or destruction. (See: system integrity.)
$ system low
(I) The lowest security level supported by a system at a
particular time or in a particular environment. (See: system
high.)
$ system resource
(I) Data contained in an information system; or a service provided
by a system; or a system capability, such as processing power or
communication bandwidth; or an item of system equipment (i.e., a
system component--hardware, firmware, software, or documentation);
or a facility that houses system operations and equipment.
$ system security officer (SSO)
(I) A person responsible for enforcement or administration of the
security policy that applies to the system.
$ system verification
See: (secondary definition under) verification.
$ TACACS
$ TACACS+
See: Terminal Access Controller (TAC) Access Control System.
$ tamper
(I) Make an unauthorized modification in a system that alters the
system's functioning in a way that degrades the security services
that the system was intended to provide.
$ TCB
See: trusted computing base.
$ TCP
See: Transmission Control Protocol.
$ TCP/IP
(I) A synonym for "Internet Protocol Suite", in which the
Transmission Control Protocol (TCP) and the Internet Protocol (IP)
are important parts.
$ TCSEC
See: Trusted Computer System Evaluation Criteria.
$ TELNET
(I) A TCP-based, application-layer, Internet Standard protocol
[R0854] for remote login from one host to another.
$ TEMPEST
(O) A nickname for specifications and standards for limiting the
strength of electromagnetic emanations from electrical and
electronic equipment and thus reducing vulnerability to
eavesdropping. This term originated in the U.S. Department of
Defense. [Army, Kuhn, Russ] (See: emanation security, soft
tempest.)
(D) ISDs SHOULD NOT use this term as a synonym for
"electromagnetic emanations security".
$ Terminal Access Controller (TAC) Access Control System (TACACS)
(I) A UDP-based authentication and access control protocol [R1492]
in which a network access server receives an identifier and
password from a remote terminal and passes them to a separate
authentication server for verification.
(C) TACACS was developed for ARPANET and has evolved for use in
commercial equipment. TACs were a type of network access server
computer used to connect terminals to the early Internet, usually
using dial-up modem connections. TACACS used centralized
authentication servers and served not only network access servers
like TACs but also routers and other networked computing devices.
TACs are no longer in use, but TACACS+ is. [R1983]
- "XTACACS": The name of Cisco Corporation's implementation,
which enhances and extends the original TACACS.
- "TACACS+": A TCP-based protocol that improves on TACACS and
XTACACS by separating the functions of authentication,
authorization, and accounting and by encrypting all traffic
between the network access server and authentication server. It
is extensible to allow any authentication mechanism to be used
with TACACS+ clients.
$ TESS
See: The Exponential Encryption System.
$ The Exponential Encryption System (TESS)
(I) A system of separate but cooperating cryptographic mechanisms
and functions for the secure authenticated exchange of
cryptographic keys, the generation of digital signatures, and the
distribution of public keys. TESS employs asymmetric cryptography,
based on discrete exponentiation, and a structure of self-
certified public keys. [R1824]
$ threat
(I) A potential for violation of security, which exists when there
is a circumstance, capability, action, or event that could breach
security and cause harm. (See: attack, threat action, threat
consequence.)
(C) That is, a threat is a possible danger that might exploit a
vulnerability. A threat can be either "intentional" (i.e.,
intelligent; e.g., an individual cracker or a criminal
organization) or "accidental" (e.g., the possibility of a computer
malfunctioning, or the possibility of an "act of God" such as an
earthquake, a fire, or a tornado).
(C) In some contexts, such as the following, the term is used
narrowly to refer only to intelligent threats:
(N) U. S. Government usage: The technical and operational
capability of a hostile entity to detect, exploit, or subvert
friendly information systems and the demonstrated, presumed, or
inferred intent of that entity to conduct such activity.
$ threat action
(I) An assault on system security. (See: attack, threat, threat
consequence.)
(C) A complete security architecture deals with both intentional
acts (i.e. attacks) and accidental events [FIPS31]. Various kinds
of threat actions are defined as subentries under "threat
consequence".
$ threat analysis
(I) An analysis of the probability of occurrences and consequences
of damaging actions to a system.
$ threat consequence
(I) A security violation that results from a threat action.
Includes disclosure, deception, disruption, and usurpation. (See:
attack, threat, threat action.)
(C) The following subentries describe four kinds of threat
consequences, and also list and describe the kinds of threat
actions that cause each consequence. Threat actions that are
accidental events are marked by "*".
1. "(Unauthorized) Disclosure" (a threat consequence): A
circumstance or event whereby an entity gains access to data
for which the entity is not authorized. (See: data
confidentiality.) The following threat actions can cause
unauthorized disclosure:
A. "Exposure": A threat action whereby sensitive data is
directly released to an unauthorized entity. This includes:
a. "Deliberate Exposure": Intentional release of sensitive
data to an unauthorized entity.
b. "Scavenging": Searching through data residue in a system
to gain unauthorized knowledge of sensitive data.
c* "Human error": Human action or inaction that
unintentionally results in an entity gaining unauthorized
knowledge of sensitive data.
d* "Hardware/software error". System failure that results in
an entity gaining unauthorized knowledge of sensitive
data.
B. "Interception": A threat action whereby an unauthorized
entity directly accesses sensitive data traveling between
authorized sources and destinations. This includes:
a. "Theft": Gaining access to sensitive data by stealing a
shipment of a physical medium, such as a magnetic tape or
disk, that holds the data.
b. "Wiretapping (passive)": Monitoring and recording data
that is flowing between two points in a communication
system. (See: wiretapping.)
c. "Emanations analysis": Gaining direct knowledge of
communicated data by monitoring and resolving a signal
that is emitted by a system and that contains the data
but is not intended to communicate the data. (See:
emanation.)
C. "Inference": A threat action whereby an unauthorized entity
indirectly accesses sensitive data (but not necessarily the
data contained in the communication) by reasoning from
characteristics or byproducts of communications. This
includes:
a. Traffic analysis: Gaining knowledge of data by observing
the characteristics of communications that carry the
data. (See: (main Glossary entry for) traffic analysis.)
b. "Signals analysis": Gaining indirect knowledge of
communicated data by monitoring and analyzing a signal
that is emitted by a system and that contains the data
but is not intended to communicate the data. (See:
emanation.)
D. "Intrusion": A threat action whereby an unauthorized entity
gains access to sensitive data by circumventing a system's
security protections. This includes:
a. "Trespass": Gaining unauthorized physical access to
sensitive data by circumventing a system's protections.
b. "Penetration": Gaining unauthorized logical access to
sensitive data by circumventing a system's protections.
c. "Reverse engineering": Acquiring sensitive data by
disassembling and analyzing the design of a system
component.
d. Cryptanalysis: Transforming encrypted data into plaintext
without having prior knowledge of encryption parameters
or processes. (See: (main Glossary entry for)
cryptanalysis.)
2. "Deception" (a threat consequence): A circumstance or event
that may result in an authorized entity receiving false data
and believing it to be true. The following threat actions can
cause deception:
A. "Masquerade": A threat action whereby an unauthorized entity
gains access to a system or performs a malicious act by
posing as an authorized entity. (See: (main Glossary entry
for) masquerade attack.)
a. "Spoof": Attempt by an unauthorized entity to gain access
to a system by posing as an authorized user.
b. "Malicious logic": In context of masquerade, any
hardware, firmware, or software (e.g., Trojan horse) that
appears to perform a useful or desirable function, but
actually gains unauthorized access to system resources or
tricks a user into executing other malicious logic. (See:
(main Glossary entry for) malicious logic.)
B. "Falsification": A threat action whereby false data deceives
an authorized entity. (See: active wiretapping.)
a. "Substitution": Altering or replacing valid data with
false data that serves to deceive an authorized entity.
b. "Insertion": Introducing false data that serves to
deceive an authorized entity.
C. "Repudiation": A threat action whereby an entity deceives
another by falsely denying responsibility for an act. (See:
non-repudiation service, (main Glossary entry for)
repudiation.)
a. "False denial of origin": Action whereby the originator
of data denies responsibility for its generation.
b. "False denial of receipt": Action whereby the recipient
of data denies receiving and possessing the data.
3. "Disruption" (a threat consequence): A circumstance or event
that interrupts or prevents the correct operation of system
services and functions. (See: denial of service.) The following
threat actions can cause disruption:
A. "Incapacitation": A threat action that prevents or
interrupts system operation by disabling a system component.
a. "Malicious logic": In context of incapacitation, any
hardware, firmware, or software (e.g., logic bomb)
intentionally introduced into a system to destroy system
functions or resources. (See: (main Glossary entry for)
malicious logic.)
b. "Physical destruction": Deliberate destruction of a
system component to interrupt or prevent system
operation.
c* "Human error": Action or inaction that unintentionally
disables a system component.
d* "Hardware or software error": Error that causes failure
of a system component and leads to disruption of system
operation.
e* "Natural disaster": Any "act of God" (e.g., fire, flood,
earthquake, lightning, or wind) that disables a system
component. [FP031 section 2]
B. "Corruption": A threat action that undesirably alters system
operation by adversely modifying system functions or data.
a. "Tamper": In context of corruption, deliberate alteration
of a system's logic, data, or control information to
interrupt or prevent correct operation of system
functions.
b. "Malicious logic": In context of corruption, any
hardware, firmware, or software (e.g., a computer virus)
intentionally introduced into a system to modify system
functions or data. (See: (main Glossary entry for)
malicious logic.)
c* "Human error": Human action or inaction that
unintentionally results in the alteration of system
functions or data.
d* "Hardware or software error": Error that results in the
alteration of system functions or data.
e* "Natural disaster": Any "act of God" (e.g., power surge
caused by lightning) that alters system functions or
data. [FP031 section 2]
C. "Obstruction": A threat action that interrupts delivery of
system services by hindering system operations.
a. "Interference": Disruption of system operations by
blocking communications or user data or control
information.
b. "Overload": Hindrance of system operation by placing
excess burden on the performance capabilities of a system
component. (See: flooding.)
4. "Usurpation" (a threat consequence): A circumstance or event
that results in control of system services or functions by an
unauthorized entity. The following threat actions can cause
usurpation:
A. "Misappropriation": A threat action whereby an entity
assumes unauthorized logical or physical control of a system
resource.
a. "Theft of service": Unauthorized use of service by an
entity.
b. "Theft of functionality": Unauthorized acquisition of
actual hardware, software, or firmware of a system
component.
c. "Theft of data": Unauthorized acquisition and use of
data.
B. "Misuse": A threat action that causes a system component to
perform a function or service that is detrimental to system
security.
a. "Tamper": In context of misuse, deliberate alteration of
a system's logic, data, or control information to cause
the system to perform unauthorized functions or services.
b. "Malicious logic": In context of misuse, any hardware,
software, or firmware intentionally introduced into a
system to perform or control execution of an unauthorized
function or service.
c. "Violation of permissions": Action by an entity that
exceeds the entity's system privileges by executing an
unauthorized function.
$ thumbprint
(I) A pattern of curves formed by the ridges on the tip of a
thumb. (See: biometric authentication, fingerprint.)
(D) ISDs SHOULD NOT use this term as a synonym for "hash result"
because that meaning mixes concepts in a potentially misleading
way.
$ ticket
(I) A synonym for "capability". (See: Kerberos.)
(C) A ticket is usually granted by a centralized access control
server (ticket-granting agent) to authorize access to a system
resource for a limited time. Tickets have been implemented with
symmetric cryptography, but can also be implemented as attribute
certificates using asymmetric cryptography.
$ timing channel
See: (secondary definition under) covert channel.
$ TLS
See: Transport Layer Security. (See: TLSP.)
$ TLSP
See: Transport Layer Security Protocol. (See: TLS.)
$ token
1. (I) General usage: An object that is used to control access and
is passed between cooperating entities in a protocol that
synchronizes use of a shared resource. Usually, the entity that
currently holds the token has exclusive access to the resource.
2. (I) Authentication usage: A data object or a portable, user-
controlled, physical device used to verify an identity in an
authentication process. (See: authentication information, dongle.)
3. (I) Cryptographic usage: See: cryptographic token.
4. (O) SET usage: "A portable device [e.g., smart card or PCMCIA
card] specifically designed to store cryptographic information and
possibly perform cryptographic functions in a secure manner."
[SET2]
$ token backup
(I) A token management operation that stores sufficient
information in a database (e.g., in a CAW) to recreate or restore
a security token (e.g., a smart card) if it is lost or damaged.
$ token copy
(I) A token management operation that copies all the personality
information from one security token to another. However, unlike in
a token restore operation, the second token is initialized with
its own, different local security values such as PINs and storage
keys.
$ token management
(I) The process of initializing security tokens (e.g., see: smart
card), loading data into the tokens, and controlling the tokens
during their life cycle. May include performing key management and
certificate management functions; generating and installing PINs;
loading user personality data; performing card backup, card copy,
and card restore operations; and updating firmware.
$ token restore
(I) A token management operation that loads a security token with
data for the purpose of recreating (duplicating) the contents
previously held by that or another token.
$ token storage key
(I) A cryptography key used to protect data that is stored on a
security token.
$ top CA
(I) A CA that is the highest level (i.e., is the most trusted CA)
in a certification hierarchy. (See: root.)
$ top-level specification
(I) "A non-procedural description of system behavior at the most
abstract level; typically a functional specification that omits
all implementation details." [NCS04] (See: (discussion under)
security policy.)
(C) A top-level specification may be descriptive or formal:
- "Descriptive top-level specification": One that is written in a
natural language like English or an informal design notation.
- "Formal top-level specification": One that is written in a
formal mathematical language to enable theorems to be proven that
show that the specification correctly implements a set of formal
requirements or a formal security model. (See: correctness proof.)
$ traffic analysis
(I) Inference of information from observable characteristics of
data flow(s), even when the data is encrypted or otherwise not
directly available. Such characteristics include the identities
and locations of the source(s) and destination(s), and the
presence, amount, frequency, and duration of occurrence. (See:
wiretapping.)
(O) "The inference of information from observation of traffic
flows (presence, absence, amount, direction, and frequency)."
[I7498 Part 2]
$ traffic flow confidentiality
(I) A data confidentiality service to protect against traffic
analysis.
(O) "A confidentiality service to protect against traffic
analysis." [I7498 Part 2]
$ traffic padding
(I) "The generation of spurious instances of communication,
spurious data units, and/or spurious data within data units."
[I7498 Part 2]
$ tranquillity property
See: (secondary definition under) Bell-LaPadula Model.
$ Transmission Control Protocol (TCP)
(I) An Internet Standard protocol [R0793] that reliably delivers a
sequence of datagrams (discrete sets of bits) from one computer to
another in a computer network. (See: TCP/IP.)
(C) TCP is designed to fit into a layered hierarchy of protocols
that support internetwork applications. TCP assumes it can obtain
a simple, potentially unreliable datagram service (such as the
Internet Protocol) from the lower-layer protocols.
$ Transport Layer Security (TLS)
(I) TLS Version 1.0 is an Internet protocol [R2246] based-on and
very similar to SSL Version 3.0. (See: TLSP.)
(C) The TLS protocol is misnamed, because it operates well above
the transport layer (OSI layer 4).
$ Transport Layer Security Protocol (TLSP)
(I) An end-to-end encryption protocol(ISO Standard 10736) that
provides security services at the bottom of OSI layer 4, i.e.,
directly above layer 3. (See: TLS.)
(C) TLSP evolved directly from the SP4 protocol of SDNS.
$ transport mode vs. tunnel mode
(I) IPsec usage: Two ways to apply IPsec protocols (AH and ESP) to
protect communications:
- "Transport mode": The protection applies to (i.e., the IPsec
protocol encapsulates) the packets of upper-layer protocols,
the ones that are carried above IP.
- "Tunnel mode": The protection applies to (i.e., the IPsec
protocol encapsulates) IP packets.
(C) A transport mode security association is always between two
hosts. In a tunnel mode security association, each end may be
either a host or a gateway. Whenever either end of an IPsec
security association is a security gateway, the association is
required to be in tunnel mode.
$ trap door
(I) A hidden computer flaw known to an intruder, or a hidden
computer mechanism (usually software) installed by an intruder,
who can activate the trap door to gain access to the computer
without being blocked by security services or mechanisms. (See:
back door, Trojan horse.)
$ triple DES
(I) A block cipher, based on DES, that transforms each 64-bit
plaintext block by applying the Data Encryption Algorithm three
successive times, using either two or three different keys, for an
effective key length of 112 or 168 bits. [A9052] (See: DES.)
(C) IPsec usage: The algorithm variation proposed for ESP uses a
168-bit key, consisting of three independent 56-bit quantities
used by the Data Encryption Algorithm, and a 64-bit initialization
value. Each datagram contains an IV to ensure that each received
datagram can be decrypted even when other datagrams are dropped or
a sequence of datagrams is reordered in transit. [R1851]
$ triple-wrapped
(I) S/MIME usage: Data that has been signed with a digital
signature, and then encrypted, and then signed again. [R2634]
$ Trojan horse
(I) A computer program that appears to have a useful function, but
also has a hidden and potentially malicious function that evades
security mechanisms, sometimes by exploiting legitimate
authorizations of a system entity that invokes the program.
$ trust
1. (I) Information system usage: The extent to which someone who
relies on a system can have confidence that the system meets its
specifications, i.e., that the system does what it claims to do
and does not perform unwanted functions. (See: trust level.)
(C) "trusted vs. trustworthy": In discussing a system or system
process or object, this Glossary (and industry usage) prefers the
term "trusted" to describe a system that operates as expected,
according to design and policy. When the trust can also be
guaranteed in some convincing way, such as through formal analysis
or code review, the system is termed "trustworthy"; this differs
from the ABA Guidelines definition (see: trustworthy system).
2. (I) PKI usage: A relationship between a certificate user and a
CA in which the user acts according to the assumption that the CA
creates only valid digital certificates.
(O) "Generally, an entity can be said to 'trust' a second entity
when it (the first entity) makes the assumption that the second
entity will behave exactly as the first entity expects. This trust
may apply only for some specific function. The key role of trust
in [X.509] is to describe the relationship between an entity and a
[certification] authority; an entity shall be certain that it can
trust the certification authority to create only valid and
reliable certificates." [X509]
$ trust chain
(D) ISDs SHOULD NOT use this term as a synonym for "certification
path" because it mixes concepts in a potentially misleading way.
(See: trust.)
$ trust-file PKI
(I) A non-hierarchical PKI in which each certificate user has a
local file (which is used by application software) of public-key
certificates that the user trusts as starting points (i.e., roots)
for certification paths. (See: hierarchical PKI, mesh PKI, root,
web of trust.)
(C) For example, popular browsers are distributed with an initial
file of trusted certificates, which often are self-signed
certificates. Users can add certificates to the file or delete
from it. The file may be directly managed by the user, or the
user's organization may manage it from a centralized server.
$ trust hierarchy
(D) ISDs SHOULD NOT use this term as a synonym for "certification
hierarchy" because this term mixes concepts (see: trust) in a
potentially misleading way and duplicates the meaning of another,
standardized term. (See: trust, web of trust.)
$ trust level
(I) A characterization of a standard of security protection to be
met by a computer system.
(C) The TCSEC defines eight trust levels. From the lowest to the
highest, they are D, C1, C2, B1, B2, B3, and A1. A trust level is
based not only on the presence of security mechanisms but also on
the use of systems engineering discipline to properly structure
the system and implementation analysis to ensure that the system
provides an appropriate degree of trust.
$ trusted
See: (discussion under) trust.
$ trusted certificate
(I) A certificate upon which a certificate user relies as being
valid without the need for validation testing; especially a
public-key certificate that is used to provide the first public
key in a certification path. (See: certification path, root
certificate, validation.)
(C) A trusted public-key certificate might be (a) the root
certificate in a hierarchical PKI, (b) the certificate of the CA
that issued the user's own certificate in a mesh PKI, or (c)
any certificate accepted by the user in a trust-file PKI.
$ trusted computer system
(I) Multilevel security usage: "A system that employs sufficient
hardware and software assurance measures to allow its use for
simultaneous processing of a range of sensitive or classified
information." [NCS04] (See: (discussion under) trust.)
$ Trusted Computer System Evaluation Criteria (TCSEC)
(N) A standard for evaluating the security provided by operating
systems [CSC001, DOD1]. Informally called the "Orange Book"
because of the color of its cover; first document in the Rainbow
Series. (See: Common Criteria, (usage note under) Green Book,
Orange Book, trust level.)
$ trusted computing base (TCB)
(I) "The totality of protection mechanisms within a computer
system, including hardware, firmware, and software, the
combination of which is responsible for enforcing a security
policy." [NCS04] (See: (discussion of "trusted" under) trust.)
$ trusted distribution
(I) "A trusted method for distributing the TCB hardware, software,
and firmware components, both originals and updates, that provides
methods for protecting the TCB from modification during
distribution and for detection of any changes to the TCB that may
occur." [NCS04]
$ trusted key
(I) A public key upon which a user relies; especially a public key
that can be used as the first public key in a certification path.
(See: certification path, root key, validation.)
(C) A trusted public key might be (a) the root key in a
hierarchical PKI, (b) the key of the CA that issued the user's own
certificate in a mesh PKI, or (c) any key accepted by the user in
a trust-file PKI.
$ trusted path
(I) COMPUSEC usage: A mechanism by which a computer system user
can communicate directly and reliably with the trusted computing
base (TCB) and that can only be activated by the user or the TCB
and cannot be imitated by untrusted software within the computer.
[NCS04]
(I) COMSEC usage: A mechanism by which a person or process can
communicate directly with a cryptographic module and that can only
be activated by the person, process, or module, and cannot be
imitated by untrusted software within the module. [FP140]
$ trusted process
(I) A system process that has privileges that enable it to affect
the state of system security and that can, therefore, through
incorrect or malicious execution, violate the system's security
policy. (See: privileged process, (discussion of "trusted" under)
trust.)
$ trusted subnetwork
(I) A subnetwork containing hosts and routers that trust each
other not to engage in active or passive attacks. (There also is
an assumption that the underlying communication channels--e.g.,
telephone lines, or a LAN--are protected from attack by some
means.)
$ trusted system
See: (discussion under) trust, trusted computer system,
trustworthy system.
$ Trusted Systems Interoperability Group (TSIG)
(N) A forum of computer vendors, system integrators, and users
devoted to promoting interoperability of trusted computer systems.
TSIG meetings are open to all persons who are working in the
INFOSEC area.
$ trustworthy system
(O) ABA usage: "Computer hardware, software, and procedures that:
(a) are reasonably secure from intrusion and misuse; (b) provide a
reasonably reliable level of availability, reliability, and
correct operation; (c) are reasonably suited to performing their
intended functions; and (d) adhere to generally accepted security
principles." [ABA] This differs somewhat from other industry
usage. (See: (discussion of "trusted vs. trustworthy" under)
trust.)
$ TSIG
See: Trusted System Interoperability Group.
$ tunnel
(I) A communication channel created in a computer network by
encapsulating (carrying, layering) a communication protocol's data
packets in (on top of) a second protocol that normally would be
carried above, or at the same layer as, the first one. (See: L2TP,
VPN.)
(C) Tunneling can involve almost any OSI or TCP/IP protocol
layers; for example, a TCP connection between two hosts could
conceivably be tunneled through email messages across the
Internet. Most often, a tunnel is a logical point-to-point link--
i.e., an OSI layer 2 connection--created by encapsulating the
layer 2 protocol in a transport protocol (such as TCP), in a
network or internetwork layer protocol (such as IP), or in another
link layer protocol. Often, encapsulation is accomplished with an
extra, intermediate protocol, i.e., a tunneling protocol (such as
L2TP) that is layered between the tunneled layer 2 protocol and
the encapsulating protocol.
(C) Tunneling can move data between computers that use a protocol
not supported by the network connecting them. Tunneling also can
enable a computer network to use the services of a second network
as though the second network were a set of point-to-point links
between the first network's nodes. (See: virtual private network.)
(O) SET usage: The name of a SET private extension that indicates
whether the CA or the payment gateway supports passing encrypted
messages to the cardholder through the merchant. If so, the
extension lists OIDs of symmetric encryption algorithms that are
supported.
$ tunnel mode
(I) IPsec usage: See: transport mode vs. tunnel mode.
$ two-person control
(I) The close surveillance and control of a system, process, or
materials (especially with regard to cryptography) at all times by
a minimum of two appropriately authorized persons, each capable of
detecting incorrect and unauthorized procedures with respect to
the tasks to be performed and each familiar with established
security requirements. (See: dual control, no-lone zone.)
$ Type I cryptography
(O) A cryptographic algorithm or device approved by NSA for
protecting classified information.
$ Type II cryptography
(O) A cryptographic algorithm or device approved by NSA for
protecting sensitive unclassified information (as specified in
section 2315 of Title 10 United States Code, or section 3502(2) of
Title 44, United States Code.)
$ Type III cryptography
(O) A cryptographic algorithm or device approved as a Federal
Information Processing Standard.
$ UDP
See: User Datagram Protocol.
$ unclassified
(I) Not classified.
$ unencrypted
(I) Not encrypted.
$ unforgeable
(I) Cryptographic usage: The property of a cryptographic data
structure (i.e., a data structure that is defined using one or
more cryptographic functions) that makes it computationally
infeasible to construct (i.e., compute) an unauthorized but
correct value of the structure without having knowledge of one of
more keys. (E.g., see: digital certificate.)
(C) This definition is narrower than general English usage, where
"unforgeable" means unable to be fraudulently created or
duplicated. In that broader sense, anyone can forge a digital
certificate containing any set of data items whatsoever by
generating the to-be-signed certificate and signing it with any
private key whatsoever. But for PKI purposes, the forged data
structure is invalid if it is not signed with the true private key
of the claimed issuer; thus, the forgery will be detected when a
certificate user uses the true public key of the claimed issuer to
verify the signature.
$ uniform resource identifier (URI)
(I) A type of formatted identifier that encapsulates the name of
an Internet object, and labels it with an identification of the
name space, thus producing a member of the universal set of names
in registered name spaces and of addresses referring to registered
protocols or name spaces. [R1630]
(C) URIs are used in HTML to identify the target of hyperlinks. In
common practice, URIs include uniform resource locators [R2368]
and relative URLs, and may be URNs. [R1808]
$ uniform resource locator (URL)
(I) A type of formatted identifier that describes the access
method and location of an information resource object on the
Internet. [R1738]
(C) A URL is a URI that provides explicit instructions on how to
access the named object. For example,
"ftp://bbnarchive.bbn.com/foo/bar/picture/cambridge.zip" is a URL.
The part before the colon specifies the access scheme or protocol,
and the part after the colon is interpreted according to that
access method. Usually, two slashes after the colon indicate the
host name of a server (written as a domain name). In an FTP or
HTTP URL, the host name is followed by the path name of a file on
the server. The last (optional) part of a URL may be either a
fragment identifier that indicates a position in the file, or a
query string.
$ uniform resource name (URN)
(I) A URI that has an institutional commitment to persistence and
availability.
$ untrusted process
(I) A system process that is not able to affect the state of
system security through incorrect or malicious operation, usually
because its operation is confined by a security kernel. (See:
trusted process.)
$ UORA
See: user-PIN ORA.
$ update
See: certificate update and key update.
$ URI
See: uniform resource identifier.
$ URL
See: uniform resource locator.
$ URN
See: uniform resource name.
$ user
(I) A person, organization entity, or automated process that
accesses a system, whether authorized to do so or not. (See:
[R2504].)
(C) Any ISD that uses this term SHOULD provide an explicit
definition, because this term is used in many ways and can easily
be misunderstood.
$ User Datagram Protocol (UDP)
(I) An Internet Standard protocol [R0768] that provides a datagram
mode of packet-switched computer communication in an internetwork.
(C) UDP is a transport layer protocol, and it assumes that IP is
the underlying protocol. UDP enables application programs to send
transaction-oriented data to other programs with minimal protocol
mechanism. UDP does not provide reliable delivery, flow control,
sequencing, or other end-to-end services that TCP provides.
$ user identifier
(I) A character string or symbol that is used in a system to
uniquely name a specific user or group of users.
(C) Often verified by a password in an authentication process.
$ user PIN
(O) MISSI usage: One of two personal identification numbers that
control access to the functions and stored data of a FORTEZZA PC
card. Knowledge of the user PIN enables the card user to perform
the FORTEZZA functions that are intended for use by an end user.
(See: SSO PIN.)
$ user-PIN ORA (UORA)
(O) A MISSI organizational RA that operates in a mode in which the
ORA performs only the subset of card management functions that are
possible with knowledge of the user PIN for a FORTEZZA PC card.
(See: no-PIN ORA, SSO-PIN ORA.)
$ usurpation
See: (secondary definition under) threat consequence.
$ UTCTime
(N) The ASN.1 data type "UTCTime" contains a calendar date
(YYMMDD) and a time to a precision of either one minute (HHMM) or
one second (HHMMSS), where the time is either (a) Coordinated
Universal Time or (b) the local time followed by an offset that
enables Coordinated Universal Time to be calculated. Note: UTCTime
has the Year 2000 problem. (See: Coordinated Universal Time,
GeneralizedTime.)
$ v1 certificate
(C) Ambiguously refers to either an X.509 public-key certificate
in its version 1 format, or an X.509 attribute certificate in its
version 1 format. However, many people who use this term are not
aware that X.509 specifies attribute certificates that do not
contain a public key. Therefore, ISDs MAY use this term as an
abbreviation for "version 1 X.509 public-key certificate", but
only after using the full term at the first instance.
(D) ISDs SHOULD NOT use this term as an abbreviation for "version
1 X.509 attribute certificate".
$ v1 CRL
(I) An abbreviation for "X.509 CRL in version 1 format".
(C) ISDs should use this abbreviation only after using the full
term at its first occurrence and defining the abbreviation.
$ v2 certificate
(I) An abbreviation for "X.509 public-key certificate in version 2
format".
(C) ISDs should use this abbreviation only after using the full
term at its first occurrence and defining the abbreviation.
$ v2 CRL
(I) An abbreviation for "X.509 CRL in version 2 format".
(C) ISDs should use this abbreviation only after using the full
term at its first occurrence and defining the abbreviation.
$ v3 certificate
(I) An abbreviation for "X.509 public-key certificate in version 3
format".
(C) ISDs should use this abbreviation only after using the full
term at its first occurrence and defining the abbreviation.
$ valid certificate
(I) A digital certificate for which the binding of the data items
can be trusted; one that can be validated successfully. (See:
validate vs. verify.)
$ valid signature
(D) ISDs SHOULD NOT use this term; instead, use "authentic
signature". This Glossary recommends saying "validate the
certificate" and "verify the signature"; therefore, it would be
inconsistent to say that a signature is "valid". (See: validate
vs. verify.)
$ validate vs. verify
(C) The PKI community uses words inconsistently when describing
what a certificate user does to make certain that a digital
certificate can be trusted. Usually, we say "verify the signature"
but say "validate the certificate"; i.e., we "verify" atomic
truths but "validate" data structures, relationships, and systems
that are composed of or depend on verified items. Too often,
however, verify and validate are used interchangeably.
ISDs SHOULD comply with the following two rules to ensure
consistency and to align Internet security terminology with
ordinary English:
- Rule 1: Use "validate" when referring to a process intended to
establish the soundness or correctness of a construct. (E.g.,
see: certificate validation.)
- Rule 2: Use "verify" when referring to a process intended to
test or prove the truth or accuracy of a fact or value. (E.g.,
see: authenticate.)
The rationale for Rule 1 is that "valid" derives from a word that
means "strong" in Latin. Thus, to validate means to make sure that
a construction is sound. A certificate user validates a public-key
certificate to establish trust in the binding that the certificate
asserts between an identity and a key. (To validate can also mean
to officially approve something; e.g., NIST validates
cryptographic modules for conformance with FIPS PUB 140-1.)
The rationale for Rule 2 is that "verify" derives from a word that
means "true" in Latin. Thus, to verify means to prove the truth of
an assertion by examining evidence or performing tests. To verify
an identity, an authentication process examines identification
information that is presented or generated. To validate a
certificate, a certificate user verifies the digital signature on
the certificate by performing calculations; verifies that the
current time is within the certificate's validity period; and may
need to validate a certification path involving additional
certificates.
$ validation
See: validate vs. verify.
$ validity period
(I) A data item in a digital certificate that specifies the time
period for which the binding between data items (especially
between the subject name and the public key value in a public-key
certificate) is valid, except if the certificate appears on a CRL
or the key appears on a CKL.
$ value-added network (VAN)
(I) A computer network or subnetwork (which is usually a
commercial enterprise) that transmits, receives, and stores EDI
transactions on behalf of its customers.
(C) A VAN may also provide additional services, ranging from EDI
format translation, to EDI-to-FAX conversion, to integrated
business systems.
$ VAN
See: value-added network.
$ verification
1. System verification: The process of comparing two levels of
system specification for proper correspondence, such as comparing
a security policy with a top-level specification, a top-level
specification with source code, or source code with object code.
[NCS04]
2. Identification verification: Presenting information to
establish the truth of a claimed identity.
$ verify
See: validate vs. verify.
$ violation
See: security violation.
$ virtual private network (VPN)
(I) A restricted-use, logical (i.e., artificial or simulated)
computer network that is constructed from the system resources of
a relatively public, physical (i.e., real) network (such as the
Internet), often by using encryption (located at hosts or
gateways), and often by tunneling links of the virtual network
across the real network.
(C) For example, if a corporation has LANs at several different
sites, each connected to the Internet by a firewall, the
corporation could create a VPN by (a) using encrypted tunnels to
connect from firewall to firewall across the Internet and (b) not
allowing any other traffic through the firewalls. A VPN is
generally less expensive to build and operate than a dedicated
real network, because the virtual network shares the cost of
system resources with other users of the real network.
$ virus
(I) A hidden, self-replicating section of computer software,
usually malicious logic, that propagates by infecting--i.e.,
inserting a copy of itself into and becoming part of--another
program. A virus cannot run by itself; it requires that its host
program be run to make the virus active.
$ VPN
See: virtual private network.
$ vulnerability
(I) A flaw or weakness in a system's design, implementation, or
operation and management that could be exploited to violate the
system's security policy.
(C) Most systems have vulnerabilities of some sort, but this does
not mean that the systems are too flawed to use. Not every threat
results in an attack, and not every attack succeeds. Success
depends on the degree of vulnerability, the strength of attacks,
and the effectiveness of any countermeasures in use. If the
attacks needed to exploit a vulnerability are very difficult to
carry out, then the vulnerability may be tolerable. If the
perceived benefit to an attacker is small, then even an easily
exploited vulnerability may be tolerable. However, if the attacks
are well understood and easily made, and if the vulnerable system
is employed by a wide range of users, then it is likely that there
will be enough benefit for someone to make an attack.
$ W3
See: World Wide Web.
$ war dialer
(I) A computer program that automatically dials a series of
telephone numbers to find lines connected to computer systems, and
catalogs those numbers so that a cracker can try to break into the
systems.
$ Wassenaar Arrangement
(N) The Wassenaar Arrangement on Export Controls for Conventional
Arms and Dual-Use Goods and Technologies is a global, multilateral
agreement approved by 33 countries in July 1996 to contribute to
regional and international security and stability, by promoting
information exchange concerning, and greater responsibility in,
transfers of arms and dual-use items, thus preventing
destabilizing accumulations. (See: International Traffic in Arms
Regulations.)
(C) The Arrangement began operations in September 1996. The
participating countries are Argentina, Australia, Austria,
Belgium, Bulgaria, Canada, Czech Republic, Denmark, Finland,
France, Germany, Greece, Hungary, Ireland, Italy, Japan,
Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal,
Republic of Korea, Romania, Russian Federation, Slovak Republic,
Spain, Sweden, Switzerland, Turkey, Ukraine, United Kingdom, and
United States. Participants meet on a regular basis in Vienna,
where the Arrangement has its headquarters.
Participating countries seek through their national policies to
ensure that transfers do not contribute to the development or
enhancement of military capabilities that undermine the goals of
the arrangement, and are not diverted to support such
capabilities. The countries maintain effective export controls for
items on the agreed lists, which are reviewed periodically to
account for technological developments and experience gained.
Through transparency and exchange of views and information,
suppliers of arms and dual-use items can develop common
understandings of the risks associated with their transfer and
assess the scope for coordinating national control policies to
combat these risks. Members provide semi-annual notification of
arms transfers, covering seven categories derived from the UN
Register of Conventional Arms. Members also report transfers or
denials of transfers of certain controlled dual-use items.
However, the decision to transfer or deny transfer of any item is
the sole responsibility of each participating country. All
measures undertaken with respect to the arrangement are in
accordance with national legislation and policies and are
implemented on the basis of national discretion.
$ watermarking
See: digital watermarking.
$ web of trust
(O) PGP usage: A trust-file PKI technique used in PGP for building
a file of validated public keys by making personal judgments about
being able to trust certain people to be holding properly
certified keys of other people. (See: certification hierarchy,
mesh PKI.)
$ web server
(I) A software process that runs on a host computer connected to
the Internet to respond to HTTP requests for documents from client
web browsers.
$ web vs. Web
1. (I) Capitalized: ISDs SHOULD capitalize "Web" when using the
term (as either a noun or an adjective) to refer specifically to
the World Wide Web. (Similarly, see: internet vs. Internet.)
2. (C) Not capitalized: ISDs SHOULD NOT capitalize "web" when
using the term (usually as an adjective) to refer generically to
technology--such as web browsers, web servers, HTTP, and HTML--
that is used in the Web or similar networks.
(C) IETF documents SHOULD spell out "World Wide Web" fully at the
first instance of usage and SHOULD Use "Web" and "web" especially
carefully where confusion with the PGP "web of trust" is possible.
$ wiretapping
(I) An attack that intercepts and accesses data and other
information contained in a flow in a communication system.
(C) Although the term originally referred to making a mechanical
connection to an electrical conductor that links two nodes, it is
now used to refer to reading information from any sort of medium
used for a link or even directly from a node, such as gateway or
subnetwork switch.
(C) "Active wiretapping" attempts to alter the data or otherwise
affect the flow; "passive wiretapping" only attempts to observe
the flow and gain knowledge of information it contains. (See:
active attack, end-to-end encryption, passive attack.)
$ work factor
(I) General security usage: The estimated amount of effort or time
that can be expected to be expended by a potential intruder to
penetrate a system, or defeat a particular countermeasure, when
using specified amounts of expertise and resources.
(I) Cryptography usage: The estimated amount of computing time and
power needed to break a cryptographic system.
$ World Wide Web ("the Web", WWW, W3)
(N) The global, hypermedia-based collection of information and