A cryptographic key that is used for both encryption and decryption, enabling the operation of a symmetric key cryptography scheme. Also, a cryptographic algorithm that uses a single key (i.e., a secret key) for both encryption of plaintext and decryption of ciphertext.
A NICE Framework category consisting of specialty areas concerned with conceptualizing, designing, and building secure IT systems, with responsibility for some aspect of the systems' development.
The process of managing and applying security controls in the form of code within DevOps processes and CI/CD pipelines. In the context of security policy, SaC is an effective way to enforce policies within cloud-native and Kubernetes environments.
The use of information technology in place of manual processes for cyber incident response and management. “Network Security Automation” relates to the “automation” of the change management process associated with networking devices such as firewalls. “Cloud Security Automation” relates to the automation of applying policy-based security controls within the build and configuration pipelines often used in cloud-native environments.
A rule or set of rules that govern the acceptable use of an organization's information and services to a level of acceptable risk and the means for protecting the organization's information assets. A rule or set of rules applied to an information system to provide security services.
In the NICE Framework, cybersecurity work where a person: Manages information security (e.g., information security) implications within the organization, specific program, or other area of responsibility, to include strategic, personnel, infrastructure, policy enforcement, emergency planning, security awareness, and other resources (e.g., the role of a Chief Information Security Officer).
A recognizable, distinguishing pattern. Types of signatures: attack signature, digital signature, electronic signature.
The level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its lifecycle, and that the software functions in the intended manner.
In the NICE Framework, cybersecurity work where a person: Develops and writes/codes new (or modifies existing) computer applications, software, or specialized utility programs following software assurance best practices.
The abuse of electronic messaging systems to indiscriminately send unsolicited bulk messages.
A data breach
Faking the sending address of a transmission to gain illegal [unauthorized] entry into a secure system. The deliberate inducement of a user or resource to take incorrect action. Note: Impersonating, masquerading, piggybacking, and mimicking are forms of spoofing.
Software that is secretly or surreptitiously installed into an information system without the knowledge of the system user or owner.
A generic name for a computerized system that is capable of gathering and processing data and applying operational controls to geographically dispersed assets over long distances.
A system of organizations, people, activities, information and resources, for creating and moving products including product components and/or services from suppliers through to their customers.
The process of identifying, analyzing, and assessing supply chain risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken.
A branch of cryptography in which a cryptographic system or algorithms use the same secret key (a shared secret key).
A cryptographic key that is used to perform both the cryptographic operation and its inverse, for example to encrypt plaintext and decrypt ciphertext, or create a message authentication code and to verify the code. Also, a cryptographic algorithm that uses a single key (i.e., a secret key) for both encryption of plaintext and decryption of ciphertext.
In the NICE Framework, cybersecurity work where a person: Installs, configures, troubleshoots, and maintains server configurations (hardware and software) to ensure their confidentiality, integrity, and availability; also manages accounts, firewalls, and patches; responsible for access control, passwords, and account creation and administration.
The attribute of an information system when it performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.
In the NICE Framework, cybersecurity work where a person: Works on the development phases of the systems development lifecycle.
In the NICE Framework, cybersecurity work where a person: Consults with customers to gather and evaluate functional requirements and translates these requirements into technical solutions; provides guidance to customers about applicability of information systems to meet business needs.
In the NICE Framework, cybersecurity work where a person: Conducts the integration/testing, operations, and maintenance of systems security.
In the NICE Framework, cybersecurity work where a person: Develops system concepts and works on the capabilities phases of the systems development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into system and security designs and processes.Tabletop exercise: A discussion-based exercise where personnel meet in a classroom setting or breakout groups and are presented with a scenario to validate the content of plans, procedures, policies, cooperative agreements or other information for managing an incident.
