Glossary of Security Terms

[Some of these terms were retrieved from SetSolutions, Inc. (2004)]

Abuse of Privilege. When a user performs an action that they should not have, according to organizational policy or law.

Access Control Lists. Rules for packet filters (typically routers) that define which packets to pass and which to block.

Access Router. A router that connects your network to the external Internet.

Application-Layer Firewall. A firewall system in which service is provided by processes that maintain complete TCP connection state and sequencing. Application layer firewalls often readdress traffic so that outgoing traffic appears to have originated from the firewall, rather than the internal host.

Authentication. The process of determining the identity of a user that is attempting to access a system.

Authentication Token. A portable device used for authenticating a user. Authentication tokens operate by challenge/response, time-based code sequences, or other techniques. This may include paper-based lists of onetime passwords.

Authorization. The processes of determining what types of activities are permitted. Usually, authorization is in the context of authentication: once you have authenticated a user, they may be authorized different types of access or activity.

Bastion Host. A system that has been hardened to resist attack, and which is installed on a network in such a way that it is expected to potentially come under attack. Bastion hosts are often components of firewalls, or may be outside Web servers or public access systems. Generally, a bastion host is running some form of general purpose operating system (e.g., Unix, VMS, NT, etc.) rather than a ROM-based or firmware operating system.

Challenge/Response. An authentication technique whereby a server sends an unpredictable challenge to the user, who computes a response using some form of authentication token. Cryptographic Checksum. A one-way function applied to a file to produce a unique fingerprint of the file for later reference. Checksum systems are a primary means of detecting filesystem tampering on Unix.

Data Driven Attack. A form of attack in which the attack is encoded in innocuous -seeming data, which is executed by a user or other software to implement an attack. In the case of firewalls, a data driven attack is a concern since it may get through the firewall in data form and launch an attack against a system behind the firewall. Defense in Depth. The security approach whereby each system on the network is secured to the greatest possible degree. May be used in conjunction with firewalls.

DNS Spoofing. Assuming the DNS name of another system by either corrupting the name service cache of a victim system, or by compromising a domain name server for a valid domain.

Encrypting Router. See Tunneling Router and Virtual Network Perimeter.

Firewall. A system or combination of systems that enforces a boundary between two or more networks.

Host-based Security. The technique of securing an individual system from attack. Host-based security is operating system and version dependent.

Insider Attack. An attack originating from inside a protected network. Intrusion Detection. Detection of break-ins or break-in attempts either manually or via software expert systems that operate on logs or other information available on the network.

IP Splicing/Hijacking. An attack in which an active, established session is intercepted and co- opted by the attacker. IP splicing attacks may occur after an authentication has been made, permitting the attacker to assume the role of an already authorized user. Primary protections against IP splicing rely on encryption at the session or network layer. IP Spoofing. An attack whereby a system attempts to illicitly impersonate another system by using its IP network address.

Least Privilege. Designing operational aspects of a system to operate with a minimum amount of system privilege. This reduces the authorization level at which various actions are performed and decreases the chance that a process or user with high privileges may be caused to perform unauthorized activity resulting in a security breach.

Logging. The process of storing information about events that occurred on the firewall or network.

Log Processing. How audit logs are processed , searched for key events, or summarized.

Log Retention. How long audit logs are retained and maintained . Network-Layer Firewall. A firewall in which traffic is examined at the network protocol packet layer.

Perimeter-based Security. The technique of securing a network by controlling access to all entry and exit points of the network. Policy. Organization-level rules governing acceptable use of computing resources, security practices, and operational procedures.

Proxy. A software agent that acts on behalf of a user. Typical proxies accept a connection from a user, make a decision as to whether or not the user or client IP address is permitted to use the proxy, perhaps does additional authentication, and then completes a connection on behalf of the user to a remote destination.

Session Stealing. See IP Splicing. Social Engineering. An attack based on deceiving users or administrators at the target site. Social engineering attacks are typically carried out by telephoning users or operators and pretending to be an authorized user, to attempt to gain illicit access to systems.

Steganography. Computer steganography is based on two principles. The first one is that the files that contain digitized images or sound can be altered to a certain extent without losing their functionality, unlike other types of data that have to be exact in order to function properly. The other principle deals with the human inability to distinguish minor changes in image color or sound quality.

Trojan Horse. A software entity that appears to do something normal but which, in fact, contains a trapdoor or attack program. Tunneling Router. A router or system capable of routing traffic by encrypting it and encapsulating it for transmission across an untrusted network, for eventual de-encapsulation and decryption.

Virtual Network Perimeter. A network that appears to be a single protected network behind firewalls, which actually encompasses encrypted virtual links over untrusted networks.

Virus. A replicating code segment that attaches itself to a program or data file. Viruses might or might not contain attack programs or trapdoors . Worm. A stand-alone program that, when run, copies itself from one host to another, and then runs itself on each newly infected host. The widely reported Internet Virus of 1988 was not a virus at all, but actually a worm.

Frequently Asked Questions about Computer Viruses

The following list of FAQs is hosted at: http://www.faqs.org/

Computer Virus FAQ for New Users

http://www.faqs.org/faqs/computer-virus/new-users/

Virus-L/comp.virus FAQ v2.00

http://www.faqs.org/faqs/computer-virus/faq/

Viruses and the Mac FAQ

http://www.faqs.org/faqs/computer-virus/macintosh-faq/

alt.comp.virus Mini-FAQ

http://www.faqs.org/faqs/computer-virus/mini-faq/

alt.comp.virus FAQ Part 1/4

http://www.faqs.org/faqs/computer-virus/alt-faq/part1/

alt.comp.virus FAQ Part 2/4

http://www.faqs.org/faqs/computer-virus/alt-faq/part2/

alt.comp.virus FAQ Part 3/4

http://www.faqs.org/faqs/computer-virus/alt-faq/part3/

alt.comp.virus FAQ Part 4/4

http://www.faqs.org/faqs/computer-virus/alt-faq/part4/

Hoax and Chain Letter Databases

The US CERT Coordination Center receives many calls and e- mails from people asking whether or not a message they received via e-mail is true or not. The following list of resources can help you separate the hoaxes from the valid warnings.

Charles Hymes Hoaxes

http://www. nonprofit .net/hoax

CIAC (Computer Incident Advisory Capability)

Internet Hoaxes ” how to identify a new hoax or valid warning and what to do

http://hoaxbusters.ciac.org/HBHoaxInfo.html

IBM antivirus online ” hype alerts!

http://www.av.ibm.com/BreakingNews/HypeAlert/

ICSA - Hoax Information

http://www.icsa.net/html/communities/antivirus/hoaxes/

Internet Chain Letters ” how to recognize a new chain letter, what to do

http://hoaxbusters.ciac.org/HBHoaxInfo.html

McAfee - Virus Information Library - Virus Hoaxes

http://vil.mcafee.com/hoax.asp

Network Associates - Virus Library - Hoaxes

http://www.nai.com/asp_set/anti_virus/library/hoaxes.asp

Virus Organizations and Publications

EICAR (European Institute for Computer Anti-Virus Research)

http://www.eicar.com/

EICAR combines universities, industry and media plus technical, security and legal experts from civil and military government and law enforcement as well as privacy protection organizations whose objectives are to unite non-commercial efforts against writing and proliferation of malicious code like computer viruses or Trojan Horses, and against computer crime, fraud and the misuse of computers or networks, including malicious exploitation of personnel data, based on a code of conduct.

ICSA (International Computer Security Association)

http://www.icsa.net

http://www.icsa.net/html/communities/antivirus/

http://www.virusbtn.com/

The international publication on computer virus prevention, recognition and removal. Virus Bulletin is the technical journal on developments in the field of computer viruses and antivirus products

The WildList Organization International

http://www.wildlist.org/

The mission of the Wildlist Organization is to provide accurate, timely and comprehensive information about In the Wild computer viruses to both users and product developers. The WildList, a list of computer viruses found in the wild and reported by a diverse group of over 40 qualified volunteers, is made available free of charge by the organization.