and secure key distribution. See also 3DES, RSA.

Penetration testing

A test that attempts to penetrate a system in order to enumerate it and identify potential software vulnerabilities. Also known as “pen testing.”

Personal identification number (PIN)

A numeric-only password, usually used when only a numeric keypad (versus an alphanumeric keyboard) is available. See also Password.

PGP (Pretty Good Privacy)

A freely available, open-source e-mail application that provides confidentiality and authentication using the IDEA cipher for encryption and the RSA asymmetric system for digital signatures and secure key distribution. See also RSA.

Pharming

A phishing attack that is targeted towards a specific organization. See also Phishing.

Phishing

A social engineering attack technique widely used in identity theft crimes. An e-mail, purportedly from a known legitimate business (typically financial institutions, online auctions, retail stores, and so on) requests the recipient to verify personal information online at a forged or hijacked Web site. See also Pharming, Spear Phishing.

Physical controls

Controls that ensure the safety and security of the physical environment.

PKI (Public Key Infrastructure)

Enables secure e-commerce through the integration of digital signatures, digital certificates, and other services necessary to ensure confidentiality, integrity, authentication, non-repudiation, and access control.

Plaintext

A message in its original readable format or a ciphertext message that has been properly decrypted (unscrambled) to produce the original readable plaintext message.

Policy

A formal high-level statement of an organization’s objectives, responsibilities, ethics and beliefs, and general requirements and controls.

Polyinstantiation

Allows different versions of the same data to exist at different sensitivity levels.

Port scan

A test used to determine which TCP/IP service ports on a system are running.

PPP (Point-to-Point Protocol)

Used in remote access service (RAS) servers to encapsulate IP packets and establish dial-in connections over serial and Integrated Services Digital Network (ISDN) links.

PPTP (Point-to-Point Tunneling Protocol)

A VPN protocol designed for individual client-server connections.

Preventive controls

Controls that prevent unwanted events.

Privacy

The security and protection of personal information.

Procedures

Provides detailed instructions on how to implement specific policies and meet the criteria defined in standards.

Process isolation

An operating system feature whereby different user processes are unable to view or modify information related to other processes.

Promiscuous mode

A setting on a computer’s network adaptor wherein all network is passed to the CPU, not just traffic addressed to it. See also Sniffing.

Protection domain

Prevents other programs or processes from accessing and modifying the contents of address space that has already been assigned to an active program or process.

Protection rings

A security architecture concept that implements multiple domains with increasing levels of trust near the center.

Proximate causation

An action taken or not taken as part of a sequence of events that resulted in negative consequences.

Prudent man rule

Under the Federal Sentencing Guidelines, senior corporate officers are required to perform their duties in good faith, in the best interests of the enterprise, and with the care and diligence that ordinary, prudent persons in a like position would exercise under similar circumstances.

Pseudo flaw

A form of social engineering wherein the attacker attempts to trick persons into performing certain actions to remedy a supposed security situation.

Public key cryptography

A cryptographic method that permits parties to communicate with each other without the benefit of exchanging a secret key in advance.

Punitive damages

Determined by a jury and intended to punish the offender.