Tiffany Iw Section 107

Measures that protect and defend imformation and info systems by ensuring their availability, authentication, confidentiality, non-repudiation.

Confinendiality

Integrity

Availability

Non-repudiation

Authentication

Authorized restriction on info acess/disclosure. Protecting personal privacy/proprietary info.

No unauthorized modification of an entity

Accessible and useable by an authorized entity

Sender and reciever recieve proof of information exchange so neither can deny the information being processed.

Verifying the identity of the user, process, or device. Prerequisite for access to an information system (IS)

Root level intrusion

User level intrusion

Malicious logic

Reconnaissance

Unsuccessful activity attempt

Investigating

Non-compliance activity

Explained Anomaly

Denial of service (DOS)

Unauthorized privileged (aka. Root/ administrative) access to DOD system.

Unauthorized non-privledged acess

Malware installed with malicous intent by adversaries to gain info without user knowledge

Activity that gathers information on DOD systems, applications, and networks that may be used to form an attack

Diliberate attempts to gain acess to DOD system

Events that are potentially malicious/ suspicious / or undergoing further review

Activity that potentially exposes dod sys. to increased risk because of unauthorized users

Suspicious events that are deamed non malicious and don't fit in any other category

Information Assurance Vulnerability Alert

An IA vulnerability may result in an immediate risk to Dod sys. Corrective action must be made due to the severity/risk

Information Assurance vulnerability bullitin

New vulnerabilities that if not corrected could increase risk.

Information Assurance vulnerability Technical Advisory

New vulnerabilities have been identified that do not pose an immediate threat

Communication Tasking Order

Urgent order or request concerning DOD comp. Assets from Naval Network command (NNWC) or higher

Navy Telecommunication Directive

Widely disseminated navy message givinf order or direction about certain IT functions that need to be compiled with.

Collection of updates, fixes and enhancments delivered in a single installable package

Process of identifying, quantifying, and prioritizing the vulnerabilities in a system

A weakness that could be compromised by a threat. Vulnerabilities can be physical/non-physical

Vulnerability is a weakness; threat is an event that can adversly impact operations.

Responsible for orgamizations IS (information systems) program

1.The IA program within command, site, system, enclave.

2. Responsible to local IA command and DAA for ensuring IT site security throughout its life cycle

3.creating site accreditation package.

4. Focal point for IA advisors on behaf of DAA

5. Principal advisor to the DAA

Command cyber readiness inspection

Red and blue team members test the networks for imternal and external vulnerabilities and disseminate current vulnerabilities with patch/fixes. ATO authority.

Evaluation of technical and non-technical security features of an information system

Permission to operate an information system in a specific environment at an acceptable risk level

Official with authority to formally assume responsibility for operating an IS system

Doc with specs on IS hardware, software, and necessary protections to operate securely

Doc that fully discribe security plan

Authorization to Operate

Given authorization to Operate an IS sys and accept the risk of agreed upon security controls

Designated approving authority

Temporary authorization granted for an is to process classified info based on preliminary results of a security evaluation

NIPR to SIPR reliavle human review requires two methods of verification, revuew info