Enterprise Risk Management

Enterprise Risk Management

Definition(s)


Enterprise Risk Management

Comprehensive approach to risk management that engages organizational systems and processes together to improve the quality of decision making for managing risks that may hinder an organization’s ability to achieve its objectives Sample Usage: An organization uses enterprise risk management processes to holistically consider the risks associated with personnel turnover. Annotation: Enterprise risks may arise from internal and external sources. Examples of internal sources include issues such as financial stewardship, personnel reliability, and systems reliability. Where internal risks threaten successful mission execution, enterprise risk management seeks to ensure that internal systems and processes are tailored to minimize the potential for mission failure. Examples of external factors include, but are not limited to, global, political, and societal trends. An organization will modify its enterprise risk management approach to take these risks into account. Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Enterprise Risk Management

A comprehensive approach to risk management that engages people, processes, and systems across an organization to improve the quality of decision making for managing risks that may hinder an organizations ability to achieve its objectives. Extended Definition: Involves identifying mission dependencies on enterprise capabilities, identifying and prioritizing risks due to defined threats, implementing countermeasures to provide both a static risk posture and an effective dynamic response to active threats; and assessing enterprise performance against threats and adjusts countermeasures as necessary. Adapted from: DHS Risk Lexicon, CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Encryption

Encryption

Definition(s)


Encryption

The process of transforming plaintext into ciphertext. Extended Definition: Converting data into a form that cannot be easily understood by unauthorized people. Adapted from: CNSSI 4009, ICAM SAML 2.0 WB SSO Profile 1.0.2 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encryption

Cryptographic transformation of plaintext into ciphertext that conceals the data’s original meaning to prevent it from being known or used (See “decryption”) [11].
  • NOTE: If the transformation is reversible, the corresponding reversal process is called "decryption," which is a transformation that restores encrypted data to its original state.
Source: ANSI/ISA–99.00.01–2007, Security for Industrial Automation and Control Systems, Part 1: Terminology, Concepts, and Models, 29 October 2007. National Standard
Encrypt

Encrypt

Definition(s)


Encrypt

The process of transforming plaintext into ciphertext. Extended Definition: Converting data into a form that cannot be easily understood by unauthorized people. Adapted from: CNSSI 4009, ICAM SAML 2.0 WB SSO Profile 1.0.2 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encrypt

To convert plaintext to ciphertext by means of a cryptographic system. From: CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encrypt

To convert plaintext to ciphertext by means of a code. Synonym(s): From: CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encrypt

The generic term encompassing encipher and encode. From: CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Encode

Encode

Definition(s)


Encode

The process of transforming plaintext into ciphertext. Extended Definition: Converting data into a form that cannot be easily understood by unauthorized people. Adapted from: CNSSI 4009, ICAM SAML 2.0 WB SSO Profile 1.0.2. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encode

To convert plaintext to ciphertext by means of a cryptographic system. From: CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encode

To convert plaintext to ciphertext by means of a code. Synonym(s): From: CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encode

The generic term encompassing encipher and encode. From: CNSSI 4009 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Encipher

Encipher

Definition(s)


Encipher

To convert plaintext to ciphertext by means of a cryptographic system. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encipher

To convert plaintext to ciphertext by means of a code. Synonym(s): From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encipher

The generic term encompassing encipher and encode. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Encipher

The process of transforming plaintext into ciphertext. Extended Definition: Converting data into a form that cannot be easily understood by unauthorized people. Adapted from: CNSSI 4009, ICAM SAML 2.0 WB SSO Profile 1.0.2 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Electronic Signature

Electronic Signature

Definition(s)


Electronic Signature

Any mark in electronic form associated with an electronic document, applied with the intent to sign the document. Adapted from: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Education and Training

Education and Training

Definition(s)


Education and Training

In the NICE Workforce Framework, cybersecurity work where a person: Conducts training of personnel within pertinent subject domain; develop, plan, coordinate, deliver, and/or evaluate training courses, methods, and techniques as appropriate. From: NICE Workforce Framework. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Dynamic Attack Surface

Dynamic Attack Surface

Definition(s)


Dynamic Attack Surface

The automated, on-the-fly changes of an information system's characteristics to thwart actions of an adversary. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Distributed Denial of Service

Distributed Denial of Service

Definition(s)


Distributed Denial of Service

A denial of service technique that uses numerous systems to perform the attack simultaneously. Adapted from: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Disruption

Disruption

Definition(s)


Disruption

An event which causes unplanned interruption in operations or functions for an unacceptable length of time. Adapted from: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Digital Signature

Digital Signature

Definition(s)


Digital Signature

A value computed with a cryptographic process using a private key and then appended to a data object, thereby digitally signing the data. Adapted from: CNSSI 4009, IETF RFC 2828, ICAM SAML 2.0 WB SSO Profile 1.0.2, InCommon Glossary, NIST SP 800-63 Rev 1. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Digital Signature

Result of a cryptographic transformation of data which, when properly implemented, provides the services of origin authentication, data integrity, and signer non-repudiation [12]. Source: ANSI/ISA–99.00.01–2007, Security for Industrial Automation and Control Systems, Part 1: Terminology, Concepts, and Models, 29 October 2007. National Standard
Digital Rights Management

Digital Rights Management

Definition(s)


Digital Rights Management

A form of access control technology to protect and manage use of digital content or devices in accordance with the content or device provider's intentions. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Digital Forensics

Digital Forensics

Definition(s)


Digital Forensics

The processes and specialized techniques for gathering, retaining, and analyzing system-related data (digital evidence) for investigative purposes. Extended Definition: In the NICE Workforce Framework, cybersecurity work where a person: Collects, processes, preserves, analyzes, and presents computer-related evidence in support of network vulnerability, mitigation, and/or criminal, fraud, counterintelligence or law enforcement investigations. Adapted from: CNSSI 4009; From: NICE Workforce Framework. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Designed-in Security

Designed-in Security

Definition(s)


Designed-in Security

A set of principles, practices, and tools to design, develop, and evolve information systems and software that enhance resistance to vulnerabilities, flaws, and attacks. Adapted from: Trustworthy Cyberspace: Strategic Plan for the Federal Cybersecurity Research and Development Program (2011), US-CERT's Build Security In website. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Denial of Service

Denial of Service

Definition(s)


Denial of Service

An attack that prevents or impairs the authorized use of information system resources or services. Adapted from: NCSD Glossary. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Denial of Service

Prevention or interruption of authorized access to a system resource or the delaying of system operations and functions [11].
  • NOTE: In the context of industrial automation and control systems, denial of service can refer to loss of process function, not just loss of data communications.
Source: ANSI/ISA–99.00.01–2007, Security for Industrial Automation and Control Systems, Part 1: Terminology, Concepts, and Models, 29 October 2007. National Standard
Decrypt

Decrypt

Definition(s)


Decrypt

To convert enciphered text to plain text by means of a cryptographic system. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decrypt

To convert encoded text to plain text by means of a code. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decrypt

A generic term encompassing decode and decipher. Synonym(s): From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decrypt

The process of transforming ciphertext into its original plaintext. Extended Definition: The process of converting encrypted data back into its original form, so it can be understood. Adapted from: ICAM SAML 2.0 WB SSO Profile 1.0.2 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Decode

Decode

Definition(s)


Decode

To convert enciphered text to plain text by means of a cryptographic system. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decode

To convert encoded text to plain text by means of a code. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decode

A generic term encompassing decode and decipher. Synonym(s): From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decode

The process of transforming ciphertext into its original plaintext. Extended Definition: The process of converting encrypted data back into its original form, so it can be understood. Adapted from: ICAM SAML 2.0 WB SSO Profile 1.0.2 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Decipher

Decipher

Definition(s)


Decipher

To convert enciphered text to plain text by means of a cryptographic system. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decipher

To convert encoded text to plain text by means of a code. From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decipher

A generic term encompassing decode and decipher. Synonym(s): From: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Decipher

The process of transforming ciphertext into its original plaintext. Extended Definition: The process of converting encrypted data back into its original form, so it can be understood. Adapted from: ICAM SAML 2.0 WB SSO Profile 1.0.2 Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Theft

Data Theft

Definition(s)


Data Theft

The deliberate or intentional act of stealing of information. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Spill

Data Spill

Definition(s)


Data Spill

The unauthorized movement or disclosure of sensitive information to a party, usually outside the organization, that is not authorized to have or see the information. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Mining

Data Mining

Definition(s)


Data Mining

The process or techniques used to analyze large sets of existing information to discover previously unrevealed patterns or correlations. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Loss Prevention

Data Loss Prevention

Definition(s)


Data Loss Prevention

A set of procedures and mechanisms to stop sensitive data from leaving a security boundary. Adapted from: Liu, S., & Kuhn, R. (2010, March/April). Data loss prevention. IEEE IT Professional, 11(2), pp. 10-13. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Loss

Data Loss

Definition(s)


Data Loss

The result of unintentionally or accidentally deleting data, forgetting where it is stored, or exposure to an unauthorized party. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Leakage

Data Leakage

Definition(s)


Data Leakage

The unauthorized movement or disclosure of sensitive information to a party, usually outside the organization, that is not authorized to have or see the information. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Integrity

Data Integrity

Definition(s)


Data Integrity

The property that data is complete, intact, and trusted and has not been modified or destroyed in an unauthorized or accidental manner. Adapted from: CNSSI 4009, NIST SP 800-27. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards  

Data Integrity

Property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner [11].
  • NOTE: This term deals with constancy of and confidence in data values, not with the information that the values represent or the trustworthiness of the source of the values.
Source: ANSI/ISA–99.00.01–2007, Security for Industrial Automation and Control Systems, Part 1: Terminology, Concepts, and Models, 29 October 2007. National Standard
Data Breach

Data Breach

Definition(s)


Data Breach

The unauthorized movement or disclosure of sensitive information to a party, usually outside the organization, that is not authorized to have or see the information. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Aggregation

Data Aggregation

Definition(s)


Data Aggregation

The process of gathering and combining data from different sources, so that the combined data reveals new information. Extended Definition: The new information is more sensitive than the individual data elements themselves and the person who aggregates the data was not granted access to the totality of the information. Adapted from: CNSSI 4009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Data Administration

Data Administration

Definition(s)


Data Administration

In the NICE Workforce Framework, cybersecurity work where a person: Develops and administers databases and/or data management systems that allow for the storage, query, and utilization of data. From: NICE Workforce Framework Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Cyberspace

Cyberspace

Definition(s)


Cyberspace

The interdependent network of information technology infrastructures, that includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers. Adapted from: NSPD 54/HSPD -23, CNSSI 4009, NIST SP 800-53 Rev 4. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards
Cybersecurity

Cybersecurity

Definition(s)


Cyber Security

The process of protecting information by preventing, detecting, and responding to attacks.

Source: API RP 781 Security Plan Methodology for the Oil and Natural Gas Industries.1st Ed. September 2016. Global Standards

Cybersecurity

Preservation of confidentiality, integrity and availability of information in the Cyberspace.
  • NOTE 1 In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved.
  • NOTE 2 Adapted from the definition for information security in ISO/IEC 27000:2009.
Source: ISO/IEC 27032:2015, Information technology — Security techniques — Guidelines for cybersecurity, First Edition, July 2012. Global Standards

Cybersecurity

The activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation. Extended Definition: Strategy, policy, and standards regarding the security of and operations in cyberspace, and encompass[ing] the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as they relate to the security and stability of the global information and communications infrastructure. Adapted from: CNSSI 4009, NIST SP 800-53 Rev 4, NIPP, DHS National Preparedness Goal; White House Cyberspace Policy Review, May 2009. Source: NICCS™ Portal Cybersecurity Lexicon, National Initiative for Cybersecurity Careers and Studies (https://niccs.us-cert.gov/glossary) as of 11 November 2015, Global Standards