 DEFINITIONS
- E2.1.
Terms used in this Instruction are selected from the NSTISSI 4009 (reference(k))
definitions when possible. Where new terms are used, the revised or
new definitions will be submitted as changes to
reference (k).
- E2.1.1.
Accountability. Property that allows auditing of IT system
activities to be traced to persons or processes that may then be held
responsible for their actions. Accountability includes authenticity
and non-repudiation.
- E2.1.2.
Accreditation. Formal declaration by the DAA that an IT system is
approved to operate in a particular security mode using a prescribed
set of safeguards at an acceptable level of risk.
- E2.1.3.
Architecture. The configuration of any equipment or interconnected
system or subsystems of equipment that is used in the automatic
acquisition, storage, manipulation, management, movement, control,
display, switching, interchange, transmission, or reception of data or
information; includes computers, ancillary equipment, and services,
including support services and related resources.
- E2.1.4.
Acquisition Organization. The Government organization that is
responsible for developing a system.
- E2.1.5.
Assurance. Measure of confidence that the security features,
practices, procedures and architecture of an IT system accurately
mediates and enforces the security policy.
- E2.1.6.
Authenticity. The property that allows the ability to validate the
claimed identity of a system entity.
- E2.1.7.
Availability. Timely, reliable access to data and information
services for authorized users.
- E2.1.8.
Certification. Comprehensive evaluation of the technical and
non-technical security features of an IT system and other safeguards,
made in support of the accreditation process, to establish the extent
that a particular design and implementation meets a set of specified
security requirements.
- E2.1.9.
Certification Authority (CA). The official responsible for
performing the comprehensive evaluation of the technical and
non-technical security features of an IT system and other safeguards,
made in support of the accreditation process, to establish the extent
that a particular design and implementation meet a set of specified
security requirements.
- E2.1.10.
Computing Environment. The total environment in that an automated
information system, network, or a component operates. The environment
includes physical, administrative, and personnel procedures as well as
communication and networking relationships with other information
systems.
- E2.1.11.
Communications Security (COMSEC). Measures and controls taken to
deny unauthorized persons information derived from telecommunications
and ensure the authenticity of such telecommunications. Communications
security includes cryptosecurity, transmission security, emission
security, and physical security of COMSEC material.
- E2.1.12.
Confidentiality. Assurance that information is not disclosed to
unauthorized persons, processes, or devices.
- E2.1.13.
Configuration Control. Process of controlling modifications to a
IT system's hardware, firmware, software, and documentation to ensure
the system is protected against improper modifications prior to,
during, and after system implementation.
- E2.1.14.
Configuration Management. Management of security features and
assurances through control of changes made to hardware, software,
firmware, documentation, test, test fixtures, and test documentation
throughout the life-cycle of the IT.
- E2.1.15.
Configuration Manager. The individual or organization responsible
for Configuration Control or Configuration Management.
- E2.1.16.
Data Integrity. The attribute of data that is related to the
preservation of its meaning and completeness, the consistency of its
representation(s), and its correspondence to what it represents.
- E2.1.17.
Defense Information Infrastructure (DII). The DII is the seamless
web of communications networks, computers, software, databases,
applications, data, security services, and other capabilities that
meets the information processing and transport needs of DoD users in
peace and in all crises, conflict, humanitarian support, and wartime
roles.
- E2.1.18.
Designated Approving Authority (DAA or Accreditor). Official with
the authority to formally assume the responsibility for operating a
system or network at an acceptable level of risk.
- E2.1.19.
Developer. The organization that develops the information system.
- E2.1.20. DoD
Information Technology Security Certification and Accreditation
Process (DITSCAP). The standard DoD process for identifying
information security requirements, providing security solutions, and
managing information system security activities.
- E2.1.21.
Emissions security (EMSEC). Measures taken to deny unauthorized
persons information derived from intercept and analysis of
compromising emanations from crypto-equipment or an IT system.
- E2.1.22.
Environment. Aggregate of external procedures, conditions, and
objects effecting the development, operation, and maintenance of an IT
system.
- E2.1.23.
Evolutionary Program Strategies. Generally characterized by
design, development, and deployment of a preliminary capability that
includes provisions for the evolutionary addition of future
functionality and changes, as requirements are further defined, DoD
Directive 5000.1 (reference (i)).
- E2.1.24.
Governing Security Requisites. Those security requirements that
must be addressed in all systems. These requirements are set by
policy, directive, or common practice set; e.g., by E.O, OMB, the OSD,
a Military Service or a DoD Agency. Those requirements are typically
high-level. While implementation will vary from case to case, those
requisites are fundamental and shall be addressed.
- E2.1.25.
Grand Design Program Strategies. Characterized by acquisition,
development, and deployment of the total functional capability in a
single increment, reference (i).
- E2.1.26.
Incremental Program Strategies. Characterized by acquisition,
development, and deployment of functionality through a number of
clearly defined system "increments" that stand on their own, reference
(i).
- E2.1.27.
Information Category. The term used to bound information and tie
it to an information security policy.
- E2.1.28.
Infrastructure-Centric. A security management approach that
considers information systems and their computing environment as a
single entity.
- E2.1.29.
Information Security Policy. The aggregate of public law,
directives, regulations, rules, and regulate how an organization
manages, protects, and distributes information. For example, the
information security policy for financial data processed on DoD
systems may be in U.S.C., E.O., DoD Directives, and local regulations.
The information security policy lists all the security requirements
applicable to specific information.
- E2.1.30.
Information System. Any telecommunication or computer-related
equipment or interconnected system or subsystems of equipment that is
used in the acquisition, storage, manipulation, management, movement,
control, display, switching, interchange, transmission, or reception
of voice and/or data, and includes software, firmware, and hardware.
- E2.1.31.
Information System Security Officer (ISSO). The person responsible
to the DAA for ensuring the security of an IT system is approved,
operated, and maintained throughout its life-cycle in accordance with
the SSAA.
- E2.1.32.
Information Technology (IT). The hardware, firmware, and software
used as part of the information system to perform DoD information
functions. This definition includes computers, telecommunications,
automated information systems, and automatic data processing
equipment. IT includes any assembly of computer hardware, software,
and/or firmware configured to collect, create, communicate, compute,
disseminate, process, store, and/or control data or information.
- E2.1.33.
Information Technology Security (ITSEC). Protection of information
technology against unauthorized access to or modification of
information, whether in storage, processing or transit, and against
the denial of service to authorized users, including those measures
necessary to detect, document, and counter such threats. Protection
and maintenance of confidentiality, integrity, availability, and
accountability.
- E2.1.34.
Integrator. An organization or individual that unites, combines,
or otherwise incorporates information system components with another
system(s).
- E2.1.35.
Integrity. Quality of an IT system reflecting the logical
correctness and reliability of the operating system; the logical
completeness of the hardware and software implementing the protection
mechanisms; and the consistency of the data structures and occurrence
of the stored data. It is composed of data integrity and system
integrity.
- E2.1.36.
Legacy Information System. An operational information system that
existed before to the implementation of the DITSCAP.
- E2.1.37.
Maintainer. The organization or individual that maintains the
information system.
- E2.1.38.
Maintenance Organization. The organization that keeps an IT system
operating in accordance with prescribed laws, policy, procedures and
regulations. In the case of a contractor maintained system, the
maintenance organization is the government organization responsible
for, or sponsoring the operation of the IT system.
- E2.1.39.
Mission. The assigned duties to be performed by a resource.
- E2.1.40.
Non-Developmental Item (NDI). Any item that is available in the
commercial marketplace; any previously developed item that is in use
by a Department or Agency of the United States, a State or local
government, or a foreign government with which the United States has a
mutual defense cooperation agreement; any item described above, that
requires only minor modifications in order to meet the requirements of
the procuring Agency; or any item that is currently being produced
that does not meet the requirements of definitions above, solely
because the item is not yet in use or is not yet available in the
commercial market place.
- E2.1.41.
Other Program Strategies. Strategies intended to encompass
variations and/or combinations of the grand design, incremental,
evolutionary, or other program strategies, DoD Directive 5000.1
(reference (i)).
- E2.1.42.
Program Manager. The person ultimately responsible for the overall
procurement, development, integration, modification, or operation and
maintenance of the IT system.
- E2.1.43.
Risk. A combination of the likelihood that a threat will occur,
the likelihood that a threat occurrence will result in an adverse
impact, and the severity of the resulting impact.
- E2.1.44.
Risk Assessment. Process of analyzing threats to, and
vulnerabilities of, an IT system, and the potential impact that the
loss of information or capabilities of a system would have on national
security. The resulting analysis is used as a basis for identifying
appropriate and effective measures.
- E2.1.45.
Risk Management. Process concerned with the identification,
measurement, control, and minimization of security risks in IT systems
to a level commensurate with the value of the assets protected.
- E2.1.46.
Security. Measures and controls that ensure confidentiality,
integrity, availability, and accountability of the information
processed and stored by a computer.
- E2.1.47.
Security Inspection. Examination of an IT system to determine
compliance with security policy, procedures, and practices.
- E2.1.48.
Security Process. The series of activities that monitor, evaluate,
test, certify, accredit, and maintain the system accreditation
throughout the system life-cycle.
- E2.1.49.
Security Requirements. Types and levels of protection necessary
for equipment, data, information, applications, and facilities to meet
security policy.
- E2.1.50.
Security Specification. Detailed description of the safeguards
required to protect an IT system.
- E2.1.51.
Security Test and Evaluation (ST&E). Examination and analysis of
the safeguards required to protect an IT system, as they have been
applied in an operational environment, to determine the security
posture of that system.
- E2.1.52.
Sensitive Information. Information, the loss, misuse, or
unauthorized access to or modification of which could adversely affect
the national interest or the conduct of federal programs, or the
privacy to which individuals are entitled under 5 U.S.C. Section 552a
(reference (l)), but that has not been specifically authorized under
criteria established by an E.O. or an Act of Congress to be kept
secret in the interest of national defense or foreign policy.
- E2.1.53.
System. A set of interrelated components consisting of mission,
environment, and architecture as a whole.
- E2.1.54.
System Entity. A system subject (user or process) or object.
- E2.1.55.
System Integrity. Quality of an IT system to perform its intended
function in an unimpaired manner, free from deliberate or inadvertent
unauthorized manipulation of the system.
- E2.1.56.
System Security Authorization Agreement (SSAA). A formal agreement
among the DAA(s), the CA, the IT system user representative, and the
program manager. It is used throughout the entire DITSCAP to guide
actions, document decisions, specify ITSEC requirements, document
certification tailoring and level-of-effort, identify potential
solutions, and maintain operational systems security.
- E2.1.57.
TEMPEST. Short name referring to investigation, study, and control
of compromising emanations from IT equipment.
- E2.1.58.
Threat. Any circumstance or event with the potential to cause harm
to an IT system in the form of destruction, disclosure, adverse
modification of data, and/or denial of service.
- E2.1.59.
Threat Assessment. Formal description and evaluation of threat to
an IT system.
- E2.1.60.
Trusted Computing Base (TCB). Totality of protection mechanisms
within a computer system, including hardware, firmware, and software,
the combination responsible for enforcing a security policy.
- E2.1.61.
User. Person or process authorized to access an IT system.
- E2.1.62.
User Representative. The individual or organization that
represents the user or user community in the definition of information
system requirements.
- E2.1.63.
Utility. An element of the DII providing information services to
DoD users. Those services include Defense Information Systems Agency
Mega-Centers, information processing, and wide-area network
communications services.
- E2.1.64.
Validation. Determination of the correct implementation in the
completed IT system with the security requirements and approach agreed
on by the users, acquisition authority, and the DAA.
- E2.1.65.
Verification. The process of determining compliance of the
evolving IT system specification, design, or code with the security
requirements and approach agreed on by the users, acquisition
authority, and the DAA.
- E2.1.66.
Vulnerability. Weakness in an information system, or cryptographic
system, or components (e.g., system security procedures, hardware
design, internal controls) that could be exploited.
- E2.1.67.
Vulnerability Assessment. Systematic examination of an information
system or product to determine the adequacy of security measures,
identify security deficiencies, provide data from which to predict the
effectiveness of proposed security measures, and confirm the adequacy
of such measures after implementation.
|
