Training & Professional Development

package

In the context of the Common Criteria for information technology security evaluation, a package is a set of security features that can be added or removed from a target system.

packet

A portion of a message that contains data and the destination address; also called a datagram. Typically located at the Network layer.

packet sniffing

The act of capturing packets from the network in hopes of extracting useful information from the packet contents.

padded cell

Similar to a honeypot. When an intruder is detected by an IDS, the intruder is transferred to a padded cell. The padded cell has the look and layout of the actual network, but within the padded cell the intruder can neither perform malicious activities nor access any confidential data. A padded cell is a simulated environment that may offer fake data to retain an intruder's interest.

pairing

The connecting or linking of two devices over Bluetooth.

palm geography

An example of a biometric factor, which is a behavioral or physiological characteristic unique to a subject. The shape of a person's hand is used to establish identity or provide authentication.

palm scan

An example of a physiological biometric factor, which is unique to a subject. It uses near-infrared light to measure vein patterns in the palm, which are as unique as fingerprints. Some palm scans identify the layout of ridges, creases, and grooves on a person's palm to establish identity or provide authentication. See palm topography.

palm topography

An example of a biometric factor, which is a behavioral or physiological characteristic that is unique to a subject. The layout of ridges, creases, and grooves on a person's palm is used to establish identity or provide authentication. This is the same as a palm scan and similar to a fingerprint.

parallel data systems or parallel computing

A computation system design to perform numerous calculations simultaneously. Parallel data systems often go far beyond basic multiprocessing capabilities. They often include the concept of dividing up a large task into smaller elements and then distributing each subelement to a different processing subsystem for parallel computation. This implementation is based on the idea that some problemsA computation system design to perform numerous calculations simultaneously. Parallel data systems often go far beyond basic multiprocessing capabilities. They often include the concept of dividing up a large task into smaller elements and then distributing each subelement to a different processing subsystem for parallel computation. This implementation is based on the idea that some problems can be solved efficiently if they are broken into smaller tasks that can be worked on concurrently.

parallel run

A type of new system deployment testing in which the new system and the old system are run in parallel.

parallel tests

Testing that involves actually relocating personnel to an alternate recovery site and implementing site activation procedures.

parole evidence rule

A rule that states that when an agreement between parties is put into written form, the written document is assumed to contain all the terms of the agreement and no verbal agreements may modify the written agreement.

partial-knowledge teams

Possess an incomplete account of organizational assets, including hardware and software inventory, prior to a penetration test. Thus, time must be spent in obtaining additional knowledge about the organization before test attacks can begin.

passphrase

A string of characters usually much longer than a password. Once the passphrase is entered, the system converts it into a virtual password for use by the authentication process. Passphrases are often natural-language sentences to allow for simplified memorization.

password

A string of characters entered by a subject as an authentication factor.

Password Authentication Protocol (PAP)

A standardized authentication protocol for PPP. PAP transmits usernames and passwords in the clear. PAP offers no form ofA standardized authentication protocol for PPP. PAP transmits usernames and passwords in the clear. PAP offers no form of encryption; it simply provides a means to transport the logon credentials from the client to the authentication server.

Password-Based Key Derivation Function 2 (PBKDF2)

An example of a key stretching technology. PBKDF2 uses a hashing operation, an encryption cipher function, or an HMAC operation (i.e., a symmetric key is used in the hashing process) on the input password, which is combined with a salt. This process is then repeated thousands of times.

password policy

The section of an organization's security policy that dictates the rules, restrictions, and requirements of passwords. This can also indicate the programmatic controls deployed on a system to improve the strength of passwords.

password restrictions

The rules that define the minimal requirements of passwords, such as length, character composition, and age.

patch management

Program that ensures relevant patches are applied to systems. Ideally, patches are evaluated, tested, and deployed, and systems are audited to verify the patches are applied and not removed.

patent

A governmental grant that bestows on an invention's creator the sole right to make, use, and sell that invention for a set period of time.

pattern-matching detection

See knowledge-based detection.

peer to peer (P2P)

Networking and distributed application solutions that share tasks and workloads among peers.

peer-to-peer network

A network structure between individual devices without the need or use of a primary controlling entity or device.

penetration

See intrusion.

penetration testing

An activity used to test the strength and effectiveness of deployed security measures with an authorized attempted intrusion attack. Penetration testing should be performed only with the consent and knowledge of the management staff.

period analysis

Examining a cryptographic text for patterns that repeat based on the length of the key. The key length is the period of the repetition. This is often a flaw or vulnerability of polyalphabetic substitution ciphers, which leads to a process of frequency analysis.

permanent virtual circuit (PVC)

A predefined virtual circuit that is always available for a Frame Relay customer.

personal identification number (PIN)

A number or code assigned to a person to be used as an identification factor. PINs should be kept secret.

Personal Identity Verification (PIV)

A smart card used by US government personnel that includes a picture and other information about the owner. It can be used as a badge and as a smart card.

personally identifiable information (PII)

Any data item that can be easily and/or obviously traced back to the person of origin or concern.

personnel management

An important factor in maintaining operations security. Personnel management is a form of administrative control or administrative management.

phishing

A form of social engineering that attempts to trick users into giving up sensitive information, opening an attachment, or clicking a link in response to an email. It is sent indiscriminately to a large number of users.

phone phreaking or phreaking

The process of breaking into telephone company computers to place free calls.

physical access control

A physical barrier deployed to prevent direct contact with systems. Examples of physical access controls include guards, fences, motion detectors, locked doors, sealed windows, lights, cable protection, laptop locks, swipe cards, dogs, CCTV, mantraps, and alarms.

physical controls for physical security

See physical access control.

Physical layer

Layer 1 of the OSI model.

physical topology

See network topology.

piggybacking

The act of following someone through a secured gate or doorway without being identified or authorized personally.

ping

A utility used to troubleshoot a connection to test whether a particular IP address is accessible.

ping-of-death attack

A type of DoS. A ping-of-death attack employs an oversized ping packet. Using special tools, an attacker can send numerous oversized ping packets to a victim. In many cases, when the victimized system attempts to process the packets, an error occurs, causing the system to freeze, crash, or reboot.

plain old telephone service (POTS)

Normal telephone service.

plain text

A message that has not been encrypted.

Platform as a Service (PaaS)

The cloud computing concept of providing a computing platform and software solution stack a virtual or cloud-based service. Essentially, it is the concept of paying for a service that provides all the aspects of a platform (i.e., operating system and complete solution package).

playback attack

See replay attack.

Point-to-Point Protocol (PPP)

A full-duplex protocol used for the transmission of TCP/ IP packets over various non-LAN connections, such as modems, ISDN, VPNs, Frame Relay, and so on. PPP is widely supported and is the transport protocol of choice for dial-up Internet connections.

Point-to-Point Tunneling Protocol (PPTP)

An enhancement of PPP that creates encrypted tunnels between communication endpoints. PPTP is used on VPNs but is often replaced by L2TP.

policy

See security policy.

polyalphabetic substitution

A cryptographic transformation that encrypts a message using letter-by-letter conversion and multiple alphabets from different languages or countries.

Poly-instantiation

The event that occurs when two or more rows in the same table appear to have identical primary key elements but contain different data for use at differing classification levels. Polyinstantiation is often used as a defense against some types of inference attacks.

polymorphic virus

A virus that modifies its own code as it travels from system to system. The virus's propagation and destruction techniques remain the same, but the signature of the virus is somewhat different each time it infects a new system.

polymorphism

In the context of object-oriented programming terminology and concepts, the characteristic of an object to provide different behaviors based on the same message and methods owing to variances in external conditions.

port

A connection address within a protocol.

Port Address Translation (PAT)

A mechanism for converting the internal private IP addresses found in packet headers into public IP addresses and port numbers forA mechanism for converting the internal private IP addresses found in packet headers into public IP addresses and port numbers for transmission over the Internet. PAT supports a many-to-one mapping of internal to external IP addresses by using ports.

port isolation or private ports

Private VLANs that are configured to use a dedicated or reserved uplink port. The members of a private VLAN or a port isolated VLAN can interact only with each other and over the predetermined exit port or uplink port. A common implementation of port isolation occurs in hotels.

port scan

Software used by an intruder to probe all of the active systems on a network and determine what public services are running on each machine.

postmortem review

An analysis and review of an activity after its completion to determine its success and whether processes and procedures need to be improved.

Post Office Protocol (POP)

A protocol used to transfer email messages from an email server to an email client.

preaction system

A combination dry pipe/wet pipe system. The system exists as a dry pipe until the initial stages of a fire (smoke, heat, and so on) are detected and then the pipes are filled with water. The water is released only after the sprinkler head activation triggers are melted by sufficient heat. If the fire is quenched before the sprinklers are triggered,A combination dry pipe/wet pipe system. The system exists as a dry pipe until the initial stages of a fire (smoke, heat, and so on) are detected and then the pipes are filled with water. The water is released only after the sprinkler head activation triggers are melted by sufficient heat. If the fire is quenched before the sprinklers are triggered, the pipes can be manually emptied and reset. This also allows for manual intervention to stop the release of water before sprinkler triggering occurs. Preaction systems are the most appropriate water-based system for environments that include both computers and humans in the same locations.

Presentation layer

Layer 6 of the OSI model.

pretexting

The practice of obtaining personal information under false pretenses. Often related to phishing and other social engineering attacks.

Pretty Good Privacy (PGP)

A public/private key system that uses the IDEA algorithm to encrypt files and email messages. PGP is not a standard but rather an independentlyA public/private key system that uses the IDEA algorithm to encrypt files and email messages. PGP is not a standard but rather an independently developed product that has wide Internet grassroots support. See also GNU Privacy Guard (GnuPG).

preventive access control

An access control deployed to stop an unwanted or unauthorized activity from occurring. Examples of preventive access controls include fences, security policies, security awareness training, and antivirus software.

preventive control

Any security mechanism, tool, or practice that can deter and mitigate undesirable actions or events.

primary key

A specific key from the set of candidate keys that is used as the main differentiator between records. Every record must have a unique value in its primary key field.

primary memory

Storage that normally consists of volatile random access memory (RAM) and is a high-performance storage resource available to a system.

Primary Rate Interface (PRI)

An ISDN service type that provides up to 23 B channels and one D channel. Thus, a full PRI ISDN connection offers 1.544 Mbps throughput, the same as a T1 line.

primary storage

The RAM that a computer uses to keep necessary information readily available.

principle of least privilege

An access control philosophy that states that subjects are granted the minimal access possible for the completion of their work tasks.

privacy

An element of confidentiality aimed at preventing personal or sensitive information about an individual or organization from being disclosed.

Privacy Act of 1974

A law that mandates that government agencies maintain only records that are necessary to conduct their business and destroy those records when they are no longer needed for a legitimate function of government. It provides a formal procedure for individuals to gain access to records the government maintains about them and to request that incorrect records be amended. The Privacy Act also restricts the way the federal government can deal with private information about individual citizens.

Privacy Enhanced Mail (PEM)

An email encryption mechanism that provides authentication, integrity, confidentiality, and nonrepudiation. PEM is a layer 7 protocol. PEM uses RSA, DES, and X.509.

private

A commercial business/private sector classification used for data of a private or personal nature that is intended for internal use only. A significant negative impact could occur for the company or individuals if private data is disclosed.

private branch exchange (PBX)

A sophisticated telephone system often used by organizations to provide inbound call support, extension-to-extension calling, conference calling, and voicemail. This can be implemented as a stand-alone phone system network or integrated with the IT infrastructure.

private cloud

A cloud deployment model that includes cloud-based assets for a single organization. Organizations can create and host private clouds using their own resources. If so, the organization is responsible for all maintenance. However, an organization can also rent resources from a third party and split maintenance requirements based on the service model (SaaS, PaaS, or IaaS).

private IP addresses

The addresses defined in RFC 1918, which are not routed over the Internet.

private key

A secret value that is used to encrypt or decrypt messages and is kept secret and known only to the user; used in conjunction with a public key in asymmetrical cryptography.

privileged entity controls

See privileged operations functions.

privileged mode

The mode designed to give the operating system access to the full range of instructions supported by the CPU. Also known as kernel mode. See also protected mode.

privileged operations functions

Activities that require special access or privilege to perform within a secured IT environment. In most cases, these functions are restricted to administrators and system operators.

privileges

A combination of rights and permissions. Rights refer to actions a user can perform on a system such as changing the system time. Permissions refer to the level of access a user is granted to data such as read, write, modify, and delete.

probability determination

See annualized rate of occurrence.

problem state

The state in which a process is actively executing.

procedure

In the context of security, a detailed step-by-step how-to document describing the actions necessary to implement a specific security mechanism, control, or solution.

process isolation

One of the fundamental security procedures put into place during system design. Basically, using process isolation mechanisms (whether part of the operating system or part of the hardware itself) ensures that each process has its own isolated memory space for storage of data and the actual executing application code itself.

processor

The central processing unit in a PC; it handles all functions on the system.

Program Evaluation Review Technique (PERT)

A project-scheduling tool. It is a method used to judge the size of a software product in development and calculate the standard deviation (SD) for risk assessment. PERT relates the estimated lowest possible size, the most likely size, and the highest possible size of each component. PERT is used to direct improvements to project management and software coding in order to produce more efficient software. As the capabilities of programming and management improve, the actual produced size of software should be smaller.

programmable logic controllers (PLC)

Industrial control system (ICS) units that are effectively single-purpose or focused-purpose digital computers. They are typically deployed for the management and automation of various industrial electromechanical operations, such as controlling systems on an assembly line or a large-scale digital light display.

programmable read-only memory (PROM)

A PROM chip that does not have its contents "burned in" at the factory as is done with standard ROM chips. Instead, special functionality is installed that allows the end user to burn in the contents of the chip.

proprietary

A form of commercial business/private sector confidential information. If proprietary data is disclosed, it can have drastic effects on the competitive edge of an organization.

protected mode

An alternate name for user mode. The less-powerful security domain of the Windows operating environment where user applications reside. User mode is distinct from kernel mode (aka privileged mode). User mode offers restricted resources, indirect and limited access to hardware, and isolation between processes. See also privileged mode.

protection profile

From the common criteria for information technology security evaluation, the evaluation element in which a subject states its security needs.

protection rings

A security design that organizes code and components in an operating system (as well as applications, utilities, or other code that runs under the operating system's control) into concentric rings, each having increasing or decreasing levels of capabilities and access.

protocol

A set of rules and restrictions that define how data is transmitted over a network medium (for example, twisted-pair cable, wireless transmission, and so on). Protocols make computer-to-computer communications possible.

protocol translator

A device or software that can translate between protocols. Typically able to move payloads between IP and IPX. Also known as a gateway.

proximity reader

A passive device, field-powered device, or transponder that detects the presence of authorized personnel and grants them physical entry into a facility. The proximity device is worn or held by the authorized bearer. When they pass a proximity reader, the reader is able to determine who the bearer is and whether they have authorized access.

proxy

A mechanism that copies packets from one network into another. The copy process also changes the source and destination address to protect the identity of the internal or private network.

prudent man rule

Invoked by the Federal Sentencing Guidelines, the rule that requires senior officials to perform their duties with the care that ordinary, prudent people would exercise under similar circumstances.

pseudo-flaws

A technique often used on honeypot systems and on critical resources to emulate well-known operating system vulnerabilities.

public

The lowest level of commercial business/private sector classification. Used for all data that does not fit in one of the higher classifications. This information is not readily disclosed, but if it is, it should not have a serious negative impact on the organization.

public cloud

A cloud deployment model that includes assets available for any consumers to rent or lease and is hosted by an external cloud service provider (CSP). Service-level agreements can be effective at ensuring the CSP provides the cloud-based services at an acceptable level to the organization.

public key

A value that is used to encrypt or decrypt messages and is made public to any user and used with a private key in asymmetric cryptography.

public key cryptosystem / public key cryptography

A subset of asymmetric cryptography based on the use of a key pair set consisting of a public key and a private key. Messages encrypted with one key from the pair can be decrypted only with the other key from the same pair.

public key infrastructure (PKI)

A hierarchy of trust relationships that makes it possible to facilitate communication between parties previously unknown to each other.

purging

The process of erasing media so it can be reused in a less secure environment.