system which an end-user uses to access services hosted on another
computer system called a server. 'Client' may also refer to a
program or a part of a system that is used by an end-user to
access services provided by another program (for example, a web
browser is a client that accesses pages provided by a Web Server).
Compound Documents
A 'document' is a file containing (a set of) data. Files may
consist of multiple parts: a plain document, an encrypted
document, a digitally-signed documents or a compressed document.
Multi-part files are known as compound documents and may require a
variety of programs to be used in order to interpret and
manipulate it. These programs may be used without the user's
knowledge.
(Computer) Account
This term describes the authorization to access a specific
computer system or network. Each end-user has to use an account,
which consists most probably of a combination of user name and
password or another means of proving that the end-user is the
person the account is assigned to.
Configuring Network Services
The part of an administrator's task that is related to specifying
the conditions and details of network services that govern the
service provision. In regard to a Web server, this includes which
Web pages are available to whom and what kind of information is
logged for later review purposes.
Cookies
Cookies register information about a visit to a web site for
future use by the server. A server may receive information of
cookies of other sites as well which create concern in terms of
breach of privacy.
Cracker
This term is used to describe attackers, intruders or other bad
guys that do not play by the rules and try to circumvent security
mechanisms and/or attack individuals and organisations.
Daemons (inetd, talkd, etc.)
These are processes that run on computer systems to provide
services to other computer systems or processes. Typically,
daemons are considered "servers".
Decrypting
The process of reversing the encryption of a file or message to
recover the original data in order to use or read it.
Default Account
Some systems and server software come with preconfigured accounts.
These accounts may be set up with a predefined (user name and)
password to allow anyone access and are often put there to make it
convenient for users to login initially. Default accounts should
be turned off or have their predefined passwords changed, to
reduce the risk of abuse to the system.
Dial-in Service
A way of providing access to computer systems or networks via a
telecommunications network. A computer uses a modem to make a
telephone call to a another modem, which in turn provides 'network
access service'. See also: PPP.
Digital Signature
A digital signature is created by a mathematical computer program.
It is not a hand-written signature nor a computer-produced picture
of one. The signature is like a wax seal that requires a special
stamp to produce it, and is attached to an Email message or file.
The origin of the message or file may then be verified by the
digital signature (using special tools).
Downloaded Software
Software packages retrieved from the Internet (using, for example,
the FTP protocol).
Downloading
The act of retrieving files from a server on the network.
Email Packages
To communicate via electronic mail, an end-user usually makes use
of an Email client that provides the user-interface to create,
send, retrieve and read Email. Various different Email packages
provide the same set of basic functions but have different user-
interfaces and perhaps, special/extra functions. Some Email
packages provide encryption and digital signature capabilities.
Email Security Software
Software which provides security through digital signatures and
encryption (and decryption) to enable the end-user to protect
messages and documents prior to sending them over a possibly
insecure network. PGP is an example of such software.
Encrypting / Encryption
This is a mathematical process of scambling data for privacy
protection.
Encryption Software
The software that actually provides the needed functionality for
end users to encrypt messages and files. PGP is one example.
End-User
An (human) individual that makes use of computer systems and
networks.
Files (programs, data, text and so on)
Files include user data, but also programs, the computer operating
system and the system's configuration data.
File Server
A computer system that provides a way of sharing and working on
files stored on the system among users with access to these files
over a network.
File Transfer
The process of transferring files between two computer systems
over a network, using a protocol such as FTP or HTTP.
Fixes, Patches and installing them
Vendors, in response to the discovery of security vulnerabilities,
provide sets of files that have to be installed on computer
systems. These files 'fix' or 'patch' the computer system or
programs and remove the security vulnerability.
FTP (File Transfer Protocol)
A protocol that allows for the transfer of files between an FTP
client and FTP server.
Group of Users
Security software often allow permissions to be set for groups (of
users) as opposed to individuals.
Help Desk
A support entity that can be called upon to get help with a
computer or communication problem.
Internet
A collection of interconnected networks that use a common set of
protocols called the TCP/IP stack to enable communication between
the connected computer systems.
Key Escrow
Keys are used to encrypt and decrypt files. key escrow is used to
store keys for use by third parties to access the data in
encrypted files.
Keys Used to Encrypt and Decrypt Files
To make use of encryption, an end-user has to provide some secret,
in the form of some data, usually called a key.
Log In, Logging into a System
This is an action performed by an end-user, when he authenticates
himself to a computer system.
Log In Prompt
The characters that are displayed when logging into a system to
ask for user name and password.
Logged In
If an end-user has successfully proven to have legitimate access
to a system, he is considered to be logged in.
Logging
Systems and server software often provide the ability to keep
track of events. Events may be configured to be written out to a
file known as a log. The log file can be read later and allows
for system failures and security breaches to be identified.
Masquerade (see Remote Log In)
Anyone who pretends to be someone they are not in order to obtain
access to a computer account is said to be in 'masquerade'. This
may be accomplished by providing a false user name, or stealing
someone else's password and logging in as him.
Network File System (NFS, file sharing with PCs, etc.)
NFS is an application and protocol suite that provides a way of
sharing files between clients and servers. There are other
protocols which provide file access over networks. These provide
similar functionality, but do not interoperate with each other.
Networking Features of Software
Some software has features which make use of the network to
retrieve or share data. It may not be obvious that software has
networking features.
Network Services
Services which are not provided on the local computer system the
end-user is working on but on a server located in the network.
One-Time Passwords (OTP)
Instead of using the same password over and over again, a
different password is used on each subsequent log in.
Passphrase
A passphrase is a long password. It is often composed of several
words and symbols to make it harder to guess.
Password-Locked Screensaver
A screen saver obscures the normal display of a monitor. A
password-locked screensaver can only be deactivated if the end-
user's password is supplied. This prevents a logged-in system
from being abused and hides the work currently being done from
passers-by.
Patch
See "Fixes, Patches and installing them"
Permissions
Another word for the access controls that are used to control the
access to files and other resources.
PGP (Pretty Good Privacy)
PGP is an application package that provides tools to encrypt and
digitally sign files on computer systems. It is especially useful
to encrypt and/or sign files and messages before sending them via
Email.
Plug-in Modules
Software components that integrate into other software (such as
web browsers) to provide additional features.
Point-of-Contact, Security
In case of security breaches or problems, many organisations
provide a designated point-of-contact which can alert others and
take the appropriate actions.
PPP (Point to Point Protocol)
PPP is the mechanism which most end-users establish a network
connection between their PC and their Internet service provider
with. Once connected, the PC is able to transmit and receive data
to any other system on the network.
Privacy Programs
Another term for encryption software that highlights the use of
this software to protect the confidentiality and therefore privacy
of the end-users that make use of it.
Remote Access Software
This software allows a computer to use a modem to connect to
another system. It also allows a computer to 'listen' for calls
on a modem (this computer provides 'remote access service'.)
Remote access software may provide access to a single computer or
to a network.
Remote Log In
If an end-user uses a network to log in to a system, this act is
known as remote log in.
Security Features
These are features which provide protection or enable end-users
and administrators to assess the security of a system, for
example, by auditing it.
Security Policy
A security policy is written by organisations to address security
issues, in the form of "do's" and "don'ts". These guidelines and
rules are for users with respect to physical security, data
security, information security and content (eg. rules stating that
sites with sexual content should not be visited, and that
copyrights should be honoured when downloading software, etc).
Server
A server is a computer system, or a set of processes on a computer
system providing services to clients across a network.
Shared Account
A common account is one which is shared by a group of users as
opposed to a normal account which is available to only one user.
If the account is misused, it is very difficult or impossible to
know which of users was responsible.
Sharing Permissions
Many computer systems allow users to share files over a network.
These systems invariably provide a mechanism for users to use to
control who has permission to read or overwrite these files.
Site
Depending on the context in which this term is used, it might
apply to computer systems that are grouped together by
geographical location, organizational jurisdiction, or network
addresses. A Site typically refers to a network under a common
administration.
SSH (Secure Shell)
SSH provides a protocol between a client and server, allowing for
encrypted remote connectivity.
SSL (Secure Sockets Layer)
This protocol provides security services to otherwise insecure
protocols which operate over a network. SSL is typically used by
web browsers to encrypt data sent to and downloaded from a server.
Systems Administrator
The individual who maintains the system and has system
administrator privileges. In order to avoid errors and mistakes
done by this individual while not acting as an administrator,
he/she should limit the time he/she acts as an administrator (as
known to the system) to a minimum.
System Administrator Privileges
System administrators have more rights (greater permissions) as
their work involve the maintenance of system files.
System Files
The set of files on a system that do not belong to end-users,
which govern the functionality of the system. System files have
a great impact on the security of the system.
Telnet
A protocol that enables remote log in to other computer systems
over the network.
Terminal
A dumb device that is connected to a computer system in order to
provide (text-based) access to it for users and administrators.
Terms of Service (TOS)
See "Acceptable Use Policy (AUP)".
Threats
The potential that an existing vulnerability can be exploited to
compromise the security of systems or networks. Even if a
vulnerability is not known, it represents a threat by this
definition.
Trojan Horse
A program which carries within itself a means to allow the creator
of the program access to the system using it.
Virus
A program which replicates itself on computer systems by
incorporating itself (secretly and maliciously) into other
programs. A virus can be transferred onto a computer system in a
variety of ways.
Virus-Detection Tool
Software that detects and possibly removes computer viruses,
alerting the user appropriately.
Vulnerability
A vulnerability is the existence of a weakness, design, or
implementation error that can lead to an unexpected, undesirable
event compromising the security of the system, network,
application, or protocol involved.
Web Browser Cache
This is the part of the file system that is used to store web
pages and related files. It can be utilized to reload recently
accessed files from the cache instead of loading it every time
from the network.
Web Browser Capabilities
The set of functionalities on a web browser for use by the end-
user. This includes the set of plug-ins available.
Web Server
A server program that provides access to web pages. Some web
servers provide access to other services, such as databases, and
directories.
Worm
A computer program which replicates itself and is self-
propogating. Worms, as opposed to viruses, are meant to spawn in
network environments.
Acknowledgments
The User Security Handbook was a collaborative effort of the Site
Security Handbook Working Group of the IETF. There were also others
who made significant contributions --- Simson Garfinkle and Eric
Luiijf provided very helpful feedback on this document. The Glossary
contribution by Klaus-Peter Kossakowski is much appreciated.
References
[GLOSSARY] Malkin, G., Ed., "Internet User's Glossary", FYI 18, RFC
1983 August 1996.
[RFC2196] Fraser, B., Ed., "Site Security Handbook", FYI 8, RFC2196
September 1997.
Security Considerations
This document discusses what computer users can do to improve
security on their systems.
Authors' Addresses
Erik Guttman
Sun Microsystems
Bahnstr. 2
74915 Waibstadt
Germany
Phone: +49 7263 911701
EMail: erik.guttman@sun.com
Lorna Leong
COLT Internet
250 City Road
City Forum, London
England
Phone: +44 171 390 3900
EMail: lorna@colt.net
Gary Malkin
Bay Networks
8 Federal Street
Billerca, MA 01821
USA
Phone: +1 508 916 4237
EMail: gmalkin@baynetworks.com
Full Copyright Statement
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.