|
Information Security
Glossary A
This glossary contains industry standard and City specific IT terminology. The glossary
should be consulted when policy, issue papers, etc. are drafted to ensure consistent use of terms across the City.
Read-Only
Recovery Point Objective (RPO)
Recovery Time Objective (RTO)
Removable Storage
Response / Response Time
Risk Assessment
Risk Management
Root
Root Directory
Root Kit
Routine
RSA
Read-Only:
A disk, file, data, document etc., which can be viewed, possibly copied,
but cannot be changed.
Items within a system, such as a ROM Chip, which the system can read
from, but not write to.
Recovery Point Objective (RPO)
The point in the business process to which the system must be recovered. An example of this
is at the start of the day versus the last transaction processed.
Recovery Time Objective (RTO)
The time frame within which the system or business process must be back in production
after a major event or disaster has occured.
Removable Storage
U.S.Computer storage media - such as disks, tapes, CDs etc., that can easily be
removed from a computer and moved to another location or used in another
computer.
Response / Response Time
U.S.Response time usually refers to a user's subjective assessment of a computers
'response' to their request. Such requests could be to logon to the network, or
could be to receive the confirmation code following entry of a transaction. The
response time of a system results from the interaction of multiple components
and not simple the 'power' of the computer itself (although this helps!) There
could be massive contention
across the network, or there could be heavy processing taking place on resulting
in little available 'CPU' time to deal with your request. One way of improving
response time, is to increase the priority of the process which you are running.
However, such techniques are not advisable, unless you are the
System Administrator
and have a good understanding of the impact such re-prioritization may have.
Risk Assessment
The process of identifying types and severity of risks and determining what action would be appropriate to take in response to each. To assist with the process various risk analysis tools are on the market. There are two major approaches to risk analysis; either quantitative or qualitative. The quantitative approach is based on mathmatical calculations involving formulas for the probability of a scenario occurring and the likely value the loss would cause. The qualitative analysis does not require probability data and uses only estimates of potential losses.
Risk Management
A comprehensive methodology that strives to balance risks against benefits in a
pre-defined environment.
Root
U.S.Very much a 'techie' term and refers to the most privileged access possible
on a Unix computer system. With 'root' access, one can create, delete (or
corrupt !) anything on the system. The use of 'root' is normally highly
restricted with Systems Operations and support staff using accounts with limited
privilege.
Root Directory
U.S.In a computer's filing system on the hard disk, the root directory is the
directory (or 'folder') from which all other directories will be created. In
Microsoft Windows® the root is denoted by the symbol '\' and in the world of
Unix is shown by '/' (just to be different!) In Unix the all powerful user of the system is also known as root which
permits access and all privileges to the root directory and hence the entire
filing system.
Root Kit
A rootkit is a collection of tools (programs) that enable administrator-level access to a computer or computer
network. Typically, a cracker installs a rootkit on a computer after first obtaining user-level access, either
by exploiting a known vulnerability or cracking a password. Once the rootkit is installed, it allows the
attacker to mask intrusion and gain root or privileged access to the computer and, possibly, other machines
on the network.
Routine
U.S.In IT, generally, a set of computer Commands/instructions forming part of a
program. For ease and clarity of programming, software often consists of
numerous modules, routines, sub-routines, etc., each of which can, if necessary,
be programmed by a different person, only being brought together at the final
stages.
RSA
U.S.RSA stands for Rivest, Shamir and Adleman, who are the developers of the
public-key encryption and authentication algorithm. They also founders of RSA
Data Security which is now RSA Security www.rsasecurity.com. The capability to use RSA security is incorporated within the browsers of
both Microsoft and Netscape and other major corporate communication tools such
as Lotus Domino® / Notes®. The creation, use and management of the Public and Private keys which are
required for RSA security, use Public Key Infrastructure , or PKI.
|