Cybersecurity Wiki - User contributions [en]

Page for Draft Bibliographic Entries

2012-06-06T14:30:52Z

WikiSysop:

Page for Draft Bibliographic Entries

2012-06-06T14:30:20Z

WikiSysop:

Page for Draft Bibliographic Entries

2012-06-06T14:29:58Z

WikiSysop:

Page for Draft Bibliographic Entries

2012-06-06T14:28:04Z

WikiSysop:

Page for Draft Bibliographic Entries

2012-06-06T14:27:24Z

WikiSysop:

Adding a Reference

2011-06-29T14:38:55Z

WikiSysop:

'''To add a new bibliographic reference entry:'''

=== 1. Research the Reference ===
Search for information on the reference including links to accessible copies online, reviews,
discussions and/or the web site of the author or sponsor.

=== 2. Create a BibTex Entry for the reference ===
Next create the BibTeX entry for the reference. (See [[Guidelines for adding Bibliography entries]].)

=== 3. Create a blank Wiki page for the reference ===
To do this within the wiki format, you need to choose an existing page to create the link on. Normally, you will enter the reference into the listing of all references on the [[Cybersecurity Annotated Bibliography]]. Enter a new table entry in the correct alphabetical order by first (if more than one) author's last name (see next paragraph). The initial entry does not have to be complete (since some information will not yet be available such as level of expertise), however leave blank table entries ("| |") for missing data.

'''The title of the new reference page will normally be the short version of the reference title.''' For
example, if the title of the reference is "''Pricing Security: Vulnerabilities as Externalities'',"
the page will be named [[Pricing Security]]. The exception will be where that page already exists
([[Cyberwar]] for example), in which case you will need to include the subtitle (or some other distinguishing text) to create a unique page name.

'''Click on your newly created link.''' This should open a blank editing page (if it does not then you need to
come up with a new unique page name).

'''Copy and paste''' the contents of the [[TemplateForSources | sample template]]
or some other reference page similar to the new reference into the newly created page. You should
copy the ''source'' of the template (by selecting the "edit" tab) rather than the displayed page text.

=== 4. Begin editing the template ===
(Note: You may find it easier to enter all the template information except for "Categorization" and "Keywords," then go back and complete these two sections last.)

==== 4.1 Full Title of Reference ====
The "Full Title of Reference" should contain both the main title and any subtitle separated by a colon.

E.g, Even though the wiki reference page is [[Four Grand Challenges in Trustworthy Computing]], the full title would be "Four Grand Challenges in Trustworthy Computing: Second in a Series of Conferences on Grand Research Challenges in Computer Science and Engineering."

==== 4.2 Full Citation ====
The full citation should consists of the bluebook formatted citation for the reference followed by a link to
the full text of the reference if available labeled as ''Web'' or ''SSRN'' depending on whether the link goes directly to the
text or to an intermediate SSRN page. This link should appear on the same line as the citation. If there is a second
source for the full text of the reference, it should follow, labled as ''AltWeb''.

(An example of the use of ''AltWeb'' is available at [[Why Information Security is Hard]].)

(An example of the use of ''SSRN'' is available at [[Overcoming Impediments to Information Sharing]].)

Note that ''Web'', ''AltWeb'', ''SSRN'', ''BibTex'' all are italicized.

On a separate line (place one blank line after the citation to force the Wiki to line space), put the following as applicable:

* A link to the ''BibTeX'' entry for the reference (this should show only a single BibTeX entry in detail format - e.g. [http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=DoD:2007 ''BibTeX'']

* A link to the ''Google Book''s entry for the reference, e.g., [http://books.google.com/books?id=ILaY4jBWXfcC&dq=Security+Engineering&ei=1NFRTNz5KJeMygTr6dDqBQ&cd=1 ''Google Books''] (This can often be found in the BibTeX entry.)

* A link to the ''WorldCat'' entry for the reference, e.g., [http://www.worldcat.org/title/security-engineering-a-guide-to-building-dependable-distributed-systems-second-edition/oclc/639194438&referer=brief_results ''World Cat''].

* A link to ''Amazon''.com's page for the reference (since this often contains useful reviews and other information about the work), e.g, [http://www.amazon.com/Security-Engineering-Building-Dependable-Distributed/dp/0470068523/ref=sr_1_1?ie=UTF8&s=books&qid=1280430777&sr=8-1 ''Amazon''].

(See [[Security Engineering]] for an example that contains all of these links.)

==== 4.3 Categorization ====
Note: ''Categories refer to the major themes of the reference.'' If the reference only mentions a category in passing but does not focus on it, then it need not be included.

'''Create links to the appropriate categories for the reference.''' When you add a link to a category to the reference page, you must also place a link back to the reference page
into the [[Table of Contents]] page for that category and ''every Table of Contents page higher in the hierarchy''. So, for example, if you categorize the reference
under TOC-> Issues-> Economics of Cybersecurity->Insurance, then links to it must appear under [[Insurance]], [[Economics of Cybersecurity]] and [[Issues]]. Links from
TOC Category pages back to the reference page should follow the table format shown in the TOC. If more than two authors, abbreviate to "<first author> et. al"

'''Enter the reference in the selected category page''' in alphabetical order by the [first] author's last name.

Categories should be separated by top level Table of Contents topics and in the following order (note only those top level topics in which the current reference has an applicable category need appear), i.e.:

* Overview:
* Resource by Type:
* Treats and Actors:
* Issues:
* Approaches:

Multiple categories within a single top level Table of Contents topic should be separated by semicolons and arranged in alphabetical order, i.e.

* Threats and Actors: [[The Threat and Skeptics]]; [[States]]; [[Security Targets]]

==== 4.4 Key Words ====
'''Add Relevant Keywords:''' Add Glossary/Keyword entries in alphabetical order separated by commas. You can copy links from the [[List of Keyword links to copy into reference pages | Keyword Links]] page directly into the reference page. (Switch to "edit" mode to copy the link -- be careful not to change the text on the Keyword Links page though.)

'''In the glossary, create links back to the reference page:''' Make sure to create links from the [[Keyword Index and Glossary of Core Ideas]] page back to the reference. If another reference by the same author is linked under a given keyword, use "[2]", "[3]", etc. for succeeding entries.

'''New keywords:''' If you decide to add a new keyword to the [[Keyword Index and Glossary of Core Ideas]], make sure to update the [[List of Keyword links to copy into reference pages | Keyword Links]] page. It is also a good idea to email either David Abrams or Caroline Nolan of the addition.

Note that links to Keywords are appropriate ''even when the item is only mentioned in passing in the reference''. The purpose of keywords are to help someone unfamiliar with the term or
to provide a way to find other references with the same keyword but appearing in a separate category.

====4.5 Synopsis====
'''Add the Synopsis:''' The goal is not merely to summarize the subject matter of the reference; rather, the synopsis should also summarize the author's conclusions as well. Typically this will be equivalent to an executive summary, and that section of the reference, if available, can provide the basis of the synopsis. Alternately, quoted opening or conclusion paragraphs from the reference may form the basis for the synopsis. Feel free to use wiki section headings "===", "====", etc. to provide clarity to the synopsis.

====4.6 Additional Notes and Highlights====
Finally, the "Additional Notes and Highlights" section provides a place to include information that does not fit in elsewhere.

'''Required:''' This section should begin with "Expertise Required: " followed by either "None" or one or more "<field> - <level>" pair separated by semicolons. Level is one of "Low", "Moderate" or "High" (although intermediate values "Low/Moderate" are allowed. If there are multiple field/level pairs, order them from highest expertise level to lowest, e.g.,

Expertise Required: Economics - Moderate; Law - Low

This is a subjective measure. "None" means a person with a college education but no specific expertise in the subject matter of the reference would be able to understand it. "High" suggests that a great deal of knowledge in the subject matter is required, possibly because of extensive mathematical equations or jargon-filled discussion.

(Note that on the reference page, each expertise entry is ordered with subject matter first followed by level required; however, in the TOC, the highest level of competence is always placed first to allow the user to sort on that parameter.)

'''Other possible items to include in the Additional Notes and Highlights (if available) are:'''

* The '''table of contents''' of the reference: [[Overcoming Impediments to Information Sharing#Additional Notes and Highlights]].

* '''Biographic information''' about the author: [[Armed Attack in Cyberspace#Additional Notes and Highlights]] or about an organization [[Security Economics and the Internal Market#Additional Notes and Highlights]].

* '''Reviews''' of the reference: [[Do Data Breach Disclosure Laws Reduce Identity Theft#Additional Notes and Highlights]].

* '''Excerpts''' or chapters where the full reference is not available online: [[Cyber War#Additional Notes and Highlights]].

* Links to '''the author's home page''': [[Why Information Security is Hard#Additional Notes and Highlights]].

* "See also" information that would be useful to the reader: [[Law and War in the Virtual Era#Additional Notes and Highlights]].

* Information on (and possibly links to) '''previous versions''' of the reference: [[A Roadmap for Cybersecurity Research#Additional Notes and Highlights]].

* Description of a '''useful appendix or glossary''' in the reference: [[Critical Infrastructure Threats and Terrorism#Additional Notes and Highlights]].

===5. Check your Work===

* Check all your links to make sure they work.
* Make sure that your reference is included in the [[Cybersecurity Annotated Bibliography]] list of all reference in the wiki.
* Make sure the reference appears in the selected categories and ''all the higher level categories'' of the selected categories.
* Make sure your category links not only work but properly link back to the reference.
* Make sure your keywords links not only work but properly link back to the reference.

Schneier on Security

2010-10-08T13:16:09Z

WikiSysop: /* Additional Notes and Highlights */

==Full Title of Reference==
Schneier on Security

==Full Citation==

Bruce Schneier, Schneier on Security (2008).

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=Schneier_B:2008 ''BibTeX'']
[http://books.google.com/books?id=tzyqfHr2oGAC&dq=Schneier+on+Security&ei=id1RTNXLNI2IygTxmojcCQ&cd=1 ''Google Books'']
[http://www.worldcat.org/search?q=isbn:0470395354 ''World Cat'']
[http://www.amazon.com/Schneier-Security-Bruce/dp/0470395354 ''Amazon'']
[http://www.schneier.com/book-sos.html ''Purchase from the Author'']

==Categorization==
* [[Overview]]
* Resource by Type: [[Books]]
* Threats and Actors: [[Actors and Incentives]]; [[The Threat and Skeptics]]; [[Transportation]]
* Issues: [[Metrics]]; [[Risk Management and Investment]]; [[Privacy]]; [[Usability/Human Factors]]
* Approaches: [[Government Organizations]]; [[Regulation/Liability]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Data_Mining | Data Mining]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Department_of_Homeland_Security | Department of Homeland Security]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy | Disclosure Policy]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Identity_Fraud/Theft | Identity Fraud/Theft]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries | Information Asymmetries]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#National_Security | National Security Policy]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Phishing | Phishing]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]]

==Synopsis==

This collection of essays on security: on security technology, on security policy, and on how security works in the real world was previously published between June 2002 and June 2008. They offer a computer security expert's insights into a wide range of security issues, including the risk of identity theft (vastly overrated), the long-range security threat of unchecked presidential power, why computer security is fundamentally an economic problem, the industry power struggle over controlling your computer, and why national ID cards won't make us safer, only poorer. Schneier recognizes that the ultimate security risk is people and that many security paractices are, in fact, security risks. While not primarily a treatise on cybersecurity (although several of the essays address cybersecurity), Schneier's insights are applicable to any security situation where limited resources make trade-offs necessary.

[http://www.amazon.com/gp/cdp/member-reviews/A1L5RDC8H9BB9S/ref=cm_cr_dp_auth_rev?ie=UTF8&sort_by=MostRecentReview Review by Ben Rothke]
<blockquote>
Perhaps no one in the world gets security like author Bruce Schneier does. ... Schneier on Security is a collection of the best articles that Bruce has written from June 2002 to June 2008, mainly from his Crypto-Gram Newsletter, his blog, and other newspapers and magazine. The book is divided into 12 sections, covering nearly the entire range of security issues from terrorism, aviation, elections, economics, psychology, the business of security and much more. 

Two of the terms Schneier uses extensively throughout the book are intelligence and economics. From an intelligence perspective, he feels that Washington has spent far too much on hardware and other trendy security devices that create a sense of security theater. The security theater gives an aura and show of security, but in reality, has little real effect.

The lack of intelligence is most manifest with airports, which are a perfect example of misguided security. Schneier notes that current trends in US airport security requires that people remove their shoes, due to a one-time incident with shoe-based explosive. Such an approach completely misses the point. Also, Schneier notes that the attempt to create a no-fly list, by feeding a limited set of characteristics into a computer, which is somehow expected to divine a person's terrorist leaning, is farcical.

Schneier therefore feels that the only way to effectively uncover terrorist plats is via intelligence and investigations, not via large-scale processing of everyone. Intelligence is an invaluable tool against terrorism, and the beauty of it is that it works regardless of what the terrorists are plotting. The bottom line according to Schneier in the book is that too much of the United State's counterterrorism security spending is not designed to protect us from the terrorists; but instead to protect public officials from criticism when another attack occurs.

Schneier also astutely notes that for the most part, security is not really so much of a technical issue, rather one of economics. A perfect example he gives is that of bulletproof vests. Since they are so effective, why doesn't everyone wear them all of the time? The reason people don't is that they do not think they are worth the cost. It is not worth the money or inconvenience, as the risk of being shot for most people is quite low. As a security consumer, people have made the calculation that not wearing a bulletproof vest is a good security trade-off. Schneier also notes that much of what is being proposed as national security is a bad security trade-off. It is not worth it and as consumers, the public is being ripped off.

Another recurring theme throughout the book is how the Bush administration has little by little eroded the Constitution, all in the name of fighting terrorism. Schneier notes that the brilliant framework the founding fathers created by creating divisions of power (executive, legislative, judicial) with checks and balances violates a basic unwritten rule, that the government should be granted only limited powers, and for limited purposes. Since there is a certainty that government powers will be abused. 

Schneier observes that the USA PATRIOT is a perfect example of this abuse. The Constitution was designed and carefully outlines which powers each branch may exercise. While Schneier is best-known as a cryptographer and security expert, Schneier on Security also shows him to be a defender of the Constitution. In a number of essays in the book, he shows how unchecked presidential powers is bad not only for security, but for the preservation of democracy. 

In chapter 8, on the topic of the economics of security, Schneier suggests a three-step program for improving computer and network security. He notes that none of them have anything to do with technology; they all have to do with businesses, economics, and people. 

In chapter 9, on the psychology of security, Schneier writes that he tells people that if something is in the news, then they do not have to worry about it. He writes that the very definition of news is something that hardly ever happens. It's when something is not in the news, when it is so common that it is no longer news, drunk drivers killing people, domestic violence, deaths from diabetes, etc., that is when you should start worrying. And much of the terrorist threats that the Department of Homeland Security is spending tens of billions of dollars on, are those news threats, such as shoe bombers and liquid explosives that present very little real threat to the people of the US.

A fundamental theme of the book is that security is a trade-off. And far too many people have made the security trade-off without thinking if it is truly worth it. In essay after essay, Schenier challenges those assertions. Since 9/11, much has been given up in the name of terrorism, and that has been personal privacy and security. Schenier asks, has it been worth it?

Schneier on Security is an exceptionally important book that is overflowing with thought-provoking articles. Schneier gets above vague adages such as the war on terror and gets to the heart of the matter. His insight details what the real threats are, and what we should really be worrying about. The irony is that what Washington does is often the exact opposite of what should be done.

Much of the security carried out in the name of 9/11 has proven to be infective in the seven years since the attack. Schneier on Security is a manifesto of what should have been done, and what should be done. The book is eye-opening from the first page to the last. It lets you know that the next time you see grandma asked to take her shoes off by a TSA agent at the airport, why she is simply a bit player in the large security theater. And why spending tens of billions on a charade like that, makes that a tragedy of epic proportions.
</blockquote>

==Additional Notes and Highlights==

Expertise Required: None

Table of Contents
Introduction
Terrorism and Security
National Security Policy
Airline Travel
Privacy and Surveillance
ID Cards and Security
Election Security
Security and Disasters
Economics of Security
Psychology of Security
Business of Security
Cybercrime and Cyberwar
Computer and Information Security
References
Index

[http://www.schneier.com/blog/archives/2010/10/stuxnet.html Bruce Schneier's analysis of the Stuxnet worm]

[http://www.schneier.com/ Bruce Schneier's blog covering security and security technology.]

[http://www.schneier.com/crypto-gram-back.html Back issues] of Bruce Schneier's monthly email newsletter. (Most of the essays in this reference can be found here.)

2010 Top Cyber Security Risks Report

2010-09-21T14:42:51Z

WikiSysop:

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]
* Approaches: [[Technology]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#DDoS_Attack | DDoS Attack]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

While the sections of the report which explain in detail how attackers hide exploits in seemingly innocuous code require some technical expertise, there is a very clear explanation of how such an exploit is downloaded and executed on a victim's computer within the corporate firewall that requires no special expertise to understand. ''See'' page 27.

[http://dvlabs.tippingpoint.com/ Web Site of Author Organization]

2010 Top Cyber Security Risks Report

2010-09-21T14:41:30Z

WikiSysop: /* Key Words */

Keyword Index and Glossary of Core Ideas

2010-09-21T14:40:51Z

WikiSysop: /* Zero-Day Exploit */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:40:39Z

WikiSysop: /* Worm */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:40:27Z

WikiSysop: /* Trojan */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:40:10Z

WikiSysop: /* SPAM */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:39:43Z

WikiSysop: /* Patching */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:39:21Z

WikiSysop: /* Patching */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:39:04Z

WikiSysop: /* Patching */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:38:48Z

WikiSysop: /* Malware */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:38:32Z

WikiSysop: /* DDoS Attack */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:38:05Z

WikiSysop: /* Cyber Crime */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:37:51Z

WikiSysop: /* Botnet */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:37:36Z

WikiSysop: /* Antivirus */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[2010 Top Cyber Security Risks Report | HP TippingPoint DVLabs]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-21T14:36:45Z

WikiSysop: /* Antivirus */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[HP TippingPoint DVLabs| 2010 Top Cyber Security Risks Report]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

2010 Top Cyber Security Risks Report

2010-09-21T14:35:46Z

WikiSysop: /* Key Words */

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]
* Approaches: [[Technology]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Distributed_Denial_of_Service_(DDoS) | Distributed Denial of Service (DDoS)]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

While the sections of the report which explain in detail how attackers hide exploits in seemingly innocuous code require some technical expertise, there is a very clear explanation of how such an exploit is downloaded and executed on a victim's computer within the corporate firewall that requires no special expertise to understand. ''See'' page 27.

Approaches

2010-09-21T14:34:11Z

WikiSysop:

''[[Table of Contents | TOC->]][[Approaches]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Author 1
! style="background-color: #efefef;" | Author 2
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Anderson, Ross J.||||2008||[[Security Engineering]]||Book||Moderate:Technology; Moderate:Cryptography||N/A
|-
|Anderson, Ross, et. al|| ||2008||[[Security Economics and the Internal Market]]||Study||Low:Economics||[http://www.enisa.europa.eu/act/sr/reports/econ-sec/economics-sec/at_download/fullReport ''Pdf'']
|-
|Anderson, Ross||||2001||[[Why Information Security is Hard]]||Conf. Paper||None||[http://www.acsac.org/2001/papers/110.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rja14/Papers/econ.pdf ''AltPdf'']
|-
|Anderson, Ross||Moore, Tyler||2006||[[The Economics of Information Security]]||Journal Article||Low:Economics||[http://people.seas.harvard.edu/~tmoore/science-econ.pdf ''Pdf''] [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.89.3331&rep=rep1&type=pdf ''AltPdf'']
|-
|Aviram, Amitai||Tor, Avishalom||2004||[[Overcoming Impediments to Information Sharing]]||Law Review||Low:Economics||[http://law.haifa.ac.il/faculty/lec_papers/tor/55Ala1.L.Rev.231.pdf ''Pdf''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=435600 ''SSRN'']
|-
|Barkham, Jason||||2001||[[Information Warfare and International Law on the Use of Force]]||Law Review||Moderate:Law||[http://www1.law.nyu.edu/journals/jilp/issues/34/pdf/34_1_b.pdf ''Pdf''] [http://activeresponse.org/files/34_1_b.pdf ''Alt Pdf'']
|-
|Beard, Jack M.||||2009||[[Law and War in the Virtual Era]]||Law Review||Low:Law||[http://www.asil.org/ajil/July2009_1selectedpiece.pdf ''Pdf'']
|-
|Bohme, Rainer||Kataria, Gaurav||2006||[[Models and Measures for Correlation in Cyber-Insurance]]||Conf. Paper||High:Economics||[http://weis2006.econinfosec.org/docs/16.pdf ''Pdf'']
|-
|Bohme, Rainer||Schwartz, Galina||2010||[[Modeling Cyber-Insurance]]||Conf. Paper||High:Economics||[http://www1.inf.tu-dresden.de/~rb21/publications/BS2010_Modeling_Cyber-Insurance_WEIS.pdf ''Pdf'']
|-
|Brown, Davis||||2006||[[A Proposal for an International Convention To Regulate the Use of Information Systems in Armed Conflict]]||Law Review||Moderate:Law||[http://www.harvardilj.org/attach.php?id=59 ''Pdf'']
|-
|Camp, L. Jean||Lewis, Stephen||2004||[[Economics of Information Security]]||Book||High:Economics||N/A
|-
|Center for Strategic and International Studies||||2008||[[Securing Cyberspace for the 44th Presidency]]||Independent Report||Low:Policy||[http://www.cyber.st.dhs.gov/docs/081208_securingcyberspace_44.pdf ''Pdf'']
|-
|Clarke, Richard A.||Knake, Robert||2010||[[Cyber War]]||Book||None||N/A
|-
|Clinton, Larry||||Undated||[[Cyber-Insurance Metrics and Impact on Cyber-Security]]||Online Paper||Low:Technology; Low:Law||[http://www.whitehouse.gov/files/documents/cyber/ISA%20-%20Cyber-Insurance%20Metrics%20and%20Impact%20on%20Cyber-Security.pdf ''Pdf'']
|-
|Department of Commerce||||2010||[[Defense Industrial Base Assessment]]||Government Report||None||[http://www.bis.doc.gov/defenseindustrialbaseprograms/osies/defmarketresearchrpts/final_counterfeit_electronics_report.pdf ''Pdf'']
|-
|Department of Defense||||1999||[[An Assessment of International Legal Issues in Information Operations]]||Government Report||Moderate:Law||[http://www.au.af.mil/au/awc/awcgate/dod-io-legal/dod-io-legal.pdf '' Pdf'']
|-
|Department of Defense||||2005||[[Strategy for Homeland Defense and Civil Support]]||Government Report||None||[http://www.defense.gov/news/Jun2005/d20050630homeland.pdf ''Pdf'']
|-
|Department of Defense||||2007||[[Mission Impact of Foreign Influence on DoD Software]]||Government Report||Low:Defense Policy/Procurement||[http://www.cyber.st.dhs.gov/docs/Defense%20Science%20Board%20Task%20Force%20-%20Report%20on%20Mission%20Impact%20of%20Foreign%20Influence%20on%20DoD%20Software%20(2007).pdf ''Pdf'']
|-
|Department of Homeland Security||||2003||[[The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets]]||Government Report||None||[http://www.dhs.gov/xlibrary/assets/Physical_Strategy.pdf ''Pdf'']
|-
|Department of Homeland Security||||2009||[[A Roadmap for Cybersecurity Research]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/DHS-Cybersecurity-Roadmap.pdf ''Pdf'']
|-
|Deputy Chief of Staff for Intelligence||||2006||[[Critical Infrastructure Threats and Terrorism]]||Government Report||Low:Organizational Analysis; Low:Risk Management||[http://www.fas.org/irp/threat/terrorism/sup2.pdf ''Pdf'']
|-
|Dörmann, Knut||||2004||[[Applicability of the Additional Protocols to Computer Network Attacks]]||Independent Report||Low:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/68LG92/$File/ApplicabilityofIHLtoCNA.pdf ''Pdf'']
|-
|Dunlap, Charles J. Jr.||||2009||[[Towards a Cyberspace Legal Regime in the Twenty-First Century]]||Speech||None||N/A
|-
|Epstein, Richard A.||Brown, Thomas P.||2008||[[Cybersecurity in the Payment Card Industry]]||Law Review||Low:Law; Low:Economics||[http://lawreview.uchicago.edu/issues/archive/v75/75_1/EpsteinArticle.pdf ''Pdf'']
|-
|Gandal, Neil||||2008||[[An Introduction to Key Themes in the Economics of Cyber Security]]||Book Chapter||Low:Economics||[http://www.tau.ac.il/~gandal/security%20encyclopedia%20entry.pdf ''Pdf'']
|-
|Grady, Mark F.||Parisi, Francesco||2006||[[The Law and Economics of Cybersecurity]]||Book||Low:Economics; Low:Law||N/A
|-
|Granick, Jennifer Stisa||||2005||[[The Price of Restricting Vulnerability Publications]]||Law Review||Low/Moderate:Law||[http://www.ijclp.net/files/ijclp_web-doc_10-cy-2004.pdf ''Pdf'']
|-
|Hollis, Duncan B.||||2007||[[Why States Need an International Law for Information Operations]]||Law Review||Moderate:Law||[http://legacy.lclark.edu/org/lclr/objects/LCB_11_4_Art7_Hollis.pdf ''Pdf'']
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|Institute for Information Infrastructure Protection||||2003||[[Cyber Security Research and Development Agenda]]||Independent Report||Low/None:Technology||[http://www.cyber.st.dhs.gov/docs/I3P%20Research%20Agenda%202003.pdf ''Pdf'']
|-
|Johnson, Eric M.||||2008||[[Managing Information Risk and the Economics of Security]]||Book||High:Economics||N/A
|-
|Johnson, Vincent R.||||2005||[[Cybersecurity, Identity Theft, and the Limits of Tort Liability]]||Law Review||Moderate:Law||[http://www.stmarytx.edu/law/pdf/Johnsoncyber.pdf ''Pdf''] [http://law.bepress.com/cgi/viewcontent.cgi?article=3530&context=expresso ''AltPdf'']
|-
|Kobayashi, Bruce H.|| ||2006||[[An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods]]||Journal Article ||High:Economics||[http://www.law.gmu.edu/assets/files/publications/working_papers/05-11.pdf ''Pdf'']
|-
|Korns, Stephen W.|| ||2009||[[Cyber Operations]]||Journal Article||Low:International Warfare||[http://www.carlisle.army.mil/DIME/documents/Cyber%20Operations%20-%20The%20New%20Balance%20-%20Korns.pdf ''Pdf'']
|-
|Kramer, Franklin D., et. al||||2009||[[Cyberpower and National Security]]||Book||None||N/A
|-
|Lernard, Thomas M.||Rubin, Paul H.||2005||[[An Economic Analysis of Notification Requirements for Data Security Breaches]]||Online Paper||Low:Economics||[http://www.pff.org/issues-pubs/pops/pop12.12datasecurity.pdf ''Pdf'']
|-
|Lernard, Thomas M.||Rubin, Paul H.||2006||[[Much Ado About Notification]]||Journal Article||Low:Economics||[http://www.cato.org/pubs/regulation/regv29n1/v29n1-5.pdf ''Pdf''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=898208# ''SSRN'']
|-
|Moore, Tyler||Clayton, Richard||2007||[[Examining the Impact of Website Take-down on Phishing]]||Conf. Paper||Low:Technology||[http://www.ecrimeresearch.org/2007/proceedings/p1_moore.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime07.pdf ''AltPdf'']
|-
|Moore, Tyler||Clayton, Richard||2008||[[The Consequence of Non-Cooperation in the Fight Against Phishing]]||Conf. Paper||Low:Technology; Low:Economics||[http://people.seas.harvard.edu/~tmoore/ecrime08.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime08pre.pdf ''AltPdf'']
|-
|Moore, Tyler||Clayton, Richard||2009||[[The Impact of Incentives on Notice and Take-down]]||Book Chapter||Moderate:Technology; Low:Law||[http://weis2008.econinfosec.org/papers/MooreImpact.pdf ''Pdf'']
|-
|National Cyber Defense Initiative||||2009||[[National Cyber Defense Financial Services Workshop Report]]||Independent Report||Moderate:Financial Services Infrastructure; Moderate:Acronym Tolerance||[http://www.cyber.st.dhs.gov/docs/NCDI_FI_Workshop_Report.pdf ''Pdf''] [http://ncdi.nps.edu/FI_Workshop_Report_100204.pdf ''AltPdf'']
|-
|National Cyber Security Summit Task Force||||2004||[[Information Security Governance]]||Government Report||Moderate:Executive Administration||[http://www.cyber.st.dhs.gov/docs/Information%20Security%20Governance-%20A%20Call%20to%20Action%20(2004).pdf ''Pdf''] [http://www.criminal-justice-careers.com/resources/InfoSecGov4_04.pdf ''AltPdf'']
|-
|National Infrastructure Advisory Council||||2004||[[Hardening The Internet]]||Government Report||High:Technology||[http://www.cyber.st.dhs.gov/docs/NIAC%20Internet%20Hardening.pdf ''Pdf''] [http://www.dhs.gov/xlibrary/assets/niac/NIAC_HardeningInternetPaper_Jan05.pdf ''AltPdf'']
|-
|National Institute of Standards and Technology||||2006||[[SP 800-82: Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security]]||Government Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/NIST%20Guide%20to%20Supervisory%20and%20Data%20Acquisition-SCADA%20and%20Industrial%20Control%20Systems%20Security%20(2007).pdf ''Pdf'']
|-
|National Research Council||||1999||[[Trust in Cyberspace]]||Independent Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/Trust%20in%20Cyberspace%20Report%201999.pdf ''Pdf'']
|-
|National Research Council||||2007||[[Toward a Safer and More Secure Cyberspace]]||Independent Report||Low:Research Processes; Low:Technology||[http://www.cyber.st.dhs.gov/docs/Toward_a_Safer_and_More_Secure_Cyberspace-Full_report.pdf ''Pdf'']
|-
|National Science and Technology Council||||2006||[[Federal Plan for Cyber Security and Information Assurance Research and Development]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/Federal%20R&D%20Plan%202006.pdf ''Pdf'']
|-
|Networking and Information Technology Research and Development||||2009||[[National Cyber Leap Year Summit 2009, Co-Chairs' Report]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/National_Cyber_Leap_Year_Summit_2009_Co-Chairs_Report.pdf ''Pdf'']
|-
|Nye, Joseph||||2010||[[Cyber Power]]||Book Chapter||Low:Technology; Low:Policy||[http://belfercenter.ksg.harvard.edu/files/cyber-power.pdf ''Pdf'']
|-
|Powell, Benjamin||||2005||[[Is Cybersecurity a Public Good]]||Law Review||Low/Moderate:Economics||[http://www.independent.org/pdf/working_papers/57_cyber.pdf ''Pdf''] [http://www.ciaonet.org/wps/pob03/pob03.pdf ''AltPdf'']
|-
|President's Commission on Critical Infrastructure Protection||||1997||[[Critical Foundations]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PCCIP%20Report%201997.pdf ''Pdf'']
|-
|President's Information Technology Advisory Council||||2005||[[Cyber Security: A Crisis of Prioritization]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PITAC%20Report%202005.pdf ''Pdf'']
|-
|Romanosky et al.||||2008||[[Do Data Breach Disclosure Laws Reduce Identity Theft]]||Conf. Paper||Moderate:Economics||[http://weis2008.econinfosec.org/papers/Romanosky.pdf ''Pdf'']
|-
|Schmitt, Michael N., et. al||||2004||[[Computers and War]]||Conf. Paper||Moderate:Law||[http://www.ihlresearch.org/ihl/pdfs/schmittetal.pdf ''Pdf'']
|-
|Schmitt, Michael N.||||1999||[[Computer Network Attack and the Use of Force in International Law]]||Law Review||High:Law||[http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA471993&Location=U2&doc=GetTRDoc.pdf ''Pdf'']
|-
|Schmitt, Michael N.||||2002||[[Wired Warfare]]||Journal Article||Moderate:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/5C5D5C/$File/365_400_Schmitt.pdf ''Pdf'']
|-
|Schneier, Bruce||||2003||[[Beyond Fear]]||Book||None||[http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 ''Scribd'']
|-
|Schneier, Bruce||||2008||[[Schneier on Security]]||Book||None||[http://www.schneier.com/book-sos.html ''Purchase'']
|-
|Schwartz, Paul||Janger, Edward||2007||[[Notification of Data Security Breaches]]||Law Review||Low:Law; Low:Economics||[http://www.michiganlawreview.org/assets/pdfs/105/5/schwartz.pdf ''Pdf'']
|-
|Sklerov, Matthew J.||||2009||[[Solving the Dilemma of State Responses to Cyberattacks]]||Law Review||Moderate:Law; Low:Technology||[http://www.loc.gov/rr/frd/Military_Law/Military_Law_Review/pdf-files/201-fall-2009.pdf ''Pdf'']
|-
|Swire, Peter P.||||2004||[[A Model for When Disclosure Helps Security]]||Law Review||Low/Moderate:Logic||[http://www.rootsecure.net/content/downloads/pdf/disclosure_helps_security.pdf ''Pdf''][http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 ''SSRN'']
|-
|Swire, Peter P.||||2006||[[A Theory of Disclosure for Security and Competitive Reasons]]||Law Review||Low/Moderate:Logic||[http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']
|-
|Todd, Graham H.||||2009||[[Armed Attack in Cyberspace]]||Law Review||Moderate:Law||[http://www.afjag.af.mil/shared/media/document/AFD-091026-024.pdf ''Pdf'']
|-
|Verizon||||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|-
|Watts, Sean||||2010||[[Combatant Status and Computer Network Attack]]||Law Review||Moderate:Law||[http://www.vjil.org/wp-content/uploads/2010/01/VJIL-50.2-Watts.pdf ''Pdf'']
|-
|White House||||2009||[[Cyberspace Policy Review]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/Cyberspace_Policy_Review_final.pdf ''Pdf'']
|-
|White House||||2003||[[The National Strategy to Secure Cyberspace]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/National%20Strategy%20to%20Secure%20Cyberspace%202003.pdf ''Pdf'']
|-
|Zittrain, Jonathan L.||||2008||[[The Future of the Internet and How To Stop It]]||Book||None||[http://futureoftheinternet.org/static/ZittrainTheFutureoftheInternet.pdf ''Pdf'']
|}

'''''Subcategories:'''''
*''[[Approaches | Approaches->]][[Regulation/Liability]]''
*''[[Approaches | Approaches->]][[Private Efforts/Organizations]]''
*''[[Approaches | Approaches->]][[Government Organizations]]''
*''[[Approaches | Approaches->]][[International Cooperation]]''
*''[[Approaches | Approaches->]][[International Law (including Laws of War)]]''
*''[[Approaches | Approaches->]][[Deterrence]]''
*''[[Approaches | Approaches->]][[Technology]]''

''[[Table of Contents | Jump to Table of Contents]]''

Technology

2010-09-21T14:34:00Z

WikiSysop:

''[[Table of Contents | TOC->]][[Approaches | Approaches->]][[Technology]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Author 1
! style="background-color: #efefef;" | Author 2
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Anderson, Ross||Moore, Tyler||2006||[[The Economics of Information Security]]||Journal Article||Low:Economics||[http://people.seas.harvard.edu/~tmoore/science-econ.pdf ''Pdf''] [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.89.3331&rep=rep1&type=pdf ''AltPdf'']
|-
|Gandal, Neil||||2008||[[An Introduction to Key Themes in the Economics of Cyber Security]]||Book Chapter||Low:Economics||[http://www.tau.ac.il/~gandal/security%20encyclopedia%20entry.pdf ''Pdf'']
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2007||[[Examining the Impact of Website Take-down on Phishing]]||Conf. Paper||Low:Technology||[http://www.ecrimeresearch.org/2007/proceedings/p1_moore.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime07.pdf ''AltPdf'']
|-
|Moore, Tyler||Clayton, Richard||2008||[[The Consequence of Non-Cooperation in the Fight Against Phishing]]||Conf. Paper||Low:Technology; Low:Economics||[http://people.seas.harvard.edu/~tmoore/ecrime08.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime08pre.pdf ''AltPdf'']
|-
|National Cyber Defense Initiative||||2009||[[National Cyber Defense Financial Services Workshop Report]]||Independent Report||Moderate:Financial Services Infrastructure; Moderate:Acronym Tolerance||[http://www.cyber.st.dhs.gov/docs/NCDI_FI_Workshop_Report.pdf ''Pdf''] [http://ncdi.nps.edu/FI_Workshop_Report_100204.pdf ''AltPdf'']
|-
|National Cyber Security Summit Task Force||||2004||[[Information Security Governance]]||Government Report||Moderate:Executive Administration||[http://www.cyber.st.dhs.gov/docs/Information%20Security%20Governance-%20A%20Call%20to%20Action%20(2004).pdf ''Pdf'']
|-
|National Infrastructure Advisory Council||||2004||[[Hardening The Internet]]||Government Report||High:Technology||[http://www.cyber.st.dhs.gov/docs/NIAC%20Internet%20Hardening.pdf ''Pdf''] [http://www.dhs.gov/xlibrary/assets/niac/NIAC_HardeningInternetPaper_Jan05.pdf ''AltPdf'']
|-
|National Institute of Standards and Technology||||2006||[[SP 800-82: Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security]]||Government Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/NIST%20Guide%20to%20Supervisory%20and%20Data%20Acquisition-SCADA%20and%20Industrial%20Control%20Systems%20Security%20(2007).pdf ''Pdf'']
|-
|National Cyber Security Summit Task Force||||2004||[[Information Security Governance]]||Government Report||Moderate:Executive Administration||[http://www.cyber.st.dhs.gov/docs/Information%20Security%20Governance-%20A%20Call%20to%20Action%20(2004).pdf ''Pdf''] [http://www.criminal-justice-careers.com/resources/InfoSecGov4_04.pdf ''AltPdf'']
|-
|National Science and Technology Council||||2006||[[Federal Plan for Cyber Security and Information Assurance Research and Development]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/Federal%20R&D%20Plan%202006.pdf ''Pdf'']
|-
|Networking and Information Technology Research and Development||||2009||[[National Cyber Leap Year Summit 2009, Co-Chairs' Report]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/National_Cyber_Leap_Year_Summit_2009_Co-Chairs_Report.pdf ''Pdf'']
|-
|President's Commission on Critical Infrastructure Protection||||1997||[[Critical Foundations]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PCCIP%20Report%201997.pdf ''Pdf'']
|-
|President's Information Technology Advisory Council||||2005||[[Cyber Security: A Crisis of Prioritization]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PITAC%20Report%202005.pdf ''Pdf'']
|-
|Verizon||||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|}

*'''''Subcategories:''''' ''None''

''[[Table of Contents| Jump to Table of Contents]]''

Issues

2010-09-21T14:33:45Z

WikiSysop:

''[[Table of Contents | TOC->]][[Issues]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Author 1
! style="background-color: #efefef;" | Author 2
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Anderson, Ross J.||||2008||[[Security Engineering]]||Book||Moderate:Technology; Moderate:Cryptography||N/A
|-
|Anderson, Ross, et. al|| ||2008||[[Security Economics and the Internal Market]]||Study||Low:Economics||[http://www.enisa.europa.eu/act/sr/reports/econ-sec/economics-sec/at_download/fullReport ''Pdf'']
|-
|Anderson, Ross||||2001||[[Why Information Security is Hard]]||Conf. Paper||None||[http://www.acsac.org/2001/papers/110.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rja14/Papers/econ.pdf ''AltPdf'']
|-
|Anderson, Ross||Moore, Tyler||2006||[[The Economics of Information Security]]||Journal Article||Low:Economics||[http://people.seas.harvard.edu/~tmoore/science-econ.pdf ''Pdf''] [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.89.3331&rep=rep1&type=pdf ''AltPdf'']
|-
|Arora et al.||||2006||[[Does Information Security Attack Frequency Increase With Vulnerability Disclosure]]||Journal Article||Moderate:Economics||[http://www.heinz.cmu.edu/~rtelang/vuln_freq_ISF.pdf ''Pdf'']
|-
|Aviram, Amitai||Tor, Avishalom||2004||[[Overcoming Impediments to Information Sharing]]||Law Review||Low:Economics||[http://law.haifa.ac.il/faculty/lec_papers/tor/55Ala1.L.Rev.231.pdf ''Pdf''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=435600 ''SSRN'']
|-
|Barkham, Jason||||2001||[[Information Warfare and International Law on the Use of Force]]||Law Review||Moderate:Law||[http://www1.law.nyu.edu/journals/jilp/issues/34/pdf/34_1_b.pdf ''Pdf''] [http://activeresponse.org/files/34_1_b.pdf ''Alt Pdf'']
|-
|Beard, Jack M.||||2009||[[Law and War in the Virtual Era]]||Law Review||Low:Law||[http://www.asil.org/ajil/July2009_1selectedpiece.pdf ''Pdf'']
|-
|Bohme, Rainer||||2005||[[Cyber-Insurance Revisited]]||Conf. Paper||High:Economics||[http://infosecon.net/workshop/pdf/15.pdf ''Pdf'']
|-
|Bohme, Rainer||Kataria, Gaurav||2006||[[Models and Measures for Correlation in Cyber-Insurance]]||Conf. Paper||High:Economics||[http://weis2006.econinfosec.org/docs/16.pdf ''Pdf'']
|-
|Bohme, Rainer||Schwartz, Galina||2010||[[Modeling Cyber-Insurance]]||Conf. Paper||High:Economics||[http://www1.inf.tu-dresden.de/~rb21/publications/BS2010_Modeling_Cyber-Insurance_WEIS.pdf ''Pdf'']
|-
|Brown, Davis||||2006||[[A Proposal for an International Convention To Regulate the Use of Information Systems in Armed Conflict]]||Law Review||Moderate:Law||[http://www.harvardilj.org/attach.php?id=59 ''Pdf'']
|-
|Camp, L. Jean||Lewis, Stephen||2004||[[Economics of Information Security]]||Book||High:Economics||N/A
|-
|Camp, L. Jean||Wolfram, Catherine||2004||[[Pricing Security]]||Book Chapter||Low:Economics||[http://books.google.com/books?id=PbzP9tgeDcAC&lpg=PA17&ots=8AOrvEojH5&dq=Economics%20of%20Information%20Security&lr&pg=PA17#v=onepage&q&f=false ''Web''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=894966 ''SSRN'']
|-
|Center for Strategic and International Studies||||2008||[[Securing Cyberspace for the 44th Presidency]]||Independent Report||Low:Policy||[http://www.cyber.st.dhs.gov/docs/081208_securingcyberspace_44.pdf ''Pdf'']
|-
|Clarke, Richard A.||Knake, Robert||2010||[[Cyber War]]||Book||None||N/A
|-
|Clinton, Larry||||Undated||[[Cyber-Insurance Metrics and Impact on Cyber-Security]]||Online Paper||Low:Technology; Low:Law||[http://www.whitehouse.gov/files/documents/cyber/ISA%20-%20Cyber-Insurance%20Metrics%20and%20Impact%20on%20Cyber-Security.pdf ''Pdf'']
|-
|Computer Economics, Inc.||||2007||[[2007 Malware Report]]||Industry Report||None||[http://www.computereconomics.com/article.cfm?id=1224 ''Purchase'']
|-
|Computing Research Association||||2003||[[Four Grand Challenges in Trustworthy Computing]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/CRA%20Grand%20Challenges%202003.pdf ''Pdf'']
|-
|Department of Commerce||||2010||[[Defense Industrial Base Assessment]]||Government Report||None||[http://www.bis.doc.gov/defenseindustrialbaseprograms/osies/defmarketresearchrpts/final_counterfeit_electronics_report.pdf ''Pdf'']
|-
|Department of Defense||||1999||[[An Assessment of International Legal Issues in Information Operations]]||Government Report||Moderate:Law||[http://www.au.af.mil/au/awc/awcgate/dod-io-legal/dod-io-legal.pdf '' Pdf'']
|-
|Department of Defense||||2005||[[Strategy for Homeland Defense and Civil Support]]||Government Report||None||[http://www.defense.gov/news/Jun2005/d20050630homeland.pdf ''Pdf'']
|-
|Department of Defense||||2007||[[Mission Impact of Foreign Influence on DoD Software]]||Government Report||Low:Defense Policy/Procurement||[http://www.cyber.st.dhs.gov/docs/Defense%20Science%20Board%20Task%20Force%20-%20Report%20on%20Mission%20Impact%20of%20Foreign%20Influence%20on%20DoD%20Software%20(2007).pdf ''Pdf'']
|-
|Department of Homeland Security||||2003||[[The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets]]||Government Report||None||[http://www.dhs.gov/xlibrary/assets/Physical_Strategy.pdf ''Pdf'']
|-
|Department of Homeland Security||||2009||[[A Roadmap for Cybersecurity Research]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/DHS-Cybersecurity-Roadmap.pdf ''Pdf'']
|-
|Deputy Chief of Staff for Intelligence||||2006||[[Critical Infrastructure Threats and Terrorism]]||Government Report||Low:Organizational Analysis; Low:Risk Management||[http://www.fas.org/irp/threat/terrorism/sup2.pdf ''Pdf'']
|-
|Dörmann, Knut||||2004||[[Applicability of the Additional Protocols to Computer Network Attacks]]||Independent Report||Low:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/68LG92/$File/ApplicabilityofIHLtoCNA.pdf ''Pdf'']
|-
|Dunlap, Charles J. Jr.||||2009||[[Towards a Cyberspace Legal Regime in the Twenty-First Century]]||Speech||None||N/A
|-
|Energetics Inc.||||2006||[[Roadmap to Secure Control Systems in the Energy Sector]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/DOE%20Roadmap%202006.pdf ''Pdf'']
|-
|Epstein, Richard A.||Brown, Thomas P.||2008||[[Cybersecurity in the Payment Card Industry]]||Law Review||Low:Law; Low:Economics||[http://lawreview.uchicago.edu/issues/archive/v75/75_1/EpsteinArticle.pdf ''Pdf'']
|-
|Financial Services Sector Coordinating Council for Critical Infrastructure Protection||||2008||[[Research Agenda for the Banking and Finance Sector]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/RD_Agenda-FINAL.pdf ''Pdf'']
|-
|Franklin, Jason, et. al||||2007||[[An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants]]||Conf. Paper||Low:Statistics; Low:Economics||[http://sparrow.ece.cmu.edu/group/pub/franklin_paxson_perrig_savage_miscreants.pdf ''Pdf''] [http://www.cs.cmu.edu/~jfrankli/acmccs07/ccs07_franklin_eCrime.pdf ''Alt Pdf'']
|-
|Gandal, Neil||||2008||[[An Introduction to Key Themes in the Economics of Cyber Security]]||Book Chapter||Low:Economics||[http://www.tau.ac.il/~gandal/security%20encyclopedia%20entry.pdf ''Pdf'']
|-
|Grady, Mark F.||Parisi, Francesco||2006||[[The Law and Economics of Cybersecurity]]||Book||Low:Economics; Low:Law||N/A
|-
|Granick, Jennifer Stisa||||2005||[[The Price of Restricting Vulnerability Publications]]||Law Review||Low/Moderate:Law||[http://www.ijclp.net/files/ijclp_web-doc_10-cy-2004.pdf ''Pdf'']
|-
|Hollis, Duncan B.||||2007||[[Why States Need an International Law for Information Operations]]||Law Review||Moderate:Law||[http://legacy.lclark.edu/org/lclr/objects/LCB_11_4_Art7_Hollis.pdf ''Pdf'']
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|Institute for Information Infrastructure Protection||||2003||[[Cyber Security Research and Development Agenda]]||Independent Report||Low/None:Technology||[http://www.cyber.st.dhs.gov/docs/I3P%20Research%20Agenda%202003.pdf ''Pdf'']
|-
|Johnson, Eric M.||||2008||[[Managing Information Risk and the Economics of Security]]||Book||High:Economics||N/A
|-
|Johnson, Vincent R.||||2005||[[Cybersecurity, Identity Theft, and the Limits of Tort Liability]]||Law Review||Moderate:Law||[http://www.stmarytx.edu/law/pdf/Johnsoncyber.pdf ''Pdf''] [http://law.bepress.com/cgi/viewcontent.cgi?article=3530&context=expresso ''AltPdf'']
|-
|Kobayashi, Bruce H.|| ||2006||[[An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods]]||Journal Article ||High:Economics||[http://www.law.gmu.edu/assets/files/publications/working_papers/05-11.pdf ''Pdf'']
|-
|Korns, Stephen W.|| ||2009||[[Cyber Operations]]||Journal Article||Low:International Warfare||[http://www.carlisle.army.mil/DIME/documents/Cyber%20Operations%20-%20The%20New%20Balance%20-%20Korns.pdf ''Pdf'']
|-
|Kramer, Franklin D., et. al||||2009||[[Cyberpower and National Security]]||Book||None||N/A
|-
|Lernard, Thomas M.||Rubin, Paul H.||2005||[[An Economic Analysis of Notification Requirements for Data Security Breaches]]||Online Paper||Low:Economics||[http://www.pff.org/issues-pubs/pops/pop12.12datasecurity.pdf ''Pdf'']
|-
|Lernard, Thomas M.||Rubin, Paul H.||2006||[[Much Ado About Notification]]||Journal Article||Low:Economics||[http://www.cato.org/pubs/regulation/regv29n1/v29n1-5.pdf ''Pdf''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=898208# ''SSRN'']
|-
|McAfee, Inc.||||2010||[[McAfee Threats Report]]||Industry Report||None||[http://www.mcafee.com/us/local_content/reports/2010q1_threats_report.pdf ''Pdf'']
|-
|Moore, Tyler, et. al||||2009||[[The Economics of Online Crime]]||Journal Article||Low:Technology||[http://people.seas.harvard.edu/~tmoore/jep09.pdf ''Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2007||[[Examining the Impact of Website Take-down on Phishing]]||Conf. Paper||Low:Technology||[http://www.ecrimeresearch.org/2007/proceedings/p1_moore.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime07.pdf ''Alt Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2008||[[The Consequence of Non-Cooperation in the Fight Against Phishing]]||Conf. Paper||Low:Technology; Low:Economics||[http://people.seas.harvard.edu/~tmoore/ecrime08.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime08pre.pdf ''Alt Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2009||[[The Impact of Incentives on Notice and Take-down]]||Book Chapter||Moderate:Technology; Low:Law||[http://weis2008.econinfosec.org/papers/MooreImpact.pdf ''Pdf'']
|-
|National Cyber Defense Initiative||||2009||[[National Cyber Defense Financial Services Workshop Report]]||Independent Report||Moderate:Financial Services Infrastructure; Moderate:Acronym Tolerance||[http://www.cyber.st.dhs.gov/docs/NCDI_FI_Workshop_Report.pdf ''Pdf'']
|-
|National Cyber Security Summit Task Force||||2004||[[Information Security Governance]]||Government Report||Moderate:Executive Administration||[http://www.cyber.st.dhs.gov/docs/Information%20Security%20Governance-%20A%20Call%20to%20Action%20(2004).pdf ''Pdf'']
|-
|National Infrastructure Advisory Council||||2004||[[Hardening The Internet]]||Government Report||High:Technology||[http://www.cyber.st.dhs.gov/docs/NIAC%20Internet%20Hardening.pdf ''Pdf'']
|-
|National Institute of Standards and Technology||||2006||[[SP 800-82: Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security]]||Government Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/NIST%20Guide%20to%20Supervisory%20and%20Data%20Acquisition-SCADA%20and%20Industrial%20Control%20Systems%20Security%20(2007).pdf ''Pdf'']
|-
|National Research Council||||1999||[[Trust in Cyberspace]]||Independent Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/Trust%20in%20Cyberspace%20Report%201999.pdf ''Pdf'']
|-
|National Research Council||||2007||[[Toward a Safer and More Secure Cyberspace]]||Independent Report||Low:Research Processes; Low:Technology||[http://www.cyber.st.dhs.gov/docs/Toward_a_Safer_and_More_Secure_Cyberspace-Full_report.pdf ''Pdf'']
|-
|National Science and Technology Council||||2006||[[Federal Plan for Cyber Security and Information Assurance Research and Development]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/Federal%20R&D%20Plan%202006.pdf ''Pdf'']
|-
|Networking and Information Technology Research and Development||||2009||[[National Cyber Leap Year Summit 2009, Co-Chairs' Report]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/National_Cyber_Leap_Year_Summit_2009_Co-Chairs_Report.pdf ''Pdf'']
|-
|Nye, Joseph||||2010||[[Cyber Power]]||Book Chapter||Low:Technology; Low:Policy||[http://belfercenter.ksg.harvard.edu/files/cyber-power.pdf ''Pdf'']
|-
|Powell, Benjamin||||2005||[[Is Cybersecurity a Public Good]]||Law Review||Low/Moderate:Economics||[http://www.independent.org/pdf/working_papers/57_cyber.pdf ''Pdf''] [http://www.ciaonet.org/wps/pob03/pob03.pdf ''AltPdf'']
|-
|President's Commission on Critical Infrastructure Protection||||1997||[[Critical Foundations]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PCCIP%20Report%201997.pdf ''Pdf'']
|-
|President's Information Technology Advisory Council||||2005||[[Cyber Security: A Crisis of Prioritization]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PITAC%20Report%202005.pdf ''Pdf'']
|-
|Romanosky et al.||||2008||[[Do Data Breach Disclosure Laws Reduce Identity Theft]]||Conf. Paper||Moderate:Economics||[http://weis2008.econinfosec.org/papers/Romanosky.pdf ''Pdf'']
|-
|Rotenberg et. al.||||2010||[[The Cyber War Threat Has Been Grossly Exaggerated]]||Debate||None||[http://intelligencesquaredus.org/index.php/past-debates/cyber-war-threat-has-been-grossly-exaggerated/ ''Audio/Transcript'']
|-
|Schmitt, Michael N., et. al||||2004||[[Computers and War]]||Conf. Paper||Moderate:Law||[http://www.ihlresearch.org/ihl/pdfs/schmittetal.pdf ''Pdf'']
|-
|Schmitt, Michael N.||||1999||[[Computer Network Attack and the Use of Force in International Law]]||Law Review||High:Law||[http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA471993&Location=U2&doc=GetTRDoc.pdf ''Pdf'']
|-
|Schmitt, Michael N.||||2002||[[Wired Warfare]]||Journal Article||Moderate:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/5C5D5C/$File/365_400_Schmitt.pdf ''Pdf'']
|-
|Schneier, Bruce||||2003||[[Beyond Fear]]||Book||None||[http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 ''Scribd'']
|-
|Schneier, Bruce||||2008||[[Schneier on Security]]||Book||None||[http://www.schneier.com/book-sos.html ''Purchase'']
|-
|Schwartz, Paul||Janger, Edward||2007||[[Notification of Data Security Breaches]]||Law Review||Low:Law; Low:Economics||[http://www.michiganlawreview.org/assets/pdfs/105/5/schwartz.pdf ''Pdf'']
|-
|Sklerov, Matthew J.|| ||2009||[[Solving the Dilemma of State Responses to Cyberattacks]]||Law Review||Moderate:Law; Low:Technology||[http://www.loc.gov/rr/frd/Military_Law/Military_Law_Review/pdf-files/201-fall-2009.pdf ''Pdf'']
|-
|Stohl, Michael||||2006||[[Cyber Terrorism]]||Journal Article||None||[http://www.ingentaconnect.com/content/klu/cris/2006/00000046/F0020004/00009061 ''Purchase'']
|-
|Swire, Peter P.||||2004||[[A Model for When Disclosure Helps Security]]||Law Review||Low/Moderate:Logic||[http://www.rootsecure.net/content/downloads/pdf/disclosure_helps_security.pdf ''Pdf''][http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 ''SSRN'']
|-
|Swire, Peter P.||||2006||[[A Theory of Disclosure for Security and Competitive Reasons]]||Law Review||Low/Moderate:Logic||[http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']
|-
|Symantec Corporation||||2010||[[Symantec Global Internet Security Threat Report]]||Industry Report||Low/Moderate:Technology||[http://www4.symantec.com/Vrt/wl?tu_id=SUKX1271711282503126202 ''Pdf'']
|-
|Telang, Rahul||Wattal, Sunil||2007||[[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors]]||Journal Article||Moderate:Economics||[http://infosecon.net/workshop/pdf/telang_wattal.pdf ''Pdf'']
|-
|Thomas, Rob||Martin, Jerry||2006||[[The Underground Economy]]||Journal Article||Low:Technology||[http://www.usenix.org/publications/login/2006-12/openpdfs/cymru.pdf ''Pdf'']
|-
|Todd, Graham H.|| ||2009||[[Armed Attack in Cyberspace]]||Law Review||Moderate:Law||[http://www.afjag.af.mil/shared/media/document/AFD-091026-024.pdf ''Pdf'']
|-
|Trend Micro Incorporated||||2010||[[Trend Micro Annual Report]]||Industry Report||Moderate:Technology||[http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/2009s_most_persistent_malware_threats__march_2010_.pdf ''Pdf'']
|-
|United States Secret Service||||2004||[[Insider Threat Study]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/its_report_040820.pdf ''Pdf'']
|-
|van Eeten, Michel J. G.||Bauer, Johannes M.||2008||[[Economics of Malware]]||Non-US Govt. Report||Moderate:Economics||[http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Pdf'']
|-
|Varian, Hal||||2000||[[Managing Online Security Risks]]||Newspaper Article||None||[http://people.ischool.berkeley.edu/~hal/people/hal/NYTimes/2000-06-01.html ''Web'']
|-
|Varian, Hal||||2004||[[System Reliability and Free Riding]]||Book Chapter||High:Economics||[http://www.sims.berkeley.edu/resources/affiliates/workshops/econsecurity/econws/48-old.pdf ''Pdf''] [http://people.ischool.berkeley.edu/~hal/Papers/2004/reliability ''AltPdf'']
|-
|Verizon||||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|-
|Watts, Sean|| ||2010||[[Combatant Status and Computer Network Attack]]||Law Review||Moderate:Law||[http://www.vjil.org/wp-content/uploads/2010/01/VJIL-50.2-Watts.pdf ''Pdf'']
|-
|White House||||2009||[[Cyberspace Policy Review]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/Cyberspace_Policy_Review_final.pdf ''Pdf'']
|-
|White House||||2003||[[The National Strategy to Secure Cyberspace]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/National%20Strategy%20to%20Secure%20Cyberspace%202003.pdf ''Pdf'']
|-
|Zittrain, Jonathan L.||||2008||[[The Future of the Internet and How To Stop It]]||Book||None||[http://futureoftheinternet.org/static/ZittrainTheFutureoftheInternet.pdf ''Pdf'']
|}

'''''Subcategories:'''''
*''[[Issues | Issues->]][[Metrics]]''
*''[[Issues | Issues->]][[Economics of Cybersecurity | Economics of Cybersecurity->]][[Risk Management and Investment]]''
*''[[Issues | Issues->]][[Economics of Cybersecurity | Economics of Cybersecurity->]][[Incentives]]''
*''[[Issues | Issues->]][[Economics of Cybersecurity | Economics of Cybersecurity->]][[Insurance]]''
*''[[Issues | Issues->]][[Economics of Cybersecurity | Economics of Cybersecurity->]][[Behavioral Economics]]''
*''[[Issues | Issues->]][[Economics of Cybersecurity | Economics of Cybersecurity->]][[Market Failure]]''
*''[[Issues | Issues->]][[Supply Chain Issues]]''
*''[[Issues | Issues->]][[Usability/Human Factors]]''
*''[[Issues | Issues->]][[Psychology and Politics]]''
*''[[Issues | Issues->]][[Information Sharing/Disclosure]]''
*''[[Issues | Issues->]][[Public-Private Cooperation]]''
*''[[Issues | Issues->]][[Attribution]]''
*''[[Issues | Issues->]][[Identity Management]]''
*''[[Issues | Issues->]][[Privacy]]''
*''[[Issues | Issues->]][[Cybercrime]]''
*''[[Issues | Issues->]][[Cyberwar]]''
*''[[Issues | Issues->]][[Espionage | Espionage->]][[Government to Government]]''
*''[[Issues | Issues->]][[Espionage | Espionage->]][[Industrial]]''
*''[[Issues | Issues->]][[Espionage | Espionage->]][[Media Perceptions]]''

''[[Table of Contents| Jump to Table of Contents]]''

Cybercrime

2010-09-21T14:33:31Z

WikiSysop:

''[[Table of Contents | TOC->]][[Issues | Issues->]][[Cybercrime]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Author 1
! style="background-color: #efefef;" | Author 2
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Anderson, Ross J.||||2008||[[Security Engineering]]||Book||Moderate:Technology; Moderate:Cryptography||N/A
|-
|Anderson, Ross, et. al|| ||2008||[[Security Economics and the Internal Market]]||Study||Low:Economics||[http://www.enisa.europa.eu/act/sr/reports/econ-sec/economics-sec/at_download/fullReport ''Pdf'']
|-
|Deputy Chief of Staff for Intelligence||||2006||[[Critical Infrastructure Threats and Terrorism]]||Government Report||Low:Organizational Analysis; Low:Risk Management||[http://www.fas.org/irp/threat/terrorism/sup2.pdf ''Pdf'']
|-
|Epstein, Richard A.||Brown, Thomas P.||2008||[[Cybersecurity in the Payment Card Industry]]||Law Review||Low:Law; Low:Economics||[http://lawreview.uchicago.edu/issues/archive/v75/75_1/EpsteinArticle.pdf ''Pdf'']
|-
|Franklin, Jason, et. al||||2007||[[An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants]]||Conf. Paper||Low:Statistics; Low:Economics||[http://sparrow.ece.cmu.edu/group/pub/franklin_paxson_perrig_savage_miscreants.pdf ''Pdf''] [http://www.cs.cmu.edu/~jfrankli/acmccs07/ccs07_franklin_eCrime.pdf ''Alt Pdf'']
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|Johnson, Eric M.||||2008||[[Managing Information Risk and the Economics of Security]]||Book||High:Economics||N/A
|-
|Kramer, Franklin D., et. al||||2009||[[Cyberpower and National Security]]||Book||None||N/A
|-
|McAfee, Inc.||||2010||[[McAfee Threats Report]]||Industry Report||None||[http://www.mcafee.com/us/local_content/reports/2010q1_threats_report.pdf ''Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2007||[[Examining the Impact of Website Take-down on Phishing]]||Conf. Paper||Low:Technology||[http://www.ecrimeresearch.org/2007/proceedings/p1_moore.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime07.pdf ''Alt Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2008||[[The Consequence of Non-Cooperation in the Fight Against Phishing]]||Conf. Paper||Low:Technology; Low:Economics||[http://people.seas.harvard.edu/~tmoore/ecrime08.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime08pre.pdf ''Alt Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2009||[[The Impact of Incentives on Notice and Take-down]]||Book Chapter||Moderate:Technology; Low:Law||[http://weis2008.econinfosec.org/papers/MooreImpact.pdf ''Pdf'']
|-
|Moore, Tyler, et. al||||2009||[[The Economics of Online Crime]]||Journal Article||Low:Technology||[http://people.seas.harvard.edu/~tmoore/jep09.pdf ''Pdf'']
|-
|National Research Council||||2007||[[Toward a Safer and More Secure Cyberspace]]||Independent Report||Low:Research Processes; Low:Technology||[http://www.cyber.st.dhs.gov/docs/Toward_a_Safer_and_More_Secure_Cyberspace-Full_report.pdf ''Pdf'']
|-
|Symantec Corporation||||2010||[[Symantec Global Internet Security Threat Report]]||Industry Report||Low/Moderate:Technology||[http://www4.symantec.com/Vrt/wl?tu_id=SUKX1271711282503126202 ''Pdf'']
|-
|Thomas, Rob||Martin, Jerry||2006||[[The Underground Economy]]||Journal Article||Low:Technology||[http://www.usenix.org/publications/login/2006-12/openpdfs/cymru.pdf ''Pdf'']
|-
|Trend Micro Incorporated||||2010||[[Trend Micro Annual Report]]||Industry Report||Moderate:Technology||[http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/2009s_most_persistent_malware_threats__march_2010_.pdf ''Pdf'']
|-
|Verizon||||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|}

*'''''Subcategories:''''' ''None''

''[[Table of Contents| Jump to Table of Contents]]''

Resource by Type

2010-09-21T14:33:08Z

WikiSysop:

''[[Table of Contents | TOC->]][[Resource by Type]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Author 1
! style="background-color: #efefef;" | Author 2
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Anderson, Ross J.|| ||2008||[[Security Engineering]]||Book||Moderate:Technology; Moderate:Cryptography|| N/A
|-
|Camp, L. Jean || Lewis, Stephen||2004||[[Economics of Information Security]]||Book||High:Economics|| N/A
|-
|Center for Strategic and International Studies|| ||2008||[[Securing Cyberspace for the 44th Presidency]]||Independent Report||Low:Policy||[http://www.cyber.st.dhs.gov/docs/081208_securingcyberspace_44.pdf ''Pdf'']
|-
|Clarke, Richard A. || Knake, Robert ||2010||[[Cyber War]]||Book||None|| N/A
|-
|Computer Economics, Inc.|| ||2007||[[2007 Malware Report]]||Industry Report||None||[http://www.computereconomics.com/article.cfm?id=1224 ''Purchase'']
|-
|Computing Research Association|| ||2003||[[Four Grand Challenges in Trustworthy Computing]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/CRA%20Grand%20Challenges%202003.pdf ''Pdf'']
|-
|Department of Commerce|| ||2010||[[Defense Industrial Base Assessment]]||Government Report||None||[http://www.bis.doc.gov/defenseindustrialbaseprograms/osies/defmarketresearchrpts/final_counterfeit_electronics_report.pdf ''Pdf'']
|-
|Department of Defense||||1999||[[An Assessment of International Legal Issues in Information Operations]]||Government Report||Moderate:Law||[http://www.au.af.mil/au/awc/awcgate/dod-io-legal/dod-io-legal.pdf '' Pdf'']
|-
|Department of Defense|| ||2005||[[Strategy for Homeland Defense and Civil Support]]||Government Report||None||[http://www.defense.gov/news/Jun2005/d20050630homeland.pdf ''Pdf'']
|-
|Department of Defense|| ||2007||[[Mission Impact of Foreign Influence on DoD Software]]||Government Report||Low:Defense Policy/Procurement||[http://www.cyber.st.dhs.gov/docs/Defense%20Science%20Board%20Task%20Force%20-%20Report%20on%20Mission%20Impact%20of%20Foreign%20Influence%20on%20DoD%20Software%20(2007).pdf ''Pdf'']
|-
|Department of Homeland Security|| ||2003||[[The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets]]||Government Report||None||[http://www.dhs.gov/xlibrary/assets/Physical_Strategy.pdf ''Pdf'']
|-
|Department of Homeland Security|| ||2009||[[A Roadmap for Cybersecurity Research]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/DHS-Cybersecurity-Roadmap.pdf ''Pdf'']
|-
|Deputy Chief of Staff for Intelligence|| ||2006||[[Critical Infrastructure Threats and Terrorism]]||Government Report||Low:Organizational Analysis; Low:Risk Management||[http://www.fas.org/irp/threat/terrorism/sup2.pdf ''Pdf'']
|-
|Dörmann, Knut||||2004||[[Applicability of the Additional Protocols to Computer Network Attacks]]||Independent Report||Low:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/68LG92/$File/ApplicabilityofIHLtoCNA.pdf ''Pdf'']
|-
|Energetics Inc.|| ||2006||[[Roadmap to Secure Control Systems in the Energy Sector]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/DOE%20Roadmap%202006.pdf ''Pdf'']
|-
|Financial Services Sector Coordinating Council for Critical Infrastructure Protection|| ||2008||[[Research Agenda for the Banking and Finance Sector]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/RD_Agenda-FINAL.pdf ''Pdf'']
|-
|Grady, Mark F. || Parisi, Francesco ||2006||[[The Law and Economics of Cybersecurity]]||Book||Low:Economics; Low:Law|| N/A
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|Institute for Information Infrastructure Protection|| ||2003||[[Cyber Security Research and Development Agenda]]||Independent Report||Low/None:Technology||[http://www.cyber.st.dhs.gov/docs/I3P%20Research%20Agenda%202003.pdf ''Pdf'']
|-
|Johnson, Eric M. || || 2008 ||[[Managing Information Risk and the Economics of Security]]||Book||High:Economics|| N/A
|-
|Kramer, Franklin D., et. al || ||2009||[[Cyberpower and National Security]]||Book||None|| N/A
|-
|McAfee, Inc.|| ||2010||[[McAfee Threats Report]]||Industry Report||None||[http://www.mcafee.com/us/local_content/reports/2010q1_threats_report.pdf ''Pdf'']
|-
|National Cyber Defense Initiative|| ||2009||[[National Cyber Defense Financial Services Workshop Report]]||Independent Report||Moderate:Financial Services Infrastructure; Moderate:Acronym Tolerance||[http://www.cyber.st.dhs.gov/docs/NCDI_FI_Workshop_Report.pdf ''Pdf'']
|-
|National Cyber Security Summit Task Force|| ||2004||[[Information Security Governance]]||Government Report||Moderate:Executive Administration||[http://www.cyber.st.dhs.gov/docs/Information%20Security%20Governance-%20A%20Call%20to%20Action%20(2004).pdf ''Pdf'']
|-
|National Infrastructure Advisory Council|| ||2004||[[Hardening The Internet]]||Government Report||High:Technology||[http://www.cyber.st.dhs.gov/docs/NIAC%20Internet%20Hardening.pdf ''Pdf'']
|-
|National Institute of Standards and Technology|| ||2006||[[SP 800-82: Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security]]||Government Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/NIST%20Guide%20to%20Supervisory%20and%20Data%20Acquisition-SCADA%20and%20Industrial%20Control%20Systems%20Security%20(2007).pdf ''Pdf'']
|-
|National Research Council|| ||1999||[[Trust in Cyberspace]]||Independent Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/Trust%20in%20Cyberspace%20Report%201999.pdf ''Pdf'']
|-
|National Research Council|| ||2007||[[Toward a Safer and More Secure Cyberspace]]||Independent Report||Low:Research Processes; Low:Technology||[http://www.cyber.st.dhs.gov/docs/Toward_a_Safer_and_More_Secure_Cyberspace-Full_report.pdf ''Pdf'']
|-
|National Science and Technology Council|| ||2006||[[Federal Plan for Cyber Security and Information Assurance Research and Development]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/Federal%20R&D%20Plan%202006.pdf ''Pdf'']
|-
|Networking and Information Technology Research and Development|| ||2009||[[National Cyber Leap Year Summit 2009, Co-Chairs' Report]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/National_Cyber_Leap_Year_Summit_2009_Co-Chairs_Report.pdf ''Pdf'']
|-
|President's Commission on Critical Infrastructure Protection|| ||1997||[[Critical Foundations]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PCCIP%20Report%201997.pdf ''Pdf'']
|-
|President's Information Technology Advisory Council|| ||2005||[[Cyber Security: A Crisis of Prioritization]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PITAC%20Report%202005.pdf ''Pdf'']
|-
|Schneier, Bruce || ||2003||[[Beyond Fear]]||Book||None||[http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 ''Scribd'']
|-
|Schneier, Bruce || ||2008||[[Schneier on Security]]||Book||None||[http://www.schneier.com/book-sos.html ''Purchase'']
|-
|Symantec Corporation|| ||2010||[[Symantec Global Internet Security Threat Report]]||Industry Report||Low/Moderate:Technology||[http://www4.symantec.com/Vrt/wl?tu_id=SUKX1271711282503126202 ''Pdf'']
|-
|Trend Micro Incorporated|| ||2010||[[Trend Micro Annual Report]]||Industry Report||Moderate:Technology||[http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/2009s_most_persistent_malware_threats__march_2010_.pdf ''Pdf'']
|-
|United States Secret Service|| ||2004||[[Insider Threat Study]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/its_report_040820.pdf ''Pdf'']
|-
|van Eeten, Michel J. G.||Bauer, Johannes M.||2008||[[Economics of Malware]]||Non-US Govt. Report||Moderate:Economics||[http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Pdf'']
|-
|Verizon||||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|-
|White House|| ||2003||[[The National Strategy to Secure Cyberspace]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/National%20Strategy%20to%20Secure%20Cyberspace%202003.pdf ''Pdf'']
|-
|White House|| ||2010||[[The Comprehensive National Cybersecurity Initiative]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/CNCI-Cybersecurity.pdf ''Pdf'']
|-
|White House|| ||2009||[[Cyberspace Policy Review]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/Cyberspace_Policy_Review_final.pdf ''Pdf'']
|-
|Zittrain, Jonathan L.|| ||2008||[[The Future of the Internet and How To Stop It]]||Book||None||[http://futureoftheinternet.org/static/ZittrainTheFutureoftheInternet.pdf ''Pdf'']
|}

'''''Subcategories:'''''
*''[[Resource by Type | Resource by Type->]][[Government Reports and Documents | Government Reports and Documents->]][[US Government Reports and Documents]]''
*''[[Resource by Type | Resource by Type->]][[Government Reports and Documents | Government Reports and Documents->]][[Non-US Government Reports and Documents]]''
*''[[Resource by Type | Resource by Type->]][[Independent Report]]''
*''[[Resource by Type | Resource by Type->]][[Industry Reports]]''
*''[[Resource by Type | Resource by Type->]][[Books]]''

''[[Table of Contents | Jump to Table of Contents]]''

Industry Reports

2010-09-21T14:32:41Z

WikiSysop:

''[[Table of Contents | TOC->]][[Resource by Type | Resource by Type->]][[Industry Reports]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Organization
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Computer Economics, Inc.||2007||[[2007 Malware Report]]||Industry Report||None||[http://www.computereconomics.com/article.cfm?id=1224 ''Purchase'']
|-
|HP TippingPoint DVLabs||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|McAfee, Inc.||2010||[[McAfee Threats Report]]||Industry Report||None||[http://www.mcafee.com/us/local_content/reports/2010q1_threats_report.pdf ''Pdf'']
|-
|Symantec Corporation||2010||[[Symantec Global Internet Security Threat Report]]||Industry Report||Low/Moderate:Technology||[http://www4.symantec.com/Vrt/wl?tu_id=SUKX1271711282503126202 ''Pdf'']
|-
|Trend Micro Incorporated||2010||[[Trend Micro Annual Report]]||Industry Report||Moderate:Technology||[http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/2009s_most_persistent_malware_threats__march_2010_.pdf ''Pdf'']
|-
|Verizon||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|}

*'''''Subcategories:''''' ''None''

''[[Table of Contents | Jump to Table of Contents]]''

Industry Reports

2010-09-21T14:32:29Z

WikiSysop:

''[[Table of Contents | TOC->]][[Resource by Type | Resource by Type->]][[Industry Reports]]''

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Organization
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Computer Economics, Inc.||2007||[[2007 Malware Report]]||Industry Report||None||[http://www.computereconomics.com/article.cfm?id=1224 ''Purchase'']
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|McAfee, Inc.||2010||[[McAfee Threats Report]]||Industry Report||None||[http://www.mcafee.com/us/local_content/reports/2010q1_threats_report.pdf ''Pdf'']
|-
|Symantec Corporation||2010||[[Symantec Global Internet Security Threat Report]]||Industry Report||Low/Moderate:Technology||[http://www4.symantec.com/Vrt/wl?tu_id=SUKX1271711282503126202 ''Pdf'']
|-
|Trend Micro Incorporated||2010||[[Trend Micro Annual Report]]||Industry Report||Moderate:Technology||[http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/2009s_most_persistent_malware_threats__march_2010_.pdf ''Pdf'']
|-
|Verizon||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|}

*'''''Subcategories:''''' ''None''

''[[Table of Contents | Jump to Table of Contents]]''

2010 Top Cyber Security Risks Report

2010-09-21T14:31:42Z

WikiSysop: /* Categorization */

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]
* Approaches: [[Technology]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Phishing | Phishing]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Social_Engineering | Social Engineering]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

While the sections of the report which explain in detail how attackers hide exploits in seemingly innocuous code require some technical expertise, there is a very clear explanation of how such an exploit is downloaded and executed on a victim's computer within the corporate firewall that requires no special expertise to understand. ''See'' page 27.

2010 Top Cyber Security Risks Report

2010-09-21T14:30:45Z

WikiSysop: /* Additional Notes and Highlights */

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Phishing | Phishing]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Social_Engineering | Social Engineering]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

While the sections of the report which explain in detail how attackers hide exploits in seemingly innocuous code require some technical expertise, there is a very clear explanation of how such an exploit is downloaded and executed on a victim's computer within the corporate firewall that requires no special expertise to understand. ''See'' page 27.

2010 Top Cyber Security Risks Report

2010-09-21T14:30:19Z

WikiSysop: /* Additional Notes and Highlights */

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Phishing | Phishing]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Social_Engineering | Social Engineering]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

While the sections of the report which explain in detail how attackers hide exploits in seemingly innocuous code require some technical expertise, there is a very clear explanation of such an exploit is downloaded and executed on a victim's computer wihtin the corporate firewall that requires no special expertise to understand. ''See'' page 27.

2010 Top Cyber Security Risks Report

2010-09-21T14:27:38Z

WikiSysop: /* Attackers are more organized and sophisticated */

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Phishing | Phishing]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Social_Engineering | Social Engineering]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

2010 Top Cyber Security Risks Report

2010-09-21T14:27:26Z

WikiSysop: /* Synopsis */

==Full Title of Reference==
2010 Top Cyber Security Risks Report

==Full Citation==

HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs.tippingpoint.com/toprisks2010 ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special:Bibliography&view=detailed&action=&keyword=hptippingpoint:2010 ''BibTeX'']

==Categorization==
* Resource by Type: [[Industry Reports]]
* Issues: [[Cybercrime]]

==Key Words==
[[Keyword_Index_and_Glossary_of_Core_Ideas#Antivirus | Antivirus]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime | Cyber Crime]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Malware | Malware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Patching | Patching]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Phishing | Phishing]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Social_Engineering | Social Engineering]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#SPAM | SPAM]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Trojan | Trojan]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Worm | Worm]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit | Zero-Day Exploit]]

==Synopsis==

In 2010, information security threats are striking networks with more sophisticated techniques than ever and exploit reports continue to dominate the media. The collective findings described within this report establish the fact that the proliferation of technology, along with the quick and effortless manner in which that technology is accessed, is dramatically and negatively impacting security. While we are not advocates for making technology more difficult, we do advocate implementing common sense security policies and technologies that battle well-known and new threats. This report evaluates some of the most significant security liabilities that the enterprise is facing today. The report focuses on four key areas:
* Increased Consumerization of Enterprise Computing
* Prolonged and Persistent Targeting of Web Applications
* Increased Organization and Sophistication of Attackers
* The Unrelenting Presence of Legacy Threats
In addition to explaining how and where the enterprise is vulnerable, the report provides insights into how organizations can protect themselves
from attack, including what the next generation of computing should look like to maximize security for the corporate network.

===Increased Consumerization of Enterprise Computing===
Some of the most serious information security issues
the research team has seen this year stem from the
increasingly high use of consumer technologies within
the enterprise. For example, there are several thousand
organizations that utilize Facebook, Twitter, WordPress,
and iTunes for promotion and brand awareness. While
these technologies may offer a wealth of marketing
recognition, they also open the door to a multitude
of security risks. Another trend impacting enterprise
IT department is an “anything goes” mentality that
allows users to download and manage applications
and programs of their choosing. While some of
these applications may be fine, and may even boost
productivity, an overwhelming majority of them are a
significant liability to corporate networks.
===Web Applications continue to be highly attractive targets===
The team highlighted the risks of running Web
applications in last year’s Threat Report. Our current
research indicates that Web applications continue to
pose one of the biggest risks to corporate networks.
Web applications offer an easy way for organizations
to create an interactive relationship between
constituents such as customers, employees, and
partners, and their back-end systems. Because Web
application systems are relatively easy to build and
offer inexpensive extensibility, they yield a great deal of
value and functionality. Because of this, the number of
Web applications continues to steadily grow.
===Attackers are more organized and sophisticated===
One of the more alarming trends observed in the
previous six months is the increased sophistication
of attacks. Attackers have not only become more
organized, they are also increasingly subversive and
inconspicuous in the way they execute their attacks.
The attacks are so sophisticated and subtle that few
victims realize they are under attack until it is too late. It
is increasingly common to hear of attackers remaining
inside a compromised organization for months,
gathering information with which they design and build
even more sophisticated attacks. Once the desired
information is obtained, the attackers launch exploits
that are both more devastating and more covert.

Attack sophistication has increased across the board,
from client side-attacks such as malicious JavaScript,
to server-side attacks like PHP file include. This report
includes examples of real-world attack techniques
employed by these increasingly sophisticated attackers

===Legacy attacks still a threat===
Despite the rising sophistication of attacks, it is still
worth highlighting that over the sample period of this
report, the number of attacks from well-known legacy
threats continues to plague computer systems. While
many of these attacks are well understood and well
protected against, it is not unheard of to see large
organizations as the source of some of these attacks,
indicating that when large organizations implement
new systems without threat management controls,
the systems are quickly infected with familiar threats.
While this is an extreme example, it highlights the
need for continued diligence against well-known
threats, ideally addressing them with strong patch and
configuration management policies.

==Additional Notes and Highlights==

Expertise Required: Technology - Moderate

2010 Top Cyber Security Risks Report

2010-09-21T14:25:42Z

WikiSysop: /* Synopsis */

2010 Top Cyber Security Risks Report

2010-09-21T14:24:34Z

WikiSysop: /* Additional Notes and Highlights */

2010 Top Cyber Security Risks Report

2010-09-21T14:24:05Z

WikiSysop:

2010 Top Cyber Security Risks Report

2010-09-21T14:19:58Z

WikiSysop: New page: ==Full Title of Reference== 2010 Top Cyber Security Risks Report ==Full Citation== HP TippingPoint DVLabs, ''2010 Top Cyber Security Risks Reports'' (2010). Online Paper. [http://dvlabs...

Cybersecurity Annotated Bibliography

2010-09-21T14:17:32Z

WikiSysop:

{| class="wikitable sortable" border="1" cellpadding="1" cellspacing="0" style="border: 1px solid LightGrey;"
|-
! style="background-color: #efefef;" | Author 1
! style="background-color: #efefef;" | Author 2
! style="background-color: #efefef;" | Year
! style="background-color: #efefef;" | Title
! style="background-color: #efefef;" | Source
! style="background-color: #efefef;" | Expertise
! style="background-color: #efefef;" class="unsortable" | Full Text
|-
|Anderson, Ross J.||||2008||[[Security Engineering]]||Book||Moderate:Technology; Moderate:Cryptography||N/A
|-
|Anderson, Ross, et. al|| ||2008||[[Security Economics and the Internal Market]]||Study||Low:Economics||[http://www.enisa.europa.eu/act/sr/reports/econ-sec/economics-sec/at_download/fullReport ''Pdf'']
|-
|Anderson, Ross||||2001||[[Why Information Security is Hard]]||Conf. Paper||None||[http://www.acsac.org/2001/papers/110.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rja14/Papers/econ.pdf ''AltPdf'']
|-
|Anderson, Ross||Moore, Tyler||2006||[[The Economics of Information Security]]||Journal Article||Low:Economics||[http://people.seas.harvard.edu/~tmoore/science-econ.pdf ''Pdf''] [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.89.3331&rep=rep1&type=pdf ''AltPdf'']
|-
|Arora et al.||||2006||[[Does Information Security Attack Frequency Increase With Vulnerability Disclosure]]||Journal Article||Moderate:Economics||[http://www.heinz.cmu.edu/~rtelang/vuln_freq_ISF.pdf ''Pdf'']
|-
|Aviram, Amitai||Tor, Avishalom||2004||[[Overcoming Impediments to Information Sharing]]||Law Review||Low:Economics||[http://law.haifa.ac.il/faculty/lec_papers/tor/55Ala1.L.Rev.231.pdf ''Pdf''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=435600 ''SSRN'']
|-
|Barkham, Jason||||2001||[[Information Warfare and International Law on the Use of Force]]||Law Review||Moderate:Law||[http://www1.law.nyu.edu/journals/jilp/issues/34/pdf/34_1_b.pdf ''Pdf''] [http://activeresponse.org/files/34_1_b.pdf ''Alt Pdf'']
|-
|Beard, Jack M.||||2009||[[Law and War in the Virtual Era]]||Law Review||Low:Law||[http://www.asil.org/ajil/July2009_1selectedpiece.pdf ''Pdf'']
|-
|Bohme, Rainer||||2005||[[Cyber-Insurance Revisited]]||Conf. Paper||High:Economics||[http://infosecon.net/workshop/pdf/15.pdf ''Pdf'']
|-
|Bohme, Rainer||Kataria, Gaurav||2006||[[Models and Measures for Correlation in Cyber-Insurance]]||Conf. Paper||High:Economics||[http://weis2006.econinfosec.org/docs/16.pdf ''Pdf'']
|-
|Bohme, Rainer||Schwartz, Galina||2010||[[Modeling Cyber-Insurance]]||Conf. Paper||High:Economics||[http://www1.inf.tu-dresden.de/~rb21/publications/BS2010_Modeling_Cyber-Insurance_WEIS.pdf ''Pdf'']
|-
|Brown, Davis||||2006||[[A Proposal for an International Convention To Regulate the Use of Information Systems in Armed Conflict]]||Law Review||Moderate:Law||[http://www.harvardilj.org/attach.php?id=59 ''Pdf'']
|-
|Camp, L. Jean|| Lewis, Stephen||2004||[[Economics of Information Security]]||Book||High:Economics|| N/A
|-
|Camp, L. Jean||Wolfram, Catherine||2004||[[Pricing Security]]||Book Chapter||Low:Economics||[http://books.google.com/books?id=PbzP9tgeDcAC&lpg=PA17&ots=8AOrvEojH5&dq=Economics%20of%20Information%20Security&lr&pg=PA17#v=onepage&q&f=false ''Web''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=894966 ''SSRN'']
|-
|Center for Strategic and International Studies|| ||2008||[[Securing Cyberspace for the 44th Presidency]]||Independent Report||Low:Policy||[http://www.cyber.st.dhs.gov/docs/081208_securingcyberspace_44.pdf ''Pdf'']
|-
|Clarke, Richard A.||Knake, Robert||2010||[[Cyber War]]||Book||None||N/A
|-
|Clinton, Larry||||Undated||[[Cyber-Insurance Metrics and Impact on Cyber-Security]]||Online Paper||Low:Technology; Low:Law||[http://www.whitehouse.gov/files/documents/cyber/ISA%20-%20Cyber-Insurance%20Metrics%20and%20Impact%20on%20Cyber-Security.pdf ''Pdf'']
|-
|Computer Economics, Inc.||||2007||[[2007 Malware Report]]||Industry Report||None||[http://www.computereconomics.com/article.cfm?id=1224 ''Purchase'']
|-
|Computing Research Association||||2003||[[Four Grand Challenges in Trustworthy Computing]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/CRA%20Grand%20Challenges%202003.pdf ''Pdf'']
|-
|Department of Commerce||||2010||[[Defense Industrial Base Assessment]]||Government Report||None||[http://www.bis.doc.gov/defenseindustrialbaseprograms/osies/defmarketresearchrpts/final_counterfeit_electronics_report.pdf ''Pdf'']
|-
|Department of Defense||||1999||[[An Assessment of International Legal Issues in Information Operations]]||Government Report||Moderate:Law||[http://www.au.af.mil/au/awc/awcgate/dod-io-legal/dod-io-legal.pdf '' Pdf'']
|-
|Department of Defense||||2005||[[Strategy for Homeland Defense and Civil Support]]||Government Report||None||[http://www.defense.gov/news/Jun2005/d20050630homeland.pdf ''Pdf'']
|-
|Department of Defense||||2007||[[Mission Impact of Foreign Influence on DoD Software]]||Government Report||Low:Defense Policy/Procurement||[http://www.cyber.st.dhs.gov/docs/Defense%20Science%20Board%20Task%20Force%20-%20Report%20on%20Mission%20Impact%20of%20Foreign%20Influence%20on%20DoD%20Software%20(2007).pdf ''Pdf'']
|-
|Department of Homeland Security||||2003||[[The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets]]||Government Report||None||[http://www.dhs.gov/xlibrary/assets/Physical_Strategy.pdf ''Pdf'']
|-
|Department of Homeland Security||||2009||[[A Roadmap for Cybersecurity Research]]||Government Report||Low:Technology||[http://www.cyber.st.dhs.gov/docs/DHS-Cybersecurity-Roadmap.pdf ''Pdf'']
|-
|Deputy Chief of Staff for Intelligence||||2006||[[Critical Infrastructure Threats and Terrorism]]||Government Report||Low:Organizational Analysis; Low:Risk Management||[http://www.fas.org/irp/threat/terrorism/sup2.pdf ''Pdf'']
|-
|Dörmann, Knut||||2004||[[Applicability of the Additional Protocols to Computer Network Attacks]]||Independent Report||Low:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/68LG92/$File/ApplicabilityofIHLtoCNA.pdf ''Pdf'']
|-
|Dunlap, Charles J. Jr.||||2009||[[Towards a Cyberspace Legal Regime in the Twenty-First Century]]||Speech||None||N/A
|-
|Energetics Inc.||||2006||[[Roadmap to Secure Control Systems in the Energy Sector]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/DOE%20Roadmap%202006.pdf ''Pdf'']
|-
|Epstein, Richard A.||Brown, Thomas P.||2008||[[Cybersecurity in the Payment Card Industry]]||Law Review||Low:Law; Low:Economics||[http://lawreview.uchicago.edu/issues/archive/v75/75_1/EpsteinArticle.pdf ''Pdf'']
|-
|Financial Services Sector Coordinating Council for Critical Infrastructure Protection||||2008||[[Research Agenda for the Banking and Finance Sector]]||Independent Report||None||[http://www.cyber.st.dhs.gov/docs/RD_Agenda-FINAL.pdf ''Pdf'']
|-
|Franklin, Jason, et. al||||2007||[[An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants]]||Conf. Paper||Low:Statistics; Low:Economics||[http://sparrow.ece.cmu.edu/group/pub/franklin_paxson_perrig_savage_miscreants.pdf ''Pdf''] [http://www.cs.cmu.edu/~jfrankli/acmccs07/ccs07_franklin_eCrime.pdf ''Alt Pdf'']
|-
|Gandal, Neil||||2008||[[An Introduction to Key Themes in the Economics of Cyber Security]]||Book Chapter||Low:Economics||[http://www.tau.ac.il/~gandal/security%20encyclopedia%20entry.pdf ''Pdf'']
|-
|Grady, Mark F.||Parisi, Francesco||2006||[[The Law and Economics of Cybersecurity]]||Book||Low:Economics; Low:Law||N/A
|-
|Granick, Jennifer Stisa||||2005||[[The Price of Restricting Vulnerability Publications]]||Law Review||Low/Moderate:Law||[http://www.ijclp.net/files/ijclp_web-doc_10-cy-2004.pdf ''Pdf'']
|-
|Hollis, Duncan B.||||2007||[[Why States Need an International Law for Information Operations]]||Law Review||Moderate:Law||[http://legacy.lclark.edu/org/lclr/objects/LCB_11_4_Art7_Hollis.pdf ''Pdf'']
|-
|HP TippingPoint DVLabs||||2010||[[2010 Top Cyber Security Risks Report]]||Industry report||Moderate:Technology||[http://dvlabs.tippingpoint.com/toprisks2010 ''Pdf'']
|-
|Institute for Information Infrastructure Protection|| ||2003||[[Cyber Security Research and Development Agenda]]||Independent Report||Low/None:Technology||[http://www.cyber.st.dhs.gov/docs/I3P%20Research%20Agenda%202003.pdf ''Pdf'']
|-
|Johnson, Eric M.||||2008||[[Managing Information Risk and the Economics of Security]]||Book||High:Economics||N/A
|-
|Johnson, Vincent R.||||2005||[[Cybersecurity, Identity Theft, and the Limits of Tort Liability]]||Law Review||Moderate:Law||[http://www.stmarytx.edu/law/pdf/Johnsoncyber.pdf ''Pdf''] [http://law.bepress.com/cgi/viewcontent.cgi?article=3530&context=expresso ''AltPdf'']
|-
|Kobayashi, Bruce H.|| ||2006||[[An Economic Analysis of the Private and Social Costs of the Provision of Cybersecurity and Other Public Security Goods]]||Journal Article ||High:Economics||[http://www.law.gmu.edu/assets/files/publications/working_papers/05-11.pdf ''Pdf'']
|-
|Korns, Stephen W.|| ||2009||[[Cyber Operations]]||Journal Article||Low:International Warfare||[http://www.carlisle.army.mil/DIME/documents/Cyber%20Operations%20-%20The%20New%20Balance%20-%20Korns.pdf ''Pdf'']
|-
|Kramer, Franklin D., et. al||||2009||[[Cyberpower and National Security]]||Book||None||N/A
|-
|Lernard, Thomas M.||Rubin, Paul H.||2005||[[An Economic Analysis of Notification Requirements for Data Security Breaches]]||Online Paper||Low:Economics||[http://www.pff.org/issues-pubs/pops/pop12.12datasecurity.pdf ''Pdf'']
|-
|Lernard, Thomas M.||Rubin, Paul H.||2006||[[Much Ado About Notification]]||Journal Article||Low:Economics||[http://www.cato.org/pubs/regulation/regv29n1/v29n1-5.pdf ''Pdf''] [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=898208# ''SSRN'']
|-
|McAfee, Inc.||||2010||[[McAfee Threats Report]]||Industry Report||None||[http://www.mcafee.com/us/local_content/reports/2010q1_threats_report.pdf ''Pdf'']
|-
|Moore, Tyler, et. al||||2009||[[The Economics of Online Crime]]||Journal Article||Low:Technology||[http://people.seas.harvard.edu/~tmoore/jep09.pdf ''Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2007||[[Examining the Impact of Website Take-down on Phishing]]||Conf. Paper||Low:Technology||[http://www.ecrimeresearch.org/2007/proceedings/p1_moore.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime07.pdf ''AltPdf'']
|-
|Moore, Tyler||Clayton, Richard||2008||[[The Consequence of Non-Cooperation in the Fight Against Phishing]]||Conf. Paper||Low:Technology; Low:Economics||[http://people.seas.harvard.edu/~tmoore/ecrime08.pdf ''Pdf''] [http://www.cl.cam.ac.uk/~rnc1/ecrime08pre.pdf ''Alt Pdf'']
|-
|Moore, Tyler||Clayton, Richard||2009||[[The Impact of Incentives on Notice and Take-down]]||Book Chapter||Moderate:Technology; Low:Law||[http://weis2008.econinfosec.org/papers/MooreImpact.pdf ''Pdf'']
|-
|National Cyber Defense Initiative||||2009||[[National Cyber Defense Financial Services Workshop Report]]||Independent Report||Moderate:Financial Services Infrastructure; Moderate:Acronym Tolerance||[http://www.cyber.st.dhs.gov/docs/NCDI_FI_Workshop_Report.pdf ''Pdf''] [http://ncdi.nps.edu/FI_Workshop_Report_100204.pdf ''AltPdf'']
|-
|National Cyber Security Summit Task Force||||2004||[[Information Security Governance]]||Government Report||Moderate:Executive Administration||[http://www.cyber.st.dhs.gov/docs/Information%20Security%20Governance-%20A%20Call%20to%20Action%20(2004).pdf ''Pdf''] [http://www.criminal-justice-careers.com/resources/InfoSecGov4_04.pdf ''AltPdf'']
|-
|National Infrastructure Advisory Council||||2004||[[Hardening The Internet]]||Government Report||High:Technology||[http://www.cyber.st.dhs.gov/docs/NIAC%20Internet%20Hardening.pdf ''Pdf''] [http://www.dhs.gov/xlibrary/assets/niac/NIAC_HardeningInternetPaper_Jan05.pdf ''AltPdf'']
|-
|National Institute of Standards and Technology||||2006||[[SP 800-82: Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security]]||Government Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/NIST%20Guide%20to%20Supervisory%20and%20Data%20Acquisition-SCADA%20and%20Industrial%20Control%20Systems%20Security%20(2007).pdf ''Pdf'']
|-
|National Research Council||||1999||[[Trust in Cyberspace]]||Independent Report||Moderate:Technology||[http://www.cyber.st.dhs.gov/docs/Trust%20in%20Cyberspace%20Report%201999.pdf ''Pdf'']
|-
|National Research Council||||2007||[[Toward a Safer and More Secure Cyberspace]]||Independent Report||Low:Research Processes; Low:Technology||[http://www.cyber.st.dhs.gov/docs/Toward_a_Safer_and_More_Secure_Cyberspace-Full_report.pdf ''Pdf'']
|-
|National Science and Technology Council||||2006||[[Federal Plan for Cyber Security and Information Assurance Research and Development]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/Federal%20R&D%20Plan%202006.pdf ''Pdf'']
|-
|Networking and Information Technology Research and Development|| ||2009||[[National Cyber Leap Year Summit 2009, Co-Chairs' Report]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/National_Cyber_Leap_Year_Summit_2009_Co-Chairs_Report.pdf ''Pdf'']
|-
|Nye, Joseph||||2010||[[Cyber Power]]||Book Chapter||Low:Technology; Low:Policy||[http://belfercenter.ksg.harvard.edu/files/cyber-power.pdf ''Pdf'']
|-
|Powell, Benjamin||||2005||[[Is Cybersecurity a Public Good]]||Law Review||Low/Moderate:Economics||[http://www.independent.org/pdf/working_papers/57_cyber.pdf ''Pdf''] [http://www.ciaonet.org/wps/pob03/pob03.pdf ''AltPdf'']
|-
|President's Commission on Critical Infrastructure Protection|| ||''1997''||[[Critical Foundations]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PCCIP%20Report%201997.pdf ''Pdf'']
|-
|President's Information Technology Advisory Council|| ||2005||[[Cyber Security: A Crisis of Prioritization]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/PITAC%20Report%202005.pdf ''Pdf'']
|-
|Romanosky et al.||||2008||[[Do Data Breach Disclosure Laws Reduce Identity Theft]]||Conf. Paper||Moderate:Economics||[http://weis2008.econinfosec.org/papers/Romanosky.pdf ''Pdf'']
|-
|Rotenberg et. al.||||2010||[[The Cyber War Threat Has Been Grossly Exaggerated]]||Debate||None||[http://intelligencesquaredus.org/index.php/past-debates/cyber-war-threat-has-been-grossly-exaggerated/ ''Audio/Transcript'']
|-
|Schmitt, Michael N., et. al||||2004||[[Computers and War]]||Conf. Paper||Moderate:Law||[http://www.ihlresearch.org/ihl/pdfs/schmittetal.pdf ''Pdf'']
|-
|Schmitt, Michael N.||||1999||[[Computer Network Attack and the Use of Force in International Law]]||Law Review||High:Law||[http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA471993&Location=U2&doc=GetTRDoc.pdf ''Pdf'']
|-
|Schmitt, Michael N.||||2002||[[Wired Warfare]]||Journal Article||Moderate:Law||[http://www.icrc.org/Web/eng/siteeng0.nsf/htmlall/5C5D5C/$File/365_400_Schmitt.pdf ''Pdf'']
|-
|Schneier, Bruce||||2003||[[Beyond Fear]]||Book||None||[http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 ''Scribd'']
|-
|Schneier, Bruce||||2008||[[Schneier on Security]]||Book||None||[http://www.schneier.com/book-sos.html ''Purchase'']
|-
|Schwartz, Paul||Janger, Edward||2007||[[Notification of Data Security Breaches]]||Law Review||Low:Law; Low:Economics||[http://www.michiganlawreview.org/assets/pdfs/105/5/schwartz.pdf ''Pdf'']
|-
|Sklerov, Matthew J.||||2009||[[Solving the Dilemma of State Responses to Cyberattacks]]||Law Review||Moderate:Law; Low:Technology||[http://www.loc.gov/rr/frd/Military_Law/Military_Law_Review/pdf-files/201-fall-2009.pdf ''Pdf'']
|-
|Stohl, Michael||||2006||[[Cyber Terrorism]]||Journal Article||None||[http://www.ingentaconnect.com/content/klu/cris/2006/00000046/F0020004/00009061 ''Purchase'']
|-
|Swire, Peter P.||||2004||[[A Model for When Disclosure Helps Security]]||Law Review||Low/Moderate:Logic||[http://www.rootsecure.net/content/downloads/pdf/disclosure_helps_security.pdf ''Pdf''][http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 ''SSRN'']
|-
|Swire, Peter P.||||2006||[[A Theory of Disclosure for Security and Competitive Reasons]]||Law Review||Low/Moderate:Logic||[http://papers.ssrn.com/sol3/papers.cfm?abstract_id=842228 ''SSRN'']
|-
|Symantec Corporation||||2010||[[Symantec Global Internet Security Threat Report]]||Industry Report||Low/Moderate:Technology||[http://www4.symantec.com/Vrt/wl?tu_id=SUKX1271711282503126202 ''Pdf'']
|-
|Telang, Rahul||Wattal, Sunil||2007||[[Impact of Software Vulnerability Announcements on the Market Value of Software Vendors]]||Journal Article||Moderate:Economics||[http://infosecon.net/workshop/pdf/telang_wattal.pdf ''Pdf'']
|-
|Thomas, Rob||Martin, Jerry||2006||[[The Underground Economy]]||Journal Article||Low:Technology||[http://www.usenix.org/publications/login/2006-12/openpdfs/cymru.pdf ''Pdf'']
|-
|Todd, Graham H.||||2009||[[Armed Attack in Cyberspace]]||Law Review||Moderate:Law||[http://www.afjag.af.mil/shared/media/document/AFD-091026-024.pdf ''Pdf'']
|-
|Trend Micro Incorporated|| ||2010||[[Trend Micro Annual Report]]||Industry Report||Moderate:Technology||[http://us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/2009s_most_persistent_malware_threats__march_2010_.pdf ''Pdf'']
|-
|United States Secret Service||||2004||[[Insider Threat Study]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/its_report_040820.pdf ''Pdf'']
|-
|van Eeten, Michel J. G.||Bauer, Johannes M.||2008||[[Economics of Malware]]||Non-US Govt. Report||Moderate:Economics||[http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Pdf'']
|-
|Varian, Hal||||2000||[[Managing Online Security Risks]]||Newspaper Article||None||[http://people.ischool.berkeley.edu/~hal/people/hal/NYTimes/2000-06-01.html ''Web'']
|-
|Varian, Hal||||2004||[[System Reliability and Free Riding]]||Book Chapter||High:Economics||[http://www.sims.berkeley.edu/resources/affiliates/workshops/econsecurity/econws/48-old.pdf ''Pdf''] [http://people.ischool.berkeley.edu/~hal/Papers/2004/reliability ''AltPdf'']
|-
|Verizon||||2010||[[2010 Data Breach Investigations Report]]||Industry Report||Low:Technology||[http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf ''Pdf'']
|-
|Watts, Sean||||2010||[[Combatant Status and Computer Network Attack]]||Law Review||Moderate:Law||[http://www.vjil.org/wp-content/uploads/2010/01/VJIL-50.2-Watts.pdf ''Pdf'']
|-
|White House||||2003||[[The National Strategy to Secure Cyberspace]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/National%20Strategy%20to%20Secure%20Cyberspace%202003.pdf ''Pdf'']
|-
|White House||||2010||[[The Comprehensive National Cybersecurity Initiative]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/CNCI-Cybersecurity.pdf ''Pdf'']
|-
|White House||||2009||[[Cyberspace Policy Review]]||Government Report||None||[http://www.cyber.st.dhs.gov/docs/Cyberspace_Policy_Review_final.pdf ''Pdf'']
|-
|Zittrain, Jonathan L.||||2008||[[The Future of the Internet and How To Stop It]]||Book||None||[http://futureoftheinternet.org/static/ZittrainTheFutureoftheInternet.pdf ''Pdf'']
|}

Keyword Index and Glossary of Core Ideas

2010-09-09T15:38:33Z

WikiSysop: /* SCADA Systems */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:38:10Z

WikiSysop: /* Red Team */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:37:58Z

WikiSysop: /* Organized Crime */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:37:42Z

WikiSysop: /* Malware */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:37:26Z

WikiSysop: /* Information Asymmetries */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:37:10Z

WikiSysop: /* Hacker */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:36:34Z

WikiSysop: /* Computer Network Attack */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

Keyword Index and Glossary of Core Ideas

2010-09-09T15:36:06Z

WikiSysop: /* Computer Network Attack */

==Keyword Index and Glossary of Core Ideas==

===Air-Gapped Network===
Air gapping is a security measure that isolates a secure network from unsecure networks physically, electrically and electromagnetically.

See also: [[Keyword_Index_and_Glossary_of_Core_Ideas#Sneakernet | Sneakernet]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Antivirus===
Software which attempts to identify and delete or isolate [[#Malware |malware]]. Antivirus software may use both a database containing signatures of known threats and heuristics to identify malware. Usually run as a background service to scan files and email copied to the protected system.

References:
* [[Security_Engineering | Anderson]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Best Practices===

The processes, practices, and systems identified in public and private organizations that performed exceptionally well and are widely recognized as improving an organization's performance and efficiency in specific areas. Successfully identifying and applying best practices can reduce business expenses and improve organizational efficiency. [http://www.gao.gov/special.pubs/bprag/bprgloss.htm GAO Glossary]

* [[Hardening_The_Internet | National Infrastructure Advisory Council]]

===Black Hat===
A black hat is a computer [[#Hacker | hacker]] who works to harm others (e.g., steal identities, spread computer viruses, install bot software).

See also: [[#White_Hat | White Hat]]

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Blacklist===
A list of computers, IP addresses, user names or other identifiers to block from access to a computing resource.

See also: [[#Whitelist | Whitelist]]

References:
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Botnet===
A portmanteau of "robot" and "network." Refers to networks of sometimes millions of infected machines that are remotely controlled by malicious actors. A single infected computer may be referred to as a zombie computer. The owners of the computer remotely controlled is often unaware of the infection. The owners of a botnet may use the combined network processing power and bandwidth to send [[#SPAM | SPAM]], install [[#Malware | malware]] and mount [[#DDoS_Attack | DDoS attacks]] or may rent out the botnet to other malicious actors.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Cyber_Power | Nye]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Schneier_on_Security | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===''Casus Belli''===
The justification for going to war. From the Latin "''casus''" meaning "incident" or "event" and "''belli''" meaning "of war."

References:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Wired_Warfare | Schmitt]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Civilian Participation===
The involvement of non-military persons in warfare. While civilians have often provided support to the military in kinetic wars, in [[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Warfare | cyber warfare]] civilians are able to remotely participate in direct attacks against opponents. This raises complicated questions of law when the combatants are not uniformed military personnel.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Combatant Status===
The legal status of combatants in warfare. Existing law distinguishes between uniformed military and civilian status.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Communications Privacy Law===
Laws which regulate access to electronic communications. In the United States, the [http://www.usiia.org/legis/ecpa.html Electronic Communications Privacy Act (ECPA]) protects electronic communications while in transit and prohibits the unlawful access and disclosure of communication contents.

References:
* [[Amending_The_ECPA_To_Enable_a_Culture_of_Cybersecurity_Research | Burstein]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[Cybersecurity:_Preventing_Terrorist_Attacks_and_Protecting_Privacy_in_Cyberspace | Nojeim]]
* [[Cyber_Power | Nye]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Emergency Response Team===
A group of experts brought together to deal with computer security issues. The Computer Emergency Response Team (CERT) mandate is to develop and promote best management practices and technology applications to “resist attacks on networked systems, to limit damage, and to ensure continuity of critical services.” (Software Engineering Institute 2008). CERT may be formed by governments to handle security at the national level or by academic institutions or individual corporations.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Computer Network Attack===
Includes actions taken via computer networks to disrupt, deny, degrade, or destroy the information within computers and computer networks and/or the computers/networks themselves. [http://www.fas.org/irp/doddir/dod/jp3_13.pdf Joint Doctrine for Information Operations JP 3-13 at I-9 (1998)]

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Information_Security | GAO]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Computers_and_War | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Beyond_Fear | Schneier]]
* [[2010 Data Breach Investigations Report | Verizon]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===COTS Software===
Commercial Off The Shelf Software. Software that is prepackaged and sold as a commodity rather than custom written for a specific user/organization or purpose. Examples include operating systems, database management programs, email servers, application servers and office product suites. [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD at 18.]]

References:
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Credit Card Fraud===
Theft of goods or services using false or stolen credit card information.

See Also: [[#Shoulder_Surfing | Shoulder Surfing]]

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Crimeware===
Software tools designed to aid criminals in perpetrating online crime. Refers only to programs not generally considered desirable or usable for ordinary tasks. Thus, while a criminal may use Internet Explorer in the commission of a [[#Cyber_Crime | cybercrime]], the Internet Explorer application itself would not be considered crimeware.

References:
* [[2007_Malware_Report |Computer Economics]]
* [[Cybersecurity | Bauer and van Eeten]], [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Crime===
In its broadest definition, cybercrime includes all crime perpetrated with or involving a computer. Symantec defines it as any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime. The crime may take place on the computer alone or in addition to other locations. [http://www.symantec.com/norton/cybercrime/definition.jsp Symantec]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as an Externality===
Economists define externalities as instances where an individual or firm’s actions have
economic consequences for others for which there is no compensation. One important
distinction is between positive and negative externalities. Instances of the latter are most
commonly discussed, such as the environmental pollution caused by a plant, which may
have impacts on the value of neighboring homes. Important examples of positive
externalities are so common in communications networks that there is a class of "network
externalities. For instance, the simple act of installing telephone service to one additional
customer creates positive externalities on everyone on the telephone network because
they can now each reach one additional person.
Several attributes of computer security suggest that it is an externality. Most importantly,
the lack of security on one machine can cause adverse effects on another. The most
obvious example of this is from electronic commerce, where credit card numbers stolen
from machines lacking security are used to commit fraud at other sites.

References:
* [[Security_Engineering | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Pricing_Security | Camp and Wolfram]], [[Economics_of_Information_Security | 2]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]]
* [[An_Introduction_to_Key_Themes_in_the_Economics_of_Cyber_Security | Gandal]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Trust in Cyberspace | National Research Council]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Security as a Public Good===
In economics, a public good is a good that is non-rivalrous and non-excludable. Non-rivalry means that consumption of the good by one individual does not reduce availability of the good for consumption by others; and non-excludability that no one can be effectively excluded from using the good.

References:
* [[Security_Engineering | Anderson]]
*[[Cyber-Insurance_Revisited | Bohme]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_Other_Public_Security_Goods | Kobayashi]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Trust in Cyberspace | National Research Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Beyond_Fear | Schneier]]
* [[System_Reliability_and_Free_Riding | Varian]], [[Managing_Online_Security_Risks | 2]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Terrorism===
A criminal act perpetrated by the use of computers and telecommunications capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing confusion and uncertainty within a given population, with the goal of influencing a government or population to conform to a particular political, social, or ideological agenda. [http://judiciary.senate.gov/hearings/testimony.cfm?id=1054&wit_id=2995 FBI]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyber_War | Clarke]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Critical_Foundations | PCCIP]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[The_Evolving_Landscape_of_Maritime_Cybersecurity | Shah]]
* [[Cyber_Terrorism | Stohl]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Cyber Warfare===
Actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. [[Cyber_War | Clarke]]

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Cyber_War | Clarke]]
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks#Full_Citation | Cornish]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Global_Cyber_Deterrence | Lan]]
* [[Critical_Foundations | PCCIP]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Estonia_Three_Years_Later | Shackelford]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]
* [[The Comprehensive National Cybersecurity Initiative | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Data Mining===
The process of extracting hidden information and correlations from one or more databases or collections of data that would not normally be revealed by a simple database query.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy#Synopsis | Besunder]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Schneier on Security | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Department of Homeland Security===
Cabinet level department of the United States assigned, ''inter alia'', the task of protecting against terrorist threats and helping state and local authorities prepare for, respond to and recover from domestic disasters.

References:
* [[Cyber_War | Clarke]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Information_Security | GAO]]
* [[Cyber_Operations | Korns]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Schneier on Security | Schneier]], [[Schneier on Security | [2]]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===DDoS Attack===
The disabling of a targeted website or Internet connection by flooding it with such high levels of Internet traffic that it can no longer respond to normal connection requests. Often mounted by directing an army of zombie computers (see [[#Botnet | botnet]]) to connect to the targeted site simultaneously. The targeted site may crash while trying to respond to an overwhelming number of connections requests or it may be disabled because all available bandwidth and/or computing resources are tied up responding to the attack requests.

References:
* [[Why_Information_Security_is_Hard | Anderson]], [[Security_Engineering | [2]]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin. et. al]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Digital Pearl Harbor===
A cyberwarfare attack similar in scale and surprise to the 1941 attack on Pearl Harbor. The expression is often invoked by those who argue that a cyber-based attack is either imminent or inevitable and that by not being properly prepared, the United States will suffer significant and unnecessary losses.

AKA: Electronic Pearl Harbor; Cyber Pearl harbor

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Disclosure Policy===
A policy that governs the disclosure to clients and other stakeholder by a provider of a computer program or system of defects discovered in those products.

References:
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Schneier on Security | Schneier]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Distributed Denial of Service (DDoS)===
See: [[#DDoS_Attack | DDoS Attack]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Dumpster Diving===
A method of obtaining proprietary, confidential or useful information by searching through trash discarded by a target.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Einstein===
The operational name of the National Cybersecurity Protection System (NCPS). Was created in 2003 by the United States Computer Emergency Readiness Team (US-CERT)14 in order to aid in its ability to help reduce and prevent computer network vulnerabilities across the federal government. The initial version of Einstein provided an automated process for collecting, correlating, and analyzing agencies’ computer network traffic information from sensors installed at their Internet connections. The Einstein sensors collected
network flow records at participating agencies, which were then analyzed by US-CERT to detect certain types of malicious activity.

References:
* [[Information_Security | GAO]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===E.U. Cybersecurity===
Discussions relating to cybersecurity of the European Union and of European Union states.

References:
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Introduction_to_Country_Reports | ENISA]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Generativity===
Generativity is a system’s capacity to produce unanticipated change through unﬁltered contributions from broad and varied audiences.

References:

*[[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Geneva Conventions===
Four treaties and three additional protocols that regulates the conduct of hostilities between states and set the standards for humanitarian treatment of the victims of war.

See also: [[#Laws_of_War | Laws of War]]

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacker===
Advanced computer users who spend a lot of time on or with computers and work hard to find vulnerabilities in IT systems. [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]

References:
* [[Security_Engineering | Anderson]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Cyber_Terrorism | Stohl]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivism===
The nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. These tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. [http://www.alexandrasamuel.com/dissertation/index.html Samuel, A.]

References:
* [[World_War_3.0:_Ten_Critical_Trends_for_Cybersecurity | Cetron and Davies]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Terrorism | Stohl]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Hacktivist===
A portmanteau of [[#Hacker | "hacker"]] and "activist." Individuals that have a political motive for their activities, and identify that motivation by their actions, such as defacing opponents’ websites with counter-information or disinformation.

See also: [[#Hacktivism | Hacktivism]]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[McAfee Threats Report | McAfee]]
* [[Cyber_Power | Nye]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Honeypot===
A computer, network or other information technology resource set as a trap to attract attacks. Honeypots may be used to collect metrics (how long does it take for an unprotected system to be breached), to test defenses, to examine methods of attack or to catch attackers. A honeypot system may also be used to collect [[#SPAM | SPAM]] so it can be added to a [[#Blacklist | blacklist]].

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Beyond_Fear | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Identity Fraud/Theft===
The exploitation by malevolent third parties of unwarranted access to clients' or consumers' identities. Often the result of lax data security or privacy measures.

References:
* [[Security_Engineering | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[2007_Malware_Report | Computer Economics]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Notification_of_Data_Security_Breaches | Schwartz and Janger]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Asymmetries===
Information asymmetry deals with the study of decisions in transactions where one party has more or better information than the other. This creates an imbalance of power in transactions which can sometimes cause the transactions to go awry.

The software market suffers from the same information asymmetry. Vendors may make claims about the security of their products, but buyers have no reason to trust them. In many cases, even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Cyber_War | Clarke]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]
* [[Wired_Warfare | Schmitt]]
* [[Schneier on Security | Schneier]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Intelligence Infrastructure/Information Infrastructure===
The network of computers and communication lines underlying critical services that American society has come to depend on: financial systems, the power grid, transportation, emergency services, and government programs. Information infrastructure includes the Internet, telecommunications networks, “embedded” systems (the built-in microprocessors that control machines from microwaves to missiles), and “dedicated” devices like individual personal computers. [http://www.cfr.org/publication/10212/targets_for_terrorism.html Council on Foreign Relations]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Cyber_Power | Nye]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Information Operations===
Actions taken to affect adversary information and information systems while defending one’s own information and information systems.” Information Operations (IO) can occur during peacetime and at every level of warfare.
Information warfare (IW), by contrast, is IO “conducted during time of crisis or conflict to achieve or promote specific objectives over a specific adversary or adversaries” [Joint Chiefs of Staff, Department of Defense, Dictionary of Military and Associated Terms, Joint Publication]

References:
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Interdependencies===
The inter-connections between supposedly independent but often interdependent systems.

See also: [[#SCADA_Systems | SCADA Systems]]

References:
* [[The_Economics_of_Information_Security | Anderson and Moore]]
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Cyber-Insurance_Revisited | Bohme]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Trust in Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cybersecurity_and_Economic_Incentives | OECD]]
* [[Critical_Foundations | PCCIP]]
* [[Evolving_Cybersecurity_Issues_in_the_Utility_Industry | Perkins]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | Schmitt]]
* [[Beyond_Fear | Schneier]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[System_Reliability_and_Free_Riding | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===International Humanitarian Law===
That part of international law which seek, for humanitarian reasons, to limit the effects of armed conflict. It protects persons who are not or are no longer participating in the hostilities and restricts the means and methods of warfare. International humanitarian law is also known as the law of war or the law of armed conflict. International law is the body of rules governing relations between States. It is contained in agreements between States (treaties or conventions), in customary rules, which consist of State practise considered by them as as legally binding, and in general principles. [http://www.icrc.org/web/eng/siteeng0.nsf/html/humanitarian-law-factsheet ICRC]

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Relay Chat (IRC)===
A method of real-time Internet communication often used by criminals to buy and sell purloined information such as credit card numbers and personal identity information. IRC chatrooms may be open or private.

References:
* [[Security_Engineering | Anderson]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Internet Service Providers===
A company that offers access to the Internet. Internet Service Providers may also provide add-on services such as web hosting, electronic mail, virus scanning, SPAM filtering, etc.

References:
* [[Security_Engineering | Anderson]]
* [[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The_Market_Consequences_of_Cybersecurity | OECD]]
* [[Economics_of_Malware | van Eeten and Bauer]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Keylogger===
Software or hardware that monitors and logs the keystrokes a user types into a computer. The keylogger may store the key sequences locally for later retrieval or send them to a remote location. A hardware keylogger can only be detected by physically inspecting the computer for unusual hardware.

References:
* [[Security_Engineering | Anderson]]
* [[2007_Malware_Report | Computer Economics]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[The_Underground_Economy | Thomas and Martin]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

=== Kinetic Attack===
Traditional mode of warfare in which arms are used to kill opponents and/or destroy an opponent's infrastructure. Usually used to distinguish a cyber attack in which destruction of the opponent's resources is accomplished through targeted information system attacks without resorting to bullets, bombs or explosives.

References:
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Computers_and_War | Schmitt]], [[Computers_and_War | 2]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Lawfare===
The use of international law to damage an opponent in a war without use of arms.

References:
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Laws of War===
The body of law that define the legality of using armed force to resolve a conflict (''jus ad bellum'') and the laws that define the legality of the actual hostilities and related activities (''jus in bello'').

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[Applicability_of_the_Additional_Protocols_to_Computer_Network_Attacks | Dörmann]]
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyber-Apocalypse_Now | Gable]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Power | Nye]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | [2]]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [3]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Malware===
A variety of computer software designed to infiltrate a user's computer specifically for malicious purposes. Includes, ''inter alia'', computer virus software, botnet software, computer worms, spyware, trojan horses, crimeware and rootkits.

References:
* [[Security_Engineering | Anderson]]
* [[A_Proposal_for_an_International_Convention_To_Regulate_the_Use_of_Information_Systems_in_Armed_Conflict | Brown]]
* [[2007_Malware_Report | Computer Economics]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Cybersecurity Strategy (U.S.)===
A comprehensive policy to secure America’s digital infrastructure as part of the Administrative Branch's [http://www.whitehouse.gov/cybersecurity/comprehensive-national-cybersecurity-initiative Comprehensive National Cybersecurity Initiative]. The goals of the policy are: to establish a front line of defense against current immediate threats; to defend against threats by enhancing U.S. counterintelligence capabilities and; to strengthen the future cybersecurity environment by expanding cyber education and redirecting research and development efforts to define and develop strategies to deter hostile or malicious activity in cyberspace.

References:
* [[Cyberpower and National Security | Kramer et. al]]
* [[Cyber_Security_and_Regulation_in_the_United_States | Lewis]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Critical_Foundations | PCCIP]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===National Security===
Broadly refers to the requirement to maintain the survival of the nation-state through the use of economic, military and political power and the exercise of diplomacy. [http://en.wikipedia.org/wiki/National_security Wikipedia]

References:
* [[Nuclear_Security | Aloise]]
*[[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[An_Assessment_of_International_Legal_Issues_in_Information_Operations | DoD Office of General Counsel]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Why_States_Need_an_International_Law_for_Information_Operations | Hollis]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Terrorist_Capabilities_for_Cyberattack:_Overview_and_Policy_Issues | Rollins and Wilson]]
* [[Wired_Warfare | Schmitt]], [[Computer_Network_Attack_and_the_Use_of_Force_in_International_Law | [2]]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]
* [[The Comprehensive National Cybersecurity Initiative | White House]], [[The National Strategy to Secure Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===New Normalcy===
New normalcy has become an episodic polict construct in U.S. strategic ideation. National leadership has relied on the new normalcy clarion call to illuminate moments in time when it is understood that the Nation faces not only a severe threat, but also a transcending reorientation. Often invoked in times of national crisis, new normalcy in the American experience signals a cardinal shift in the nature of U.S. security. ["Cyber Operations - The New Balance," Stephen W. Korns]

===Notice and Take-down===
Most commonly used to remove infringing web material under copyright law, a notice and take-down regime is a procedure by which an infringing web site is removed from a service provider's (ISP) network, or access to an allegedly infringing website, disabled. Websites violating copyright are subject to notice and take-down, as are phishing websites.

References:
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Organized Crime===
Groups having some manner of a formalized structure and whose primary objective is to obtain money through illegal activities. Such groups maintain their position through the use of actual or threatened violence, corrupt public officials, graft, or extortion, and generally have a significant impact on the people in their locales, region, or the country as a whole. [http://www.fbi.gov/hq/cid/orgcrime/glossary.htm FBI]

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Cybersecurity_in_the_Payment_Card_Industry | Epstein and Brown]]
* [[An_Inquiry_into_the_Nature_and_Causes_of_the_Wealth_of_Internet_Miscreants | Franklin et. al]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Outreach and Collaboration===
Working across government and with the private sector to share information on threats and other data, and to develop shared approaches to securing cyberspace. [http://www.fas.org/sgp/crs/natsec/R40836.pdf CRS Report for Congress, at 6 (2009).]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Pricing_Security | Camp and Wolfram]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]], [[Strategy_for_Homeland_Defense_and_Civil_Support | [2]]]
* [[The_National_Strategy_for_the_Physical_Protection_of_Critical_Infrastructures_and_Key_Assets | DHS]], [[A Roadmap for Cybersecurity Research | [2]]]
* [[Introduction_to_Country_Reports | ENISA]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
*[[The_Law_and_Economics_of_Cybersecurity | Grady and Parisi]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Experiences_and_Challenges_with_Using_CERT_Data_to_Analyze_International_Cyber_Security | Madnick et. al.]]
* [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | Moore and Clayton]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Cybersecurity:_Current_Legislation%2C_Executive_Branch_Initiatives%2C_and_Options_for_Congress | Theohary and Rollins]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Password Weakness===
Security threats caused by the use of easily guessable passwords which protect vital stores of confidential information stored online.

References:
* [[Security_Engineering | Anderson]]
* [[Cybersecurity%2C_Identity_Theft%2C_and_the_Limits_of_Tort_Liability | Johnson, V.]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Patching===
Patching refers to the installation of a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance. Though meant to fix problems, poorly designed patches can sometimes introduce new problems. [http://en.wikipedia.org/wiki/Patch_%28computing%29 Wikipedia]

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Phishing===
The criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

References:
* [[Security_Engineering | Anderson]]
* [[Security_Economics_and_the_Internal_Market | Anderson et. al.]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]],
* [[2007_Malware_Report | Computer Economics]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[Examining_the_Impact_of_Website_Take-down_on_Phishing | Moore and Clayton]], [[The_Consequence_of_Non-Cooperation_in_the_Fight_Against_Phishing | [2]]], [[The_Impact_of_Incentives_on_Notice_and_Take-down | [3]]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Privacy Law===
Laws which regulate the protection of confidential personal information stored in private records or disclosed to a professional. Also includes laws which regulate the gathering of electronic data in which personal information is accumulated or misappropriated.

References:
* [[Best_Practices_for_Data_Protection_and_Privacy | Besunder]]
* [[Securing_Cyberspace_for_the_44th_Presidency | Center for Strategic and International Studies]]
* [[A Roadmap for Cybersecurity Research | DHS]]
* [[Strategy_for_Homeland_Defense_and_Civil_Support | DoD]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Red Team===
A structured, iterative process executed by trained, educated and practiced team members that provides commanders an independent capability to continuously challenge plans, operations, concepts, organizations and capabilities in the context of the operational environment and from our partners’ and adversaries’ perspectives. See [http://www.tradoc.army.mil/pao/tnsarchives/July05/070205.htm U.S. Army]

References:
* [[Critical_Infrastructure_Threats_and_Terrorism | Deputy Chief of Staff for Intelligence]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Research & Development===
Research and development (R&D) addressing cyber security and information infrastructure protection.

References:
* [[Pricing_Security | Camp and Wolfram]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Research_Agenda_for_the_Banking_and_Finance_Sector | Financial Services Sector Coordinating Council for Critical Infrastructure Protection]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[Cyber_Security_Research_and_Development_Agenda | Institute for Information Infrastructure Protection]]
* [[The_Need_for_a_National_Cybersecurity_Research_and_Development_Agenda | Maughan]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Federal Plan for Cyber Security and Information Assurance Research and Development | National Science & Tech. Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Risk Modeling===
The creation of a model to estimate risk exposure, policy option efficacy and cost-benefit analysis of a particular threat and solution. See [http://cisac.stanford.edu/publications/how_much_is_enough__a_riskmanagement_approach_to_computer_security/ Soo Hoo, Kevin J.]

References:
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Cyber-Insurance_Metrics_and_Impact_on_Cyber-Security | Clinton]]
* [[Nothing_Ventured%2C_Nothing_Gained | Geer and Conway]]
* [[An_Economic_Analysis_of_the_Private_and_Social_Costs_of_the_Provision_of_Cybersecurity_and_other_Public_Security_Goods | Kobayashi]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Making_the_Best_Use_of_Cybersecurity_Economic_Models | Rue and Pfleeger]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[Beyond_Fear | Schneier]]
* [[Managing_Online_Security_Risks | Varian]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SCADA Systems===
SCADA stands for "supervisory control and data acquisition" and in the cybersecurity context usually refers to industrial control systems that control infrastructure such as electrical power transmission and distribution, water treatment and distribution, wastewater collection and treatment, oil and gas pipelines and large communication systems. The focus is on whether as these systems are connected to the public Internet they become vulnerable to a remote attack.

References:
* [[Towards_a_Cyberspace_Legal_Regime_in_the_Twenty-First_Century | Dunlap]]
* [[Cyberpower and National Security | Kramer et. al]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[Cyber_Power | Nye]]
* [[Critical_Foundations | PCCIP]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[A_Framework_for_Linking_Cybersecurity_Metrics_to_the_Modeling_of_Macroeconomic_Interdependencies | Santos et. al.]]
* [[Metrics_for_Mitigating_Cybersecurity_Threats_to_Networks | Schneidewind]]
* [[The National Strategy to Secure Cyberspace | White House]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Scareware===
Software or web site that purports to be security software reporting a threat against a user's computer to convince the user to purchase unneeded software or install malware.

* [[2007_Malware_Report | Computer Economics]]
* [[McAfee Threats Report | McAfee]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Script Kiddie===
A derogatory term for a [[#Black_Hat | Black Hat]] who uses canned tools and programs written by more skillful [[#Hacker | hackers]] to commit cyber crime without understanding how they work.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Security Trade-Offs===
There is no single correct level of security; how much security you have depends on what you’re willing to give up in order to get it. This trade-off is, by its very nature, subjective—secu- rity decisions are based on personal judgments. Different people have different senses of what constitutes a threat, or what level of risk is acceptable. What’s more, between different commu- nities, or organizations, or even entire societies, there is no agreed-upon way in which to define threats or evaluate risks, and the modern technological and media-filled world makes these evaluations even harder. [http://www.scribd.com/doc/12185921/beyond-fear-thinking-sensibly-about-security-in-an-uncertain-world-bruce-schneier-copernicus-books-2003 Bruce Schneier]

References:

*[[Cyber-Insurance_Revisited | Bohme]]
* [[Cyber_Operations | Korns]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Shoulder Surfing===
The process of obtaining passwords or other sensitive information by covertly watching an authorized user enter information into a computer system.

References:
* [[Security_Engineering | Anderson]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sneakernet===
Describes the transfer of data between computers or networks that are not physically, electrically or electromagnetically connected requiring information to be shared by physically transporting media contain the shared information from one computer to another. Initially described systems lacking the technology to network together, now usually refers to systems deliberately isolated for security reasons.

See also: [[#Air-Gapped_Network | Air-Gapped Network]]

===Social Engineering===
Conning a human into supplying passwords, computer access or other sensitive information by pretending to be a person with rights to the information or who the target believes they must surrender the information to.

References:
* [[Security_Engineering | Anderson]]
* [[Emerging_Threats_to_Internet_Security_-_Incentives%2C_Externalities_and_Policy_Implications | Bauer and van Eeten]]
* [[Cyber_Power | Nye]]
* [[The_Market_Consequences_of_Cybersecurity:_Defining_Externalities_and_Ways_to_Address_Them | OECD]], [[Cybersecurity_and_Economic_Incentives | [2]]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Social Network===
A software application or website that allows a large group of users to interact with each other, often allowing the creation of online portals or identities to share with specific people or the online world at large.

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Software Vulnerability===

A software vulnerablilty refers to the existence of a flaw -- or "bug" -- in software that may allow a third party or program to obtain unauthorized access to the flaw and exploit it. [http://www.spi.dod.mil/tenets.htm U.S. Air Force Software Protection Initiative]

References:
* [[Security_Engineering | Anderson]]
* [[Does Information Security Attack Frequency Increase With Vulnerability Disclosure | Arora et. al.]]
* [[Four Grand Challenges in Trustworthy Computing | Computing Research Association]]
* [[Mission Impact of Foreign Influence on DoD Software | DoD]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[The Price of Restricting Vulnerability Publications | Granick]]
* [[Cyber Security Research and Development Agenda | Institute for Information Infrastructure Protection]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Cyber Security: A Crisis of Prioritization | PITAC]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]], [[Trust in Cyberspace | [2]]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[Insider_Threat_Study | U.S. Secret Service]]
* [[Economics_of_Malware | van Eeten and Bauer]]
* [[2010 Data Breach Investigations Report | Verizon]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===SPAM===
Unwanted or junk email usually sent indiscriminately in bulk selling illegal or near illegal goods or services. Even with low response rates and heavy filtering, SPAM can stil be economically viable because of the extremely low costs in sending even huge quantities of electronic messages. Commonly believed to be named after the [http://www.youtube.com/watch?v=anwy2MPT5RE Monty Python skit] where the breakfast meat Spam overwhelms all other food choices.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[McAfee Threats Report | McAfee]]
* [[The_Impact_of_Incentives_on_Notice_and_Take-down | Moore and Clayton]]
* [[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[Schneier on Security | Schneier]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[The_Underground_Economy | Thomas and Martin]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Sponsored Attacks===
[[#Computer_Network_Attack | Computer network attacks]] commissioned by, supported by or carried out by a state or government.

Reverences:
* [[The_Government_and_Cybersecurity | Bellovin]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Beyond_Fear | Schneier]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===State Affiliation===
Under the control or command of a recognized state or government.

References:
* [[Cyber_Security_and_Politically%2C_Socially_and_Religiously_Motivated_Cyber_Attacks | Cornish]]
* [[Cyberspace_and_the_National_Security_of_the_United_Kingdom | Cornish et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber-Apocalypse_Now_-_Securing_the_Internet_Against_Cyberterrorism_and_Using_Universal_Jurisdiction_as_a_Deterrent | Gable]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[National_Cyber_Defense_Financial_Services_Workshop_Report | National Cyber Defense Initiative]]
* [[Armed_Attack_in_Cyberspace | Todd]]
* [[The Cyber War Threat Has Been Grossly Exaggerated | Rotenberg et. al]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Combatant_Status_and_Computer_Network_Attack | Watts]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Tragedy of Commons===
A situation, first described in an influential article written by ecologist Garrett Hardin for the journal Science, in 1968, in which multiple individuals, acting independently, and solely and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. The term can be applied to any issue related to the management of a shared resource, from energy to the public domain, to cybersecurity.

References:
* [[Why_Information_Security_is_Hard | Anderson]]
* [[Economics_of_Information_Security | Camp and Wolfram]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Is_Cybersecurity_a_Public_Good | Powell]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Transparency===
A set of policies, practices and procedures that allow citizens to have accessibility, usability, informativeness, understandability and auditability of information and process held by centers of authority. [http://en.wikipedia.org/wiki/Transparency_(social) Wikipedia]

References:
* [[Overcoming_Impediments_to_Information_Sharing | Aviram and Tor]]
* [[Research Agenda for the Banking and Finance Sector | FSSCC]]
* [[An_Economic_Analysis_of_Notification_Requirements_for_Data_Security_Breaches | Lenard and Rubin]], [[Much_Ado_About_Notification | [2]]]
* [[Managing_Information_Risk_and_the_Economics_of_Security | Johnson, E.]]
* [[Cyber_Operations | Korns]]
* [[Do_Data_Breach_Disclosure_Laws_Reduce_Identity_Theft | Romanosky et. al.]]
* [[Beyond_Fear | Schneier]]
* [[A_Model_for_When_Disclosure_Helps_Security | Swire]], [[A_Theory_of_Disclosure_for_Security_and_Competitive_Reasons | [2]]]
* [[Impact_of_Software_Vulnerability_Announcements_on_the_Market_Value_of_Software_Vendors | Telang and Wattal]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Trojan===
[[#Malware | Malware]] which masquerades as some other type of program such as a link to a web site, a desirable image, etc. to trick a user into installing it. Named for the Ancient Greek legend of the [http://www.mlahanas.de/Greeks/Mythology/TrojanHorse.html Trojan Horse].

References:
* [[Security_Engineering | Anderson]]
* [[Cyber_Operations | Korns]]
* [[McAfee Threats Report | McAfee]]
*[[The_Economics_of_Online_Crime | Moore et. al.]]
* [[Beyond_Fear | Schneier]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Military Technologies===
Warfare made possible by advances in remotely controlled or semiautomated military technologies which remove the operator from risk of harm while attacking an opponent.

References:
* [[Information_Warfare_and_International_Law_on_the_Use_of_Force | Barkham]]
* [[Law_and_War_in_the_Virtual_Era | Beard]]
* [[Critical_Infrastructure_Threats_and_Terrorism | DCSINT]]
* [[Global_Cyber_Deterrence_Views_from_China | Lan]]
* [[Wired_Warfare | Schmitt]], [[Computers_and_War | 2]]
* [[Critical_Foundations | PCCIP]]
* [[Armed_Attack_in_Cyberspace | Todd]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Virtual Warfare===

See: [[#Virtual_Military_Technologies | Virtual Military Technologies]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===White Hat===
A white hat is a computer [[#Hacker | hacker]] who works to find and fix computer security risks. White hat consultants are often hired to attempt to break into their client's network to see if all security holes have been addressed.

See also: [[#Black_Hat | Black Hat]]

References:
* [[Security_Engineering | Anderson]], [[Why_Information_Security_is_Hard | [2]]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Whitelist===
A list of computers, IP (Internet Protocol) addresses, user names or other identifiers to specifically allow access to a computing resource. Normally combined with a default "no-access" policy.

See also: [[#Blacklist | Blacklist]]

References:
* [[Security_Engineering | Anderson]]
* [[Symantec Global Internet Security Threat Report | Symantec]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Worm===
A type of malware that replicates itself and spreads to other computers through network connections.

References:
* [[Security_Engineering | Anderson]]
* [[Models_and_Measures_for_Correlation_in_Cyber-Insurance | Bohme and Kataria]]
* [[Modeling_Cyber-Insurance | Bohme and Schwartz]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[Cyber_Operations | Korns]]
* [[Hardening_The_Internet | National Infrastructure Advisory Council]]
* [[Toward_a_Safer_and_More_Secure_Cyberspace | National Research Council]]
* [[National Cyber Leap Year Summit 2009, Co-Chairs' Report | NITRD]]
* [[Beyond_Fear | Schneier]], [[Schneier on Security | [2]]]
* [[Solving_the_Dilemma_of_State_Responses_to_Cyberattacks | Sklerov]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]
* [[The_Future_of_the_Internet_and_How_To_Stop_It | Zittrain]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''

===Zero-Day Exploit===
[[#Malware | Malware]] designed to exploit a newly discovered security hole unknown to the software developer. "Zero-day" refers to the amount of time a developer has between learning of a security hole and the time it becomes public or when [[#Black_Hat | black hat]] [[#Hacker | hackers]] find out about it and try to use the security hole for nefarious purposes.

References:
* [[Security_Engineering | Anderson]]
* [[Does_Information_Security_Attack_Frequency_Increase_With_Vulnerability_Disclosure | Arora et. al.]]
* [[Mission_Impact_of_Foreign_Influence_on_DoD_Software | DoD]]
* [[The_Price_of_Restricting_Vulnerability_Publications | Granick]]
* [[McAfee Threats Report | McAfee]]
* [[Symantec Global Internet Security Threat Report | Symantec]]
* [[Trend Micro Annual Report | Trend Micro]]

''[[Keyword_Index_and_Glossary_of_Core_Ideas#Top | Jump to top of Glossary]]''