7. Notes¶
This document is structured on MIL-STD-498, described at A forgotten military standard that saves weeks of work (by providing free project management templates), by Kristof Kovacs. Specifically, this document is modelled on SSDD.html.
7.1. Glossary of Terms¶
- Agile
- A programming methodology based on short cycles of feature-specific changes and rapid delivery, as opposed to the “Waterfall” model of system development with long requirements definition, specification, design, build, test, acceptance, delivery sequences of steps.
- Botnets System
- The name given to the re-implementation of Einstein 1 technology. See http://web.archive.org/web/20131115180654/http://www.botnets.org/
- cron
- A Unix/Linux service daemon that is responsible for running background tasks on a scheduled basis.
- Git
- A source code version management system in widespread use.
- CIFglue
- “Simple rails app to quickly add indicators to the Collective Intelligence Framework”
- Cryptographic Hash
- Cryptographic Hashing Algorithm
A mathematical method of uniquely representing a stream of bits with a fixed-length numeric value in a numeric space sufficiently large so as to be infeasible to predictably generate the same hash value for two different files. (Used as an integrity checking mechanism). Commonly used algorithms are MD5, SHA1, SHA224, SHA256, RIPEMD-128. (See also http://en.wikipedia.org/wiki/Cryptographic_hash_function).
I An aggregation of software that satisfies an end use function and is designated for separate configuration management by the acquirer. CSCIs are selected based on tradeoffs among software function, size, host or target computers, developer, support concept, plans for reuse, criticality, interface considerations, need to be separately documented and controlled, and other factors.
- Einstein 1
- A network flow based behavioral and watchlist based detection system developed by University of Michigan and Merit Networks, Inc. for use by US-CERT. The re-implementation is known as the Botnets System.
- Fusion Center
- Entities created by DHS to integrate federal law enforcement and intelligence resources with state and local law enforcement for greater collaboration and information sharing across levels of SLTT governments.
- GZIP
- Gnu ZIP (file compression program)
- MUTEX
- Mutual Exclusion (object or lock, used to synchronize execution of independent threads or processes that must share a common resource in an exclusive manner, or to ensure only one copy of a program is running at a time)
- NetFlow
- Record format developed by Cisco for logging and storing Network Flow information (see also SiLKTools).
- NoSQL
- The term for database that does not use the typical table-based relational schema as Relational Database Management Systems (RDBMS)
- Ops-Trust (ops-t)
- Operational Security Trust organization (see http://ops-trust.net/)
- Redis
- A “NoSQL” database system used to store files in a key/value pair model via a RESTful HTTP/HTTPS interface.
- SiLKTools
- A network flow logging and archiving format and tool set developed by Carnegie Mellon’s Software Engineering Institute (in support of CERT/CC).
- Team Cymru
- (Pronounced “COME-ree”) – “Team Cymru Research NFP is a specialized Internet security research firm and 501(c)3 non-profit dedicated to making the Internet more secure. Team Cymru helps organizations identify and eradicate problems in their networks, providing insight that improves lives.”
- Tupelo
- A host-based forensic system (client and server) developed at the University of Washington, based on the Honeynet Project “Manuka” system.
7.2. List of Acronyms¶
- AAA
- Authentication, Authorization, and Accounting
- AMQP
- Advanced Message Queuing Protocol
- AS
- Autonomous System
- ASN
- Autonomous System Number
- CI
- Critical Infrastructure
- CIDR
- Classless Internet Domain Routing
- CIF
- Collective Intelligence Framework
- CIP
- Critical Infrastructure Protection
- CISO
- Chief Information and Security Officer
- COA
- Course of Action (steps to Respond and Recover)
- CONOPS
- Concept of Operations
- CRADA
- Cooperative Research and Development Agreement
- CSIRT
- Computer Security Incident Response Team
- CSV
- Comma-separated Value (a semi-structured file format)
- DIMS
- Distributed Incident Management System
- DNS
- Domain Name System
- DoS
- Denial of Service
- DDoS
- Distributed Denial of Service
- EO
- Executive Order
- HSPD
- Homeland Security Presidential Directive
- ICT
- Information and Communication Technology
- IOC
- Indicators of Compromise
- IP
- Internet Protocol (TCP and UDP are examples of Internet Protocols)
- IRC
- Internet Relay Chat (an instant messaging system)
- JSON
- JavaScript Object Notation
- MAPP
- Microsoft Active Protections Program
- MNS
- Mission Needs Statement
- NCFTA
- National Cyber-Forensics & Training Alliance
- NTP
- Network Time Protocol (a service exploited to perform reflected/amplified DDoS attacks by spoofing the source address of requests, where the much larger responses flood the victim)
- OODA
- Observe, Orient, Decide, and Act (also known as the “Boyd Cycle”)
- PPD
- Presidential Policy Directive
- PRISEM
- Public Regional Information Security Event Management
- RBAC
- Role Based Access Control
- RESTful
- Representational State Transfer web service API
- RPC
- Remote Procedure Call
- SCADA
- Supervisory Control and Data Acquisition
- SIEM
- Security Information Event Management (sometimes referred to as Security Event Information Management, Security Event Monitoring, causing some to pronounce it as “sim-sem”.)
- SITREP
- SITuational awareness REPort
- SLTT
- State, Local, Territorial, and Tribal (classification of non-federal government entities)
- SOC
- Security Operations Center
- SoD
- Security on Demand (PRISEM project support vendor)
- SSH
- Secure Shell
- STIX
- Structure Threat Information Expression. A standard for information exchange developed by MITRE in support of DHS US-CERT.
- TAXII
- Trusted Automated Exchange of Indicator Information
- TCP
- Transmission Control Protocol (one of the Internet Protocols)
- TLP
- Traffic Light Protocol
- TTP
- Tools, Tactics, and Procedures
- UC
- Use Case
- UDP
- Unreliable Datagram Protocol (one of the Internet Protocols)
- WCX
- Western Cyber Exchange