Glossary of Key Information Security Terms (NIST) part 25 / E - F

Set of assurance requirements that represent a point on the Common Criteria predefined assurance scale.

Any observable occurrence in a network or system. Any observable occurrence in a system and/or network. Events sometimes provide indication that an incident is occurring.

A technical review that makes the evidence visible and suitable for analysis; tests performed on the evidence to determine the presence or absence of specific data.

A type of assessment method that is characterized by the process of checking, inspecting, reviewing, observing, studying, or analyzing one or more assessment objects to facilitate understanding, achieve clarification, or obtain evidence, the results of which are used to support the determination of security control effectiveness over time.

Evidence that tends to decrease the likelihood of fault or guilt.

An executive department specified in 5 United States Code (U.S.C.), Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); and a wholly owned government corporation fully subject to the provisions of 31 U.S.C., Chapter 91.

Cryptographic key material used exclusively to safeguard communications transmitted over-the-air during military or organized civil training exercises.

Any data collected from monitoring and assessments as part of the Information Security Continuous Monitoring (ISCM) strategy.

A program that allows attackers to automatically break into a system.

Channel that allows the violation of the security policy governing an information system and is usable or detectable by subjects external to the trusted computing base. See Covert Channel.

SCAP language for specifying checklists and reporting checklist results.

An information system or component of an information system that is outside of the authorization boundary established by the organization and for which the organization typically has no direct control over the application of required security controls or the assessment of security control effectiveness.

An information system service that is implemented outside of the authorization boundary of the organizational information system (i.e., a service that is used by, but not a part of, the organizational information system) and for which the organization typically has no direct control over the application of required security controls or the assessment of security control effectiveness.

A provider of external information system services to an organization through a variety of consumer-producer relationships, including but not limited to: joint ventures; business partnerships; outsourcing arrangements (i.e., through contracts, interagency agreements, lines of business arrangements); licensing agreements; and/or supply chain exchanges.

A network not controlled by the organization.

Security testing conducted from outside the organization’s security perimeter.

Capability of crypto-equipment or secure telecommunications equipment to resist efforts to extract key.

A private network that uses Web technology, permitting the sharing of portions of an enterprise’s information or operations with suppliers, vendors, partners, customers, or other enterprises.

Automatic protection of programs and/or processing systems when hardware or software failure is detected.

Selective termination of affected nonessential processing when hardware or software failure is determined to be imminent.