Training & Professional Development

table

The main building block of a relational database; also known as a relation.

TACACS

See Terminal Access Controller Access Control System (TACACS).

tactical plan

A midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan. A tactical plan is typically useful for about a year. It often prescribes and schedules the tasks necessary to accomplish organizational goals.

Take-Grant model

A model that employs a directed graph to dictate how rights can be passed from one subject to another or from a subject to an object. Simply put, a subject with the grant right can grant another subject or another object any other right they possess.A model that employs a directed graph to dictate how rights can be passed from one subject to another or from a subject to an object. Simply put, a subject with the grant right can grant another subject or another object any other right they possess. Likewise, a subject with the take right can take a right from another subject.

task-based

An access control methodology in which access is granted based on work tasks or operations.

TCP model

A network protocol conceptual model that was derived from TCP/IP. Also known as the DARPA model and the DoD model. The TCP model has four layers as opposed to the OSI model's seven. Those four layers from the bottom up are Link, Internet, Host-to-Host, and Process.

TCP wrapper

An application that can serve as a basic firewall by restricting access based on user IDs or system IDs.

teardrop attack

A type of DoS. A teardrop attack occurs when an attacker exploits a bug in an operating system. The bug exists in the routines used to reassemble fragmented packets. An attacker sends numerous specially formatted fragmented packets to the victim, which causes the system to freeze or crash.

technical access control

The hardware or software mechanisms used to manage access to resources and systems and provide protection for those resources and systems.The hardware or software mechanisms used to manage access to resources and systems and provide protection for those resources and systems. Examples of logical or technical access controls include encryption, smart cards, passwords, biometrics, constrained interfaces, access control lists, protocols, firewalls, routers, IDEs, and clipping levels. The same as logical access control.

technical physical security controls

Security controls that use technology to implement some form of physical security, including intrusion-detection systems, alarms, CCTV, monitoring, HVAC, power supplies, and fire detection and suppression.

telephony

The collection of methods by which telephone services are provided to an organization or the mechanisms by which an organization uses telephone services for either voice and/or data communications. Traditionally, telephony included POTS or PSTN services combined with modems. However, this has expanded to include PBX, VoIP, and VPN.

TEMPEST

The study and control of electronic signals produced by various types of electronic hardware, such as computers, televisions, phones, and so on. Its primary goal is to prevent EM and RF radiation from leaving a strictly defined area so as to eliminate the possibility of external radiation monitoring, eavesdropping, and signal sniffing.

Terminal Access Controller Access Control System (TACACS)

An alternative to RADIUS. TACACS is available in three versions: original TACACS, XTACACS (extended TACACS), and TACACS+. TACACS integrates the authentication and authorization processes. XTACACS keeps the authentication, authorization, and accounting processes separate. TACACS+ improves XTACACS by adding two-factor authentication.

terrorist attacks

Attacks that differ from military and intelligence attacks in that the purpose is to disrupt normal life, whereas a military or intelligence attack is designed to extract secret information.

test data method

A form of program testing that examines the extent of the system testing to locate untested program logic.

testimonial evidence

Evidence that consists of the testimony of a witness, either verbal testimony in court or written testimony in a recorded deposition.

thicknet

See 10Base5.

thin client

A term used to describe a workstation that has little or no local processing or storage capacity. A thin client is used to connect to and operate a remote system.

thinnet

See 10Base2.

third-party governance

The system of oversight that may be mandated by law, regulation, industry standards, or licensing requirements.

threat

A potential occurrence that may cause an undesirable or unwanted outcome for an organization or a specific asset.

threat agents

People, programs, hardware, or systems that intentionally exploit vulnerabilities.

threat events

Accidental exploitations of vulnerabilities.

threat modeling

The process of identifying, understanding, and categorizing potential threats. It attempts to identify a potential list of threats to valuable assets, along with an analysis of the threat.

thrill attacks

An attack launched by crackers with few true skills. The main motivation behind thrill attacks is the "high" of getting into a system.

throughput rate

The rate at which a biometric device can scan and authenticate subjects. A rate of about six seconds or faster is required for general acceptance of a specific biometric control.

ticket

An electronic authentication factor used by the Kerberos authentication system.

ticket-granting service (TGS)

An element of the Kerberos authentication system. The TGS manages the assignment and expiration of tickets. Tickets are used by subjects to gain access to objects.

time of check (TOC)

The time at which a subject checks on the status of an object.

time of check to time of use (TOCTTOU or TOC/TOU)

A timing vulnerability that occurs when a program checks access permissions too far in advance of a resource request.

time of use (TOU)

The time at which the decision is made by a subject to access an object.

time slice

A single chunk or division of processing time.

token

See token device.

token device

A password-generating device that subjects must carry with them. Token devices are a form of a "something you have" (Type 2) authentication factor.

token ring

A token-passing LAN technology.

top secret

The highest level of government/military classification. Unauthorized disclosure of top-secret data will cause exceptionally grave damage to national security.

topology

The physical layout of network devices and connective cabling. The common network topologies are ring, bus, star, and mesh.

total risk

The amount of risk an organization would face if no safeguards were implemented. Threats x vulnerabilities x asset value = total risk.

trade secret

Intellectual property that is absolutely critical to a business and would cause significant damage if it were disclosed to competitors and/or the public.

trademark

A registered word, slogan, or logo used to identify a company and its products or services.

traffic analysis

A form of monitoring in which the flow of packets rather than the actual content of packets is examined. Also referred to as trend analysis.

training

The task of teaching employees to perform their work tasks and to comply with the security policy. All new employees require some level of training so they will be able to properly comply with all standards, guidelines, and procedures mandated by the security policy.

transferring risk

Placing the cost of loss from a realized risk onto another entity or organization, such as purchasing insurance. Also referred to as assigning risk.

transparency

The characteristic of a service, security control, or access mechanism that ensures that it is unseen by users. Transparency is often a desirable feature for security controls. The more transparent a security mechanism is, the less likely a user will be able to circumvent it or even be aware that it exists.A characteristic of a service, security control, or access mechanism that is unseen by users. Transparency is often a desirable feature for security controls.

transient

A short duration of line noise disturbance.

transitive trust

The concept that if A trusts B and B trusts C, then A inherits trust of C through the transitive property, which works like it would in a mathematical equation: if A = B, and B = C, then A = C. Transitive trust is a serious security concern because it may enable bypassing of restrictions or limitations between A and C, especially if A and C both support interaction with B.

Transmission Control Protocol (TCP)

A connection-oriented protocol located at layer 4 of the OSI model.

transmission error correction

A capability built into connection- or session-oriented protocols and services. If it is determined that a message, in whole or in part, was corrupted, altered, or lost, a request can be made for the source to resend all or part of the message.

transmission logging

A form of auditing focused on communications. Transmission logging records the details about source, destination, time stamps, identification codes, transmission status, number of packets, size of message, and so on.

transmission window

The number of packets transmitted before an acknowledge packet is sent.

Transport layer

Layer 4 of the OSI model.

Transport Layer Security (TLS)

Based on SSL technology, TLS incorporated many security enhancements and was eventually adopted as a replacement for SSL in most applications. Early versions of TLS supported downgrading communications to SSL v3.0 when both parties did not support TLS. However, in 2011 TLS v1.2 dropped this backward compatibility. As with SSL, TLS uses TCP port 443.

transport mode

A mode of IPSec when used in a VPN. In transport mode, the IP packet data is encrypted but the header of the packet is not.

transposition cipher

Cipher that uses an encryption algorithm to rearrange the letters of a plain-text message to form the cipher-text message.

trap door

Undocumented command sequence that allows software developers to bypass normal access restrictions.

traverse mode noise

EMI noise generated by the difference in power between the hot and neutral wires of a power source or operating electrical equipment.

trend analysis

See traffic analysis.

Triple DES (3DES)

A standard that uses three iterations of DES with two or three different keys to increase the effective key strength to 112 bits.

Trojan horse

A malicious code object that appears to be a benevolent program, such as a game or simple utility that performs the "cover" functions as advertised but also carries an unknown payload, such as a virus.

trust

A security bridge established to share resources from one domain to another. A trust is established between two domains to allow users from one domain to access resources in another. Trusts can be one-way only, or they can be two-way.

trusted computing base (TCB)

The combination of hardware, software, and controls that form a trusted base that enforces your security policy.

trusted path

Secure channel used by the TCB to communicate with the rest of the system.

Trusted Platform Module (TPM)

A cryptoprocessor chip on a mainboard used to store and process cryptographic keys for the purposes of a hardware supported/implemented hard drive encryption system.

trusted recovery process

On a secured system, a process that ensures the system always returns to a secure state after an error, failure, or reboot.

trusted system

A secured computer system.

tunnel mode

A mode of IPSec when used in a VPN. In tunnel mode, the entire IP packet is encrypted and a new header is added to the packet to govern transmission through the tunnel.

tunneling

A network communications process that protects the contents of protocol packets by encapsulating them in packets of another protocol.

tuple

A record or row in a database.

turnstile

A form of gate that prevents more than one person at a time from gaining entry and often restricts movement in one direction.

twisted-pair

See 10Base-T.

two-factor authentication

Authentication that requires two factors.

Type 1 authentication factor

Something you know, such as a password, personal identification number (PIN), combination lock, passphrase, mother's maiden name, or favorite color.

Type 2 authentication factor

Something you have, such as a smart card, ATM card, token device, or memory card.

Type 3 authentication factor

Something you are, such as fingerprints, voice print, retina pattern, iris pattern, face shape, palm topology, or hand geometry.

Type 1 error

See false rejection rate (FRR).

Type 2 error

See false acceptance rate (FAR).