{"language":"en_GB","topic":{"id":"p66712i04","strTitle":"Topic glossary","strContent":{"objNavigationConfiguration":[]},"screens":[{"id":"p66712i04s01","strTitle":"Acceptable Use Policy (AUP)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s01a01","layoutId":"p66712i04s01lay01","strContent":"Definition of what a user can and cannot do when using IT resources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s02","strTitle":"Access Control List (ACL)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s02a01","layoutId":"p66712i04s02lay01","strContent":"Defines the kinds of access granted or denied to users of an object.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s03","strTitle":"Access controls","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s03a01","layoutId":"p66712i04s03lay01","strContent":"Mechanisms and policies that restrict or permit access to IT resources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s04","strTitle":"Advance Fee (419) Fraud","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s04a01","layoutId":"p66712i04s04lay01","strContent":"A fraudulent attempt to gain user's information; User's receive a request (usually by email) asking for their help in 'freeing' up a large sum of money, but the catch is that they must provide some personal information first (normally bank account details) to facilitate this. If you receive any of these please don't reply - report them (to the IT Service Desk) and delete them immediately.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s05","strTitle":"Advanced Encryption Standard (AES)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s05a01","layoutId":"p66712i04s05lay01","strContent":"The American National Institute of Standards & Technology (NIST) chose the Rijndael cipher block algorithm to be the AES in 2001, and since that time it has become the 'de facto' standard for encrypting data around the world.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s06","strTitle":"Advanced Persistent Threat (APT)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s06a01","layoutId":"p66712i04s06lay01","strContent":"Term given to a mixture of spear phishing and social engineering to launch a complex targeted attack with a specific end objective.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s07","strTitle":"Adware","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s07a01","layoutId":"p66712i04s07lay01","strContent":"Collective term used for a software package that automatically plays, displays or downloads advertisements to a computer, either after the software has been installed on it or while the application is being used. Where adware also tracks the user's patterns of behaviour (computer usage) then it is termed as spyware.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s08","strTitle":"Algorithms","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s08a01","layoutId":"p66712i04s08lay01","strContent":"A clearly-defined mathematical formula used to solve a problem or run an operation.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s09","strTitle":"Anti-Virus (AV)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s09a01","layoutId":"p66712i04s09lay01","strContent":"Software that protects against the illegal (and in most cases unknown) running of malicious code on a user's PC. Main protection techniques used are:\n[list]\n[*]Signature-Based - Traditional form of AV that uses lists of 'known' virus signatures (executable code samples) to actively block any code from running on a user's PC\n[*]Heuristics - Newer form of AV that uses pattern matching to "second guess" that code is malicious and unwanted\n[\/list]\n","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s10","strTitle":"Anti-Spyware","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s10a01","layoutId":"p66712i04s10lay01","strContent":"Software that protects against spyware.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s11","strTitle":"Astroturfing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s11a01","layoutId":"p66712i04s11lay01","strContent":"Generating and publishing positive, anonymous reviews to inflate your brand\/company on the Internet.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s12","strTitle":"Asymmetric Encryption (or Public Key Cryptography)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s12a01","layoutId":"p66712i04s12lay01","strContent":"A key pair (public and private) is used to encrypt (make it unreadable) and decrypt electronic data (make it readable again to the holder of the corresponding key); these keys are mathematically related but the private key cannot be derived from the public one.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s13","strTitle":"Authentication","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s13a01","layoutId":"p66712i04s13lay01","strContent":"Process of determining whether someone or something is, in fact, who or what it is declared to be.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s14","strTitle":"Backdoor","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s14a01","layoutId":"p66712i04s14lay01","strContent":"Can be intentional or unintentional but allows access to information or IT system without going through the proper access control procedure.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s15","strTitle":"Biometrics","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s15a01","layoutId":"p66712i04s15lay01","strContent":"Science of human identifiers (such as fingerprints, speech recognition, iris scanning, etc.) that may be used to authenticate users to IT systems.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s16","strTitle":"Black Box Testing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s16a01","layoutId":"p66712i04s16lay01","strContent":"Running a penetration test against a system\/application with no prior knowledge.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s17","strTitle":"Blacklist","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s17a01","layoutId":"p66712i04s17lay01","strContent":"Basic access control mechanism that allows everyone access, except for the members of the black list (i.e. list of denied accesses); The opposite is a Whitelist.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s18","strTitle":"Bluejacking","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s18a01","layoutId":"p66712i04s18lay01","strContent":"Sending of unsolicited messages over Bluetooth.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s19","strTitle":"Bluesnarfing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s19a01","layoutId":"p66712i04s19lay01","strContent":"Unauthorised access (hacking) of information from a wireless device through a Bluetooth connection.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s20","strTitle":"Bot","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s20a01","layoutId":"p66712i04s20lay01","strContent":"Software applications that run automated tasks over the Internet.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s21","strTitle":"Bot Controller","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s21a01","layoutId":"p66712i04s21lay01","strContent":"Master server that controls the bots and sends commands.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s22","strTitle":"Bot Network (or Botnet)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s22a01","layoutId":"p66712i04s22lay01","strContent":"Collection of bots that run autonomously and automatically.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s23","strTitle":"Bug","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s23a01","layoutId":"p66712i04s23lay01","strContent":"Flaw, error, failure or fault in an IT system or program that produces an incorrect or unexpected result.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s24","strTitle":"Business Continuity","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s24a01","layoutId":"p66712i04s24lay01","strContent":"What can be undertaken to preserve\/provide IT services in the short-term after a major incident.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s25","strTitle":"Business Internal Information","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s25a01","layoutId":"p66712i04s25lay01","strContent":""Data used for day to day business and academic operations by staff, students and University stakeholders not included in confidential \/ business-restricted category."","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s26","strTitle":"BYOD (Bring Your Own Device)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s26a01","layoutId":"p66712i04s26lay01","strContent":"See 'Consumerisation'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s27","strTitle":"CAPS (CESG Assisted Products Scheme)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s27a01","layoutId":"p66712i04s27lay01","strContent":"UK Government's assurance model for the evaluation of cryptographic products to ensure they meet rigorous standards.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s28","strTitle":"CAPTCHA","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s28a01","layoutId":"p66712i04s28lay01","strContent":"Designed to differentiate automatic programs (bots) and human interaction with websites.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s29","strTitle":"CESG","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s29a01","layoutId":"p66712i04s29lay01","strContent":"UK Government's Technical Assurance Agency based in Cheltenham.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s30","strTitle":"Clear Desk","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s30a01","layoutId":"p66712i04s30lay01","strContent":"Recognised 'best practice' where no personal or confidential information is left lying on a person's desk where it can be seen by unauthorised persons.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s31","strTitle":"Clear Screen","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s31a01","layoutId":"p66712i04s31lay01","strContent":"Recognised 'best practice' where monitor screens are locked when an account holder is not present (using CTRL+ALT+DEL on a Windows machine).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s32","strTitle":"Clone","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s32a01","layoutId":"p66712i04s32lay01","strContent":"A replica of the original, in this context it refers to credit card cloning where the card has been copied illegally to purchase goods without the owner's consent.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s33","strTitle":"Cloud Computing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s33a01","layoutId":"p66712i04s33lay01","strContent":"Provision of an internet-based, on-demand, normally chargeable service that is dynamic and shared across the host's infrastructure. ","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s34","strTitle":"Code Breaking","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s34a01","layoutId":"p66712i04s34lay01","strContent":"Ability to decipher coded (unreadable) messages so that they can be read and understood.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s35","strTitle":"Code (SQL) Injection","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s35a01","layoutId":"p66712i04s35lay01","strContent":"Exploitation of a computer bug that is caused by processing invalid data.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s36","strTitle":"Cold Site","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s36a01","layoutId":"p66712i04s36lay01","strContent":"Term used in 'Disaster Recovery' to show that the recovery will need to be started up from scratch.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s37","strTitle":"Computer Misuse Act (CMA)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s37a01","layoutId":"p66712i04s37lay01","strContent":"UK legislation that makes it illegal to access or modify data in an unauthorised manner (i.e. Hacking).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s38","strTitle":"Confidentiality","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s38a01","layoutId":"p66712i04s38lay01","strContent":"One of the cornerstones of information security meaning that data must only be accessed by those authorised to see it.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s39","strTitle":"Confidential Information","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s39a01","layoutId":"p66712i04s39lay01","strContent":""Information relating to specific business and academic operations\/groups that needs to be protected from general CU stakeholder access i.e. Data that if lost, stolen or compromised would have a significant adverse impact on the University."","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s40","strTitle":"Cookies","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s40a01","layoutId":"p66712i04s40lay01","strContent":"A cookie is a small file, typically of letters and numbers, downloaded on to a device when the user accesses certain website. Cookies allow a website to recognize a user's device and their use is covered by Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s41","strTitle":"Consumerisation","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s41a01","layoutId":"p66712i04s41lay01","strContent":"Generic term given to the blurring of personal and business provided equipment and the fact that people want to connect to IT systems from anywhere with any device.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s42","strTitle":"Copyright Infringement Notice","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s42a01","layoutId":"p66712i04s42lay01","strContent":"Channel used by copyright holders to inform suspected offenders of breaches to copyright (usually for downloading media i.e. movies, music and\/or software).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s43","strTitle":"Cracking","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s43a01","layoutId":"p66712i04s43lay01","strContent":"Same as 'Code Breaking'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s44","strTitle":"Cybersecurity","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s44a01","layoutId":"p66712i04s44lay01","strContent":"Recent rebadging of Information Security (which itself was previously termed Data Security, etc.) which is used as a reference point for any action or activity that can cause harm through the use of IT e.g. Cyber Warfare, Cyber Terrorism, etc.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s45","strTitle":"Crypto-Custodian","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s45a01","layoutId":"p66712i04s45lay01","strContent":"Role assigned to a person(s) responsible for the management and distribution of cryptographic key material.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s46","strTitle":"Cryptography","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s46a01","layoutId":"p66712i04s46lay01","strContent":"Science of 'hiding' information by making it unreadable to unauthorised viewers; Also see 'Encryption'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s47","strTitle":"Data Classification","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s47a01","layoutId":"p66712i04s47lay01","strContent":"Means to place a 'value' on information so that appropriate protection tools can be implemented.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s48","strTitle":"Data Loss Prevention (DLP)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s48a01","layoutId":"p66712i04s48lay01","strContent":"Tools and techniques to tag and track data so that it cannot be used\/viewed by unauthorised objects (users, processes, etc.).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s49","strTitle":"Data Protection Act (DPA)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s49a01","layoutId":"p66712i04s49lay01","strContent":"UK legislation that outlines how personal data must be handled through complying with 8 principles:\n([actionset=p66712i04s49a01.0]http:\/\/ico.org.uk\/for_organisations\/data_protection\/the_guide[\/actionset])","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s50","strTitle":"Denial of Service (DoS)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s50a01","layoutId":"p66712i04s50lay01","strContent":"Deliberately or accidentally preventing access to a service, process, data source, etc. from a single or limited number of sources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s51","strTitle":"Digital Forensics (AKA Computer Forensics)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s51a01","layoutId":"p66712i04s51lay01","strContent":"Scientifically-based techniques to ensure that legal evidence of misuse (alleged or actual) is true and accurate.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s52","strTitle":"Digital Signature","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s52a01","layoutId":"p66712i04s52lay01","strContent":"Mathematical means for proving the authenticity of a digital message or document; See encryption and non-repudiation.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s53","strTitle":"Disaster Recovery","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s53a01","layoutId":"p66712i04s53lay01","strContent":"Plans and procedures to be implemented in the event of a disaster which in the University would equate to a major fire, flood, explosion, etc.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s54","strTitle":"Distributed Denial of Service (DDoS)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s54a01","layoutId":"p66712i04s54lay01","strContent":"Deliberately (given that there is usually a malicious intent behind such attacks it is highly unlikely to be accidental) preventing access to a service, process, data source, etc. from multiple sources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s55","strTitle":"Domain Name System (DNS) Poisoning","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s55a01","layoutId":"p66712i04s55lay01","strContent":"DNS is used to translate human readable information (i.e. cranfield.ac.uk) into IP addresses (i.e. 138.250.0.0) which are used when communicating with 'networked' equipment. If this information becomes poisoned, then the routing of communications (packets of data) can be disrupted or diverted.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s56","strTitle":"Drive-By Download","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s56a01","layoutId":"p66712i04s56lay01","strContent":"This is when a program is automatically downloaded to a computer without the user's consent or knowledge, and it can be initiated by visiting a website or viewing an HTML email message.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s57","strTitle":"Dumpster Diving","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s57a01","layoutId":"p66712i04s57lay01","strContent":"This is when a person will go through somebody else's rubbish to obtain personal or other useful information to mount an attack or impersonate the victim.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s58","strTitle":"Eavesdropping (See Sniffing)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s58a01","layoutId":"p66712i04s58lay01","strContent":"To overhear or intercept private communications between parties.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s59","strTitle":"Emanations","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s59a01","layoutId":"p66712i04s59lay01","strContent":"This refers to transmissions (electrical, mechanical or acoustical) from a source which can then be intercepted and analysed to disclose the information being processed on IT equipment. The UK Government recommends the use of Tempest techniques to screen\/secure highly confidential (Top Secret) information.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s60","strTitle":"Encryption (See Cryptography)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s60a01","layoutId":"p66712i04s60lay01","strContent":"Ability to make data unreadable, thus preventing unauthorised access\/viewing.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s61","strTitle":"EndPoint Security","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s61a01","layoutId":"p66712i04s61lay01","strContent":"Assurance of the secure configuration and status (e.g. up-to-date anti-virus protection) of a device that connects to a network.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s62","strTitle":"eXtensible Threat Management (XTM)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s62a01","layoutId":"p66712i04s62lay01","strContent":"Next generation of integrated network security appliances (see 'Unified Threat Management'), which provide a suite of security products in a single box.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s63","strTitle":"Federal Information Processing Standard (FIPS) 140-2","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s63a01","layoutId":"p66712i04s63lay01","strContent":"USA standard for accrediting cryptographic modules; a number of encryption products bear this certificate to prove that they have been through a rigorous accreditation process.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s64","strTitle":"Firewall","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s64a01","layoutId":"p66712i04s64lay01","strContent":"Device for controlling the flow of network traffic, that is usually used to prevent external attackers accessing internal organizational networks.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s65","strTitle":"Government Security Classification (GSC) Scheme","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s65a01","layoutId":"p66712i04s65lay01","strContent":"The UK Government's information classification scheme that came into force in April 2014: [actionset=p66712i04s65a01.0]https:\/\/www.gov.uk\/government\/publications\/government-security-classifications[\/actionset] ","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s66","strTitle":"Hacker","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s66a01","layoutId":"p66712i04s66lay01","strContent":"​A person who seeks out vulnerabilities in a IT system, process, application or service in order to exploit it in some way e.g. to compromise information\/ resources for personal gain or kudos. Dependent on their motivation can be non-malicious (White Hats) or malicious and destructive (Black Hats) (i.e. not all hackers are malicious some are labelled 'security researchers' and highlight vulnerabilities before they can be exploited by otherwise motivated individuals).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s67","strTitle":"Hacktivist","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s67a01","layoutId":"p66712i04s67lay01","strContent":"Loose alliance of hackers to undertake some political, economic, social or technological attack(s) or actions to demonstrate or make a point.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s68","strTitle":"Hashes","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s68a01","layoutId":"p66712i04s68lay01","strContent":"Used in computing to verify the contents and integrity of data (AKA Checksums) whereby a mathematical formula condenses a block of data to a bit string. The original block of data can then be checked for tampering by repeating the process, and if a different hash value is returned then the block of data has been changed.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s69","strTitle":"Flooding","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s69a01","layoutId":"p66712i04s69lay01","strContent":"Swamping a service with requests (either accidentally or maliciously) which causes the service to fail.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s70","strTitle":"Freedom of Information Act (FoI)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s70a01","layoutId":"p66712i04s70lay01","strContent":"UK legislation that provides a public "right to know" for public bodies, which is overseen by the Information Commissioner's Office: [actionset=p66712i04s70a01.0]http:\/\/www.ico.gov.uk\/what_we_cover\/freedom_of_information.aspx[\/actionset]","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s71","strTitle":"Hacking","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s71a01","layoutId":"p66712i04s71lay01","strContent":"Actions taken by a hacker to compromise information\/resources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s72","strTitle":"Honeypot","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s72a01","layoutId":"p66712i04s72lay01","strContent":"A trap set to detect, deflect, or in some manner counteract attempts made to access to IT systems through unauthorised means.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s73","strTitle":"Hot Site","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s73a01","layoutId":"p66712i04s73lay01","strContent":"Used in 'Disaster Recovery'\/'Business Continuity Planning' to describe an alternative site, which can be used immediately if a DR\/BCP event occurs.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s74","strTitle":"HTML (Hypertext Markup Language)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s74a01","layoutId":"p66712i04s74lay01","strContent":"Used for creating structured web pages.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s75","strTitle":"Identity Theft","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s75a01","layoutId":"p66712i04s75lay01","strContent":"Much touted phrase used in the media to describe where IT users have had some (or all) of their personal details compromised i.e. bank account details.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s76","strTitle":"Impact","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s76a01","layoutId":"p66712i04s76lay01","strContent":"In an information security context this refers to the effect that a given range of conditions (i.e. risks or vulnerabilities) may have on the organization, IT systems, users and\/or data.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s77","strTitle":"Information Classification","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s77a01","layoutId":"p66712i04s77lay01","strContent":"Process where information is assessed and given a standard marking on it's value. The three classes of categorisation used within the University are 'Public', 'Business Internal' and 'Confidential'. Alternatively, the information could have been provided to the University with a pre-determined classification e.g. Commercial Confidential which obligates certain handling conditions.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s78","strTitle":"Information Classification Matrix","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s78a01","layoutId":"p66712i04s78lay01","strContent":"Table providing definitions and examples of University classified information.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s79","strTitle":"Information Security","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s79a01","layoutId":"p66712i04s79lay01","strContent":"Generic term for the protection of information\/data, this historically has centred on the confidentiality, integrity and availability of the information\/data.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s80","strTitle":"InfoSec","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s80a01","layoutId":"p66712i04s80lay01","strContent":"Shortened term for 'Information Security'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s81","strTitle":"Integrity","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s81a01","layoutId":"p66712i04s81lay01","strContent":"In the information security context integrity refers to the safeguarding of the accuracy and completeness of the information\/data.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s82","strTitle":"Interception","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s82a01","layoutId":"p66712i04s82lay01","strContent":"This is where information\/data is accessed or deflected from its 'true' path during transmission or when static, and can be physical or logical and may be lawful (Regulation of Investigatory Powers Act) or based on more sinister notions (i.e. criminally motivated, competitor advantage, espionage, etc.). Note: This can be accidental as well as intentional.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s83","strTitle":"Intrusion Detection Systems (IDS)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s83a01","layoutId":"p66712i04s83lay01","strContent":"A means to identify unusual patterns of behaviour on IT systems that may be malicious or against set policies.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s84","strTitle":"Intrusion Prevention Systems (IPS)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s84a01","layoutId":"p66712i04s84lay01","strContent":"A means to identify unusual patterns of behaviour on IT systems that may be malicious or against set policies and stop it from occurring. This is a more aggressive form of network monitoring and can result in false positives i.e. mistakenly blocking legitimate actions.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s85","strTitle":"ITSO (Information Technology Security Officer)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s85a01","layoutId":"p66712i04s85lay01","strContent":"UK Government term for a central role that deals primarily with information security.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s86","strTitle":"Janet","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s86a01","layoutId":"p66712i04s86lay01","strContent":"High speed network for the UK research and education community.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s87","strTitle":"Joe Job","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s87a01","layoutId":"p66712i04s87lay01","strContent":"Spam campaign that contains links to a particular site with the intention to cause a 'denial of service' attack; there is an expectation that recipients of the spam will click on the links and flood the site with requests, thus overstretching computer resources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s88","strTitle":"Key-logging","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s88a01","layoutId":"p66712i04s88lay01","strContent":"This refers to the technique of capturing users input into IT systems and is normally achieved by running a malicious, hidden program (normally installed\/downloaded by a Trojan) unknowingly in the background which record keystrokes.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s89","strTitle":"Key Management","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s89a01","layoutId":"p66712i04s89lay01","strContent":"This is an important element of the cryptographic\/encryption process and describes how encryption keys (asymmetric or symmetric) are used and their supporting processes.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s90","strTitle":"Key Strength","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s90a01","layoutId":"p66712i04s90lay01","strContent":"This refers to the length of characters that the cryptographic\/encryption key uses to secure the information\/data. This will often be shown as multiples of 256 bits i.e. 512, 1024, etc.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s91","strTitle":"Locked-Down","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s91a01","layoutId":"p66712i04s91lay01","strContent":"Where a PC or IT system is described as being 'locked down' it has been securely configured to ensure that only known, trusted services run with the least user privilege.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s92","strTitle":"Logs","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s92a01","layoutId":"p66712i04s92lay01","strContent":"A record of events that have taken place on an IT system, which can be used for example to determine the past actions\/responses that took place prior to a system becoming corrupted or failing.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s93","strTitle":"Malware","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s93a01","layoutId":"p66712i04s93lay01","strContent":"Generic term given to malicious software (hence mal~ware) that encompasses viruses, Trojans, worms, etc.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s94","strTitle":"Man-In-The-Middle","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s94a01","layoutId":"p66712i04s94lay01","strContent":"This type of attack either impersonates a 'trusted' element in the traffic flow from point A to point B, or surreptitiously includes an unseen element with the aim to capture\/intercept\/alter\/eavesdrop\/etc. the traffic contents.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s95","strTitle":"Masquerade","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s95a01","layoutId":"p66712i04s95lay01","strContent":"This is a form of impersonation where something (could be an IT system, user, service, etc.) pretends to be something else in order to deceive IT systems\/users.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s96","strTitle":"Mobile Application Management (MAM)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s96a01","layoutId":"p66712i04s96lay01","strContent":"Technology that provides the ability to manage applications on mobile devices.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s97","strTitle":"Mobile Device Management (MDM)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s97a01","layoutId":"p66712i04s97lay01","strContent":"Technology that provides the ability to manage mobile devices that access organisations IT systems.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s98","strTitle":"Mule","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s98a01","layoutId":"p66712i04s98lay01","strContent":"In information security this refers to a PC which has become compromised by a bot controller and is now used (normally unwittingly by the legitimate user) to distribute spam\/malware.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s99","strTitle":"Network","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s99a01","layoutId":"p66712i04s99lay01","strContent":"Infrastructure that links IT systems\/resources; Can be wired or wireless.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s100","strTitle":"Non-repudiation","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s100a01","layoutId":"p66712i04s100lay01","strContent":"Term used to tie an IT system\/user to an action that cannot be disowned.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s101","strTitle":"Passwords","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s101a01","layoutId":"p66712i04s101lay01","strContent":"Fundamental cornerstone of access control, as it is the most widely accepted means of authenticating user ID's to IT systems\/resources.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s102","strTitle":"Password Caching","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s102a01","layoutId":"p66712i04s102lay01","strContent":"The storage (or saving) of passwords so that they do not need to be entered every time access to a system is required.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s103","strTitle":"Patching","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s103a01","layoutId":"p66712i04s103lay01","strContent":"Term used to describe how IT systems are maintained and kept up-to-date.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s104","strTitle":"Penetration Testing (AKA Ethical Hacking)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s104a01","layoutId":"p66712i04s104lay01","strContent":"Used as a means of providing assurance that an IT system\/application does not have any vulnerabilities that could cause serious harm to the University.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s105","strTitle":"Perimeter","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s105a01","layoutId":"p66712i04s105lay01","strContent":"This describes the external boundary of an IT system, and would normally be protected by Firewalls.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s106","strTitle":"Pharming","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s106a01","layoutId":"p66712i04s106lay01","strContent":"Redirection of a website to another illegitimate 'bogus' one, with the intention to steal user details i.e. passwords, bank account information, etc.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s107","strTitle":"Phishing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s107a01","layoutId":"p66712i04s107lay01","strContent":"Where an attacker tries to lure users (hence the play on 'fishing') into divulging sensitive information (either personal or business).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s108","strTitle":"Privilege escalation","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s108a01","layoutId":"p66712i04s108lay01","strContent":"Where a user\/process is allowed to elevate their level of access i.e. ordinary user to system administrator.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s109","strTitle":"Protectively Marked Material (PMM)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s109a01","layoutId":"p66712i04s109lay01","strContent":"Previous term used to classify UK Government information; Replaced by Government Security Classification (GSC) in April 2014.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s110","strTitle":"Public Information","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s110a01","layoutId":"p66712i04s110lay01","strContent":""Data intended for public use."","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s111","strTitle":"Recovery Point Objective (RPO)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s111a01","layoutId":"p66712i04s111lay01","strContent":"Term used in business continuity to describe when operational data needs to be available following a major disruption.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s112","strTitle":"Recovery Time Objective (RTO)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s112a01","layoutId":"p66712i04s112lay01","strContent":"Term used in business continuity to describe when operational systems should be available following a major disruption.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s113","strTitle":"Regulations of Investigatory Powers Act (RIPA)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s113a01","layoutId":"p66712i04s113lay01","strContent":"UK Legislation that provides a regulatory framework for the use of covert techniques by public authorities. This legislation was raised in 2000 to ensure that the UK adhered to the Human Rights Act (2000) and individual's right to privacy.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s114","strTitle":"Replay Attacks","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s114a01","layoutId":"p66712i04s114lay01","strContent":"This is used to resend or delay intercepted messages, and can form part of a masquerade attack where user credentials (i.e. passwords) are obtained illegally and then reused to impersonate the legitimate user.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s115","strTitle":"Resilience","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s115a01","layoutId":"p66712i04s115lay01","strContent":"Term used in business continuity to describe how quickly an organisation can achieve its recovery time and recovery point objectives i.e. the higher the resilience the less time it will take.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s116","strTitle":"Risk Assessment","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s116a01","layoutId":"p66712i04s116lay01","strContent":"A means to establish the likelihood and impact of a given threat.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s117","strTitle":"Risk Score","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s117a01","layoutId":"p66712i04s117lay01","strContent":"Calculated value of a threat or range of threats that can then be used to prioritise remedial activities.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s118","strTitle":"Rogue Access Points","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s118a01","layoutId":"p66712i04s118lay01","strContent":"Unauthorised wireless access point that can be used to capture legitimate traffic or provide a service for illegitimate traffic.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s119","strTitle":"Rootkit","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s119a01","layoutId":"p66712i04s119lay01","strContent":"Malware (normally) that attempts to avoid detection by working at the greatest privilege level (root) of a service, operating system or program.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s120","strTitle":"Router","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s120a01","layoutId":"p66712i04s120lay01","strContent":"Device used in a network to forward (i.e. route) data outside the local area network (LAN).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s121","strTitle":"Sandboxing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s121a01","layoutId":"p66712i04s121lay01","strContent":"Ability to ring fence personal and business data running on the same device.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s122","strTitle":"Scam","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s122a01","layoutId":"p66712i04s122lay01","strContent":"Any means that attempts to defraud, mislead or gain an individual's confidence\/personal information for financial or other gain.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s123","strTitle":"Scareware","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s123a01","layoutId":"p66712i04s123lay01","strContent":"Software that masquerades as a legitimate service and tries to frighten 'i.e. scare' the user into either running the software (fake anti-virus\/spyware) or paying for a service that they don't need.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s124","strTitle":"Secure Socket Layer (SSL)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s124a01","layoutId":"p66712i04s124lay01","strContent":"The main way that computers securely connect to web services; used extensively for on-line banking, shopping, etc. on the Internet (shown by a padlock somewhere on the page i.e. address bar).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s125","strTitle":"Secure Shell (SSH)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s125a01","layoutId":"p66712i04s125lay01","strContent":"Network protocol (set of rules) for secure communications between two networked computers.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s126","strTitle":"Security Information & Event Management (SIEM)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s126a01","layoutId":"p66712i04s126lay01","strContent":"SIEM technology provides real-time analysis of security alerts generated by IT systems and applications.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s127","strTitle":"Server","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s127a01","layoutId":"p66712i04s127lay01","strContent":"Combination of computer hardware and software that provides services to users.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s128","strTitle":"Senior Information Risk Officer (SIRO)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s128a01","layoutId":"p66712i04s128lay01","strContent":"Executive Board member with overall responsibility for risk assessment and management.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s129","strTitle":"Shibboleth","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s129a01","layoutId":"p66712i04s129lay01","strContent":"A 'standards-based' federated identity solution.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s130","strTitle":"Short Message Service (SMS)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s130a01","layoutId":"p66712i04s130lay01","strContent":"Texting by mobile phones or similar devices.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s131","strTitle":"SMiShing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s131a01","layoutId":"p66712i04s131lay01","strContent":"Phishing by text message to obtain personal information.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s132","strTitle":"Sniffing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s132a01","layoutId":"p66712i04s132lay01","strContent":"Refers to listening or intercepting network traffic to obtain the information\/data using the network.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s133","strTitle":"Spam","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s133a01","layoutId":"p66712i04s133lay01","strContent":"Unsolicited emails that attempt to direct users to websites containing malware, divulge personal details or download unauthorized\/malicious software.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s134","strTitle":"Spear Phishing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s134a01","layoutId":"p66712i04s134lay01","strContent":"Targeted form of phishing that has some prior knowledge of the intended victim to make the attack more convincing i.e. attacker may know the recipient's name, on-line bank, etc.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s135","strTitle":"Social Engineering","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s135a01","layoutId":"p66712i04s135lay01","strContent":"Generic term given to the act of manipulating people into performing actions or divulging personal information (bank account details) that is used for financial or other gain.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s136","strTitle":"Spoofing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s136a01","layoutId":"p66712i04s136lay01","strContent":"Where a person or service successfully masquerades as another in order to obtain increased privileges or access to information or information systems.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s137","strTitle":"Spyware","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s137a01","layoutId":"p66712i04s137lay01","strContent":"Generic term given to software that secretly (i.e. without the user's knowledge) collects information on how a user interacts with IT systems e.g. key loggers capture passwords and personal information.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s138","strTitle":"Switch","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s138a01","layoutId":"p66712i04s138lay01","strContent":"Device used in an IT network to connect network segments together.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s139","strTitle":"Symmetric Encryption","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s139a01","layoutId":"p66712i04s139lay01","strContent":"Form of encryption that uses an identical 'secret' key pair to protect information end-to-end.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s140","strTitle":"Tempest","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s140a01","layoutId":"p66712i04s140lay01","strContent":"The study of radiation from electrical\/electronic equipment to provide the emanations of the user input into the equipment: [actionset=p66712i04s140a01.0]https:\/\/www.cesg.gov.uk\/servicecatalogue\/TEMPEST\/Pages\/What-is-TEMPEST.aspx[\/actionset]","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s141","strTitle":"Threat","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s141a01","layoutId":"p66712i04s141lay01","strContent":"In this context it means an action that has a negative consequence on information or information systems.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s142","strTitle":"Timestamp","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s142a01","layoutId":"p66712i04s142lay01","strContent":"The time at which an event was recorded by a computer used in logging events.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s143","strTitle":"Transport Layer Security (TLS)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s143a01","layoutId":"p66712i04s143lay01","strContent":"See 'Secure Sockets Layer' which was the predecessor to TLS.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s144","strTitle":"Trojans","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s144a01","layoutId":"p66712i04s144lay01","strContent":"Software programs that pretend to provide 'desirable' operations but actually hide malicious code within themselves which then compromises the computer or information system. Trojan programs provide attackers with a means to remotely control the device and are used extensively to build bot networks.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s145","strTitle":"Two-Factor Authentication (2FA)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s145a01","layoutId":"p66712i04s145lay01","strContent":"Means of providing a more secure form of authentication to an IT system, by adding a further dimension to "something you know" (password) with either "something you have" (token) or "something you are" (biometric e.g. fingerprint, iris scan, etc.).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s146","strTitle":"Unified Threat Management (UTM)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s146a01","layoutId":"p66712i04s146lay01","strContent":"Generic term for a number of security features residing on a single networked device (typically a Firewall).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s147","strTitle":"Validation","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s147a01","layoutId":"p66712i04s147lay01","strContent":"See 'Authentication'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s148","strTitle":"Verification","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s148a01","layoutId":"p66712i04s148lay01","strContent":"See 'Authentication'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s149","strTitle":"Vishing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s149a01","layoutId":"p66712i04s149lay01","strContent":"Phishing by phone or voicemail.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s150","strTitle":"Virtualization","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s150a01","layoutId":"p66712i04s150lay01","strContent":"Refers to running software on virtual hardware, where a number of applications and operating systems can run on a single physical server.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s151","strTitle":"Virtual Private Network (VPN)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s151a01","layoutId":"p66712i04s151lay01","strContent":"A 'dedicated' channel for connecting two IT systems securely.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s152","strTitle":"Viruses","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s152a01","layoutId":"p66712i04s152lay01","strContent":"Malicious software programs that can copy themselves and infect other computers on a peer-to-peer basis.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s153","strTitle":"Vulnerability","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s153a01","layoutId":"p66712i04s153lay01","strContent":"Weakness in an IT system that needs to be identified and understood so that appropriate remedial activities can take place.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s154","strTitle":"Warm Site","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s154a01","layoutId":"p66712i04s154lay01","strContent":"Term used in business continuity to describe a standby site which contains an element of hardware and data that can be used in a disaster recovery scenario. This is better than a 'cold site' but doesn't offer the full functionality of a 'hot site'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s155","strTitle":"Web Defacement","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s155a01","layoutId":"p66712i04s155lay01","strContent":"This is where an attacker makes an unauthorised change on a website (e.g. message or some other form of visual modification) or attempts to use the compromised website to distribute malicious code to visitors.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s156","strTitle":"War-driving","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s156a01","layoutId":"p66712i04s156lay01","strContent":"Term used for the searching for Wi-Fi wireless networks by a person in a moving vehicle using software and a portable computer. This could be in order to locate unsecured wireless networks so that the attacker can 'piggyback' on the bandwidth or compromise\/listen to the data traffic.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s157","strTitle":"Web Filtering","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s157a01","layoutId":"p66712i04s157lay01","strContent":"Technique for controlling\/analysing the content of traffic that is being viewed whilst surfing the web.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s158","strTitle":"Web Scrapping","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s158a01","layoutId":"p66712i04s158lay01","strContent":"Obtaining information from websites (also known as Web Harvesting), which has both legitimate (price comparisons, weather monitoring, etc.) and illegitimate purposes (obtaining email addresses for spam campaigns).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s159","strTitle":"White Box Testing","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s159a01","layoutId":"p66712i04s159lay01","strContent":"Running a penetration test against a system\/application with prior knowledge.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s160","strTitle":"Whitelist","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s160a01","layoutId":"p66712i04s160lay01","strContent":"This details programs\/applications\/websites\/etc. that are trusted and are allowed to run.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s161","strTitle":"Wi-Fi (Wireless Fidelity)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s161a01","layoutId":"p66712i04s161lay01","strContent":"Trademark of the Wi-Fi Alliance that relates to wireless networks, with close links to the IEEE2 802.11 standard (suite of protocols that determine how wireless networks operate).","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s162","strTitle":"Wireless Access Point (WAP)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s162a01","layoutId":"p66712i04s162lay01","strContent":"Device that allows wireless devices to connect to a wired network using Wi-Fi.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s163","strTitle":"Wi-Fi Hotspot","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s163a01","layoutId":"p66712i04s163lay01","strContent":"An 'open' (i.e. unsecured) site that offers internet access over a wireless local area network using Wi-Fi technology. Usually found in coffee shops, airport lounges, hotels, etc. which are not to be used to access personal or confidential data unless further security controls are applied e.g. use of a VPN.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s164","strTitle":"Worms","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s164a01","layoutId":"p66712i04s164lay01","strContent":"Malicious software programs that can copy themselves and infect other computers without any user intervention.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s165","strTitle":"Zero-day (or Zero-Hour or Day Zero) Attack","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s165a01","layoutId":"p66712i04s165lay01","strContent":"This attack uses a previously unknown IT system vulnerability to exploit and compromise the system, or the data residing in it.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s166","strTitle":"Zombies","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s166a01","layoutId":"p66712i04s166lay01","strContent":"See 'Bot'.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s167","strTitle":"App","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s167a01","layoutId":"p66712i04s167lay01","strContent":"An application (abbreviated to 'app'), is a software program designed to perform a specific function. They are usually downloaded to mobile devices.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s168","strTitle":"Coding","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s168a01","layoutId":"p66712i04s168lay01","strContent":"Coding is an analytical process that systematically categorises or indexes both qualitative and quantitative data to help further analysis.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s169","strTitle":"SD Card (Secure Digital Card)","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s169a01","layoutId":"p66712i04s169lay01","strContent":"An ultra small flash memory card designed to provide high-capacity memory in a small size. SD cards are used in many small portable devices such as digital cameras, smartphones and laptops.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1},{"id":"p66712i04s170","strTitle":"Codified","objNormalBackgroundSrc":{"strSrc":""},"assets":[{"id":"p66712i04s170a01","layoutId":"p66712i04s170lay01","strContent":"To arrange or organise something (e.g. information) according to a system or plan.","active":1}],"extras":{"scalar":""},"subscreens":[],"active":1}],"active":true}}