Glossary
A glossary is very important for personal use but more important is to have a glossary so everyone is using the same terminology and understands the meaning to help ensure proper communications. I’ve begun to alphabetize this glossary by topic.
- Assurance- “Part of corporate governance in which a management provides accurate and current information to the stakeholders about the efficiency and effectiveness of its policies and operations, and the status of its compliance with the statutory obligations.” [1]
- Audit-“Accounting: Systematic examination and verification of a firm’s books of account, transaction records, other relevant documents, and physical inspection of inventory by qualified accountants (called auditors). See also external audit and internal audit. 2. Quality control: Periodic (usually every six months) onsite-verification (by a certification authority) to ascertain whether or not a documented quality system is being effectively implemented.” [2]
- Business case-“A business case captures the reasoning for initiating a project or task. It is often presented in a well-structured written document, but may also sometimes come in the form of a short verbal argument or presentation. The logic of the business case is that, whenever resources such as money or effort are consumed, they should be in support of a specific business need.” [3]
- Business process-“A business process or business method is a collection of related, structured activities or tasks that produce a specific service or product (serve a particular goal) for a particular customer or customers.” [4]
- Business process owner-“A process owner is responsible for managing and overseeing the objectives and performance of a process through Key Performance Indicators (KPI). A process owner has the authority to make required changes related to achieving process objectives.” [5]
- Business value-“In management, business value is an informal term that includes all forms of value that determine the health and well-being of the firm in the long run. Business value expands concept of value of the firm beyond economic value (also known as economic profit, economic value added, and shareholder value) to include other forms of value such as employee value, customer value, supplier value, channel partner value, alliance partner value, managerial value, and societal value. Many of these forms of value are not directly measured in monetary terms.” [6]
- IT Capabilities- “The quality, efficiency and effectiveness of an organization’s IT Capabilities are the key factor that determines the value that an IT organization can deliver.” [8]
- Management- “the act or art of managing: the conducting or supervising of something [as a business].” [10]
- Measurement- “Measurement is the process of quantifying properties of an object by comparing them with a standard unit.” [11]
- Metric- I looked up ‘metric’ and it was just a unit of measurement, but TechTarget had a definition that ties into our study. “A business metric is any type of measurement used to gauge some quantifiable component of a company’s performance, such as return on investment (ROI), employee and customer churn rates, revenues, EBITDA, and so on. Business metrics are part of the broad area of business intelligence, which comprises a wide variety of applications and technologies for gathering, storing, analyzing, and providing access to data to help enterprise users make better business decisions. Systematic approaches, such as the balanced scorecard methodology, can be employed to transform an organization’s mission statement and business strategy into specific and quantifiable goals, and to monitor the organization’s performance in terms of achieving those goals.” [14]
- Planning- “To formulate a scheme or program for the accomplishment, enactment, or attainment.” [12]
- Risk- “Risk is the potential of losing something of value, weighed against the potential to gain something of value. Values (such as physical health, social status, emotional well being or financial wealth) can be gained or lost when taking risk resulting from a given action, activity and/or inaction, foreseen or unforeseen. Risk can also be defined as the intentional interaction with uncertainty.” [13]
1. Assurance, 2014. Retrieved 19 January 2014, from Business Dictionary: http://www.businessdictionary.com/definition/assurance.html.
2. Audit, 2014. Retrieved 19 January 2014, from Business Dictionary: http://www.businessdictionary.com/definition/audit.html
3. Business case, 16 January 2014. Retrieved 19 January 2014, from Wikipedia: http://en.wikipedia.org/wiki/Business_Case.
4. Business process, 6 January 2014. Retrieved 19 January 2014, from Wikipedia: http://en.wikipedia.org/wiki/Business_Process.
5. Business Process Owner, 2010. Retrieved 19 January 2014, from Techopedia: http://www.techopedia.com/definition/4525/process-owner.
6. Business Value, 2 December 2013. Retrieved 19 January 2014, from Wikipedia: http://en.wikipedia.org/wiki/Business_value.
7. Information technology management, 11 May 2015. Retrieved 31 May 2015, from Wikipedia: https://en.wikipedia.org/wiki/Information_technology_management.
8. IT Capabilities, n.d. Retrieved 19 January 2014, from IT Renaissance: http://itrenaissance.com/page95.html.
9. IT Governance Using COBIT and ValIT: Student Book, 2nd Edition. IT Governance Institute. 2007.
10. Management, 2014. Retrieved 19 January 2014, from Merriam-Webster: http://www.merriam-webster.com/dictionary/management.
11. Measurement, n.d. Retrieved 19 Jan 2014, from Learner.org: http://www.learner.org/courses/learningmath/measurement/keyterms.html.
12. Planning, 2014. Retrieved, 19 Jan 2014, from theFreeDictionary: http://www.thefreedictionary.com/planning.
13. Risk, 19 Jan 2014. Retrieved 19 Jan 2014, from Wikipedia: http://en.wikipedia.org/wiki/Risk.
HPA
Host Protected Area
The Host Protected Area (HPA) and Device Configuration Overlay (DCO) are features for hiding sectors of a hard disk from being accessible to the end user. (Google)
At the time HPA was first implemented on Hard Disk firmware, some BIOS had difficulty booting with large Hard Disks. An initial HPA could then be set (by some jumpers on the Hard Disk) to limit the number of cylinder to 4095 or 4096 so that older BIOS would start. It was then the job of the bootloader to reset the HPA so that the operating system would see the full Hard Disk storage space.
HPA can be used by various booting and diagnostic utilities, normally in conjunction with the BIOS. An example of this implementation is the Phoenix FirstBIOS, which uses BEER (Boot Engineering Extension Record) and PARTIES (Protected Area Run Time Interface Extension Services).[3] Another example is the Gujin installer which can install the bootloader in BEER, naming that pseudo-partition /dev/hda0 or /dev/sdb0; then only cold boots (from power-down) will succeed because warm boots (from Control-Alt-Delete) will not be able to read the HPA.
Computer manufacturers may use the area to contain a preloaded OS for install and recovery purposes (instead of providing DVD or CD media).
Dell notebooks hide Dell MediaDirect utility in HPA. IBM and LG notebooks hide system restore software in HPA.
HPA is also used by various theft recovery and monitoring service vendors. For example, the laptop security firm Computrace use the HPA to load software that reports to their servers whenever the machine is booted on a network. HPA is useful to them because even when a stolen laptop has its hard drive formatted the HPA remains untouched.
HPA can also be used to store data that is deemed illegal and is thus of interest to government and police computer forensics teams.[4]
Some vendor-specific external drive enclosures (Maxtor) are known to use HPA to limit the capacity of unknown replacement hard drives installed into the enclosure. When this occurs, the drive may appear to be limited in size (e.g. 128 GB), which can look like a BIOS or dynamic drive overlay (DDO) problem. In this case, one must use software utilities (see below) that use READ NATIVE MAX ADDRESS and SET MAX ADDRESS to change the drive’s reported size back to its native size, and avoid using the external enclosure again with the affected drive.
Some rootkits hide in the HPA to avoid being detected by anti-rootkit and antivirus software.[3]
Some NSA exploits uses HPA[5] for application persistence.
https://en.wikipedia.org/wiki/Host_protected_area
Detection software: http://www.osforensics.com/hidden-areas-hpa-dco.html
Different Types of Kernels
There are, of course, different ways to build a kernel and architectural considerations when building one from scratch. In general, most kernels fall into one of three types: monolithic, microkernel, and hybrid. Linux is a monolithic kernel while OS X (XNU) and Windows 7 use hybrid kernels.
http://www.howtogeek.com/howto/31632/what-is-the-linux-kernel-and-what-does-it-do/
Microkernel
In computer science, a microkernel (also known as μ-kernel) is the near-minimum amount of software that can provide the mechanisms needed to implement an operating system (OS). These mechanisms include low-level address space management, thread management, and inter-process communication (IPC).
https://en.wikipedia.org/wiki/Microkernel
Bus Interface
The bus interface unit is the part of the CPU that interfaces with the rest of the computer. Its name comes from the fact that it deals with moving information over the processor data bus, the primary conduit for the transfer of information to and from the CPU. The bus interface unit is responsible for responding to all signals that go to the processor, and generating all signals that go from the processor to other parts of the system. It is the part of the processor that handles reading and writing to memory and connects the CPU and memory and is responsible for the transfer of data between the processor, memory and I/O devices, instructions and addresses on the system bus to the execution unit.
The Bus interface Unit is an actual physical connection that makes it possible to transfer data from one location in the computer system to another by way of a group of electrical conductors (wires). The more data a bus can handle at one time, the faster it allows information to travel. The speed of the bus, measured in megahertz (MHz), refers to how much data can move across the bus simultaneously. Intel released fourth-generation Core i “Haswell” chips to further improve overclocking which will increase clock and bus speeds and overall speed and performance.
Different types of buses:
ISA (Industry Standard Architecture)
EISA (Extended ISA)
VESA (Video Electronics Standards Association, VL Bus)
PCI (Peripheral Component Interconnect) main system bus, most common bus found in computers today due to plug-and-play characteristics and ability to function with a 64-bit data bus.
USB (Universal Serial Bus)
AGP (Advanced Graphics Port)
The following are important definitions from Holtsnider, B. and Jaffe, B. IT Manager’s Handbook, Third Edition. Morgan Kaufmann. Waltham. 2012.
Adware: “Software that installs itself on a [device] for the purpose of displaying ads to the user … and is considered malware.”
AES: “a data encryption standard.”
Backdoor Trojans: “Trojan horse programs that allow a hacker to control your computer remotely.”
Black List: “a lit of e-mail originators (e-mail and IP addresses) whose messages should always be considered spam.” These are commonly blocked by providers.
Black-hat hackers: “hackers interested in discovering [and exploiting] security flaws.”
CERT: “research and development center at Carnegie Mellon University (funded U.S. Department of Defense and the Department of Homeland Security) that coordinates communication among security information experts.”
Chief Security Officer (CSO): “individual at a corporation in charge of defining and implementing security policies.”
CIA: “Confidentiality, Integrity, and Availability tenants of information security.”
CISSP: “Certified Information Systems Security Professional security certification.”
DARPA (Defense Advanced Research Projects Agency): “federal agency originally responsible for the “network of networks” that became the Internet.”
DES: ” a data encryption standard.”
DMZ (Demilitarized Zone): “an area of a network that is used to host devices that are accessible via the Internet, but are still protected by the firewall.
Firewall: “a device that is used to control access between two networks.”
Incident Response: “the response of an organization to a disaster or other significant event that may significantly affect the organization, its people, or its ability to function productively.”
Intrusion Detection System (IDS): “security software that identifies suspicious traffic (i.e., security threats) based on patterns of activity.”
Intrusion Prevention System (IPS): “security software that not only detects malicious activity (like an IDS), but also takes action to halt it.”
ISO 17799: “an internationally recognized information security standard.”
ISO 270001: “international information security standard against which organizations can seek independent certification of their Information Security Management Systems.”
Key loggers: “small applications that reside on a computer to record key strokes, usually installed without the knowledge or consent of the user, and considered to be malware and spyware.”
Locking down: “configuring an operating system to limit the types of activities the user can do (e.g., configuration changes, software installations, etc.).”
M&M security model: “security model designed to make a system ‘hard on the outside and soft in the middle.'”
Malware: “general term for software designed to damage a computer or computer system. Spyware, adware, and viruses are all considered forms of malware.”
Network Access Control (NAC): “solution for granting access to network resources based upon authentication of the user and the device.”
Page hijacker: “a form of malware that changes a browser’s default home settings, search settings, and such to point to other sites.”
PGP (Pretty Good Privacy): “data encryption method.”
Phishing: “the process of trying to obtain confidential information (e.g., credit card numbers, passwords, social security numbers, bank account numbers, etc.) by sending e-mails that appear to be from legitimate organizations but are in fact fraudulent.”
PKI (Public Key Infrastructure): “enables users to securely exchange data through the use of a public and a private cryptographic key pair that is obtained and shared through a trust authority.”
Rule of Least Privilege: ” users should be granted only the least amount of access to the system, and for the least amount of time necessary, as is authorized for their job.”
Security Incident Response Team (SIRT): ” a formal group assembled within a company to respond to security breaches.”
Spoofing: “the process of forging an e-mail address or IP address. Usually used by hackers for illicit purposes like fraudulently entering a computer or computer network.”
Spyware: “software placed on a computer that monitors a user’s activity. Usually installed without the knowledge or consent of the user, and considered to be malware.”
SSO (Single Sign-on): “a security solution that allows a user to authenticate once, and then have access to all systems and resources for which he[/she] has been granted permission.” In today’s climate, this is considered inadequate.
Trojan horse: “software that appears to be an application but is, in fact, a destructive program.”
White hats: “hackers [that] are interested in security flaws as a way of identifying how security can be improved, and how systems can be better protected; sometimes called ‘ethical hackers.'”
Worm: “a form of malware as a standalone program ([as] opposed to viruses that attach themselves to other objects).”
Zero Day Attack: “a malware attack that takes advantage of a software vulnerability for which the vendor has not released a patch.”
RE – “Requirements engineering is the process of identifying, analyzing, documenting and validating user requirements for a new or modified IT system or service.” Young, R. R. (2003). The Requirements Engineering Handbook. Artech House Publishers.
The following are important definitions from Holtsnider, B. and Jaffe, B. IT Manager’s Handbook, Third Edition. Morgan Kaufmann. Waltham. 2012.
Agile Development: “a method of software development that stresses quick development cycles; it is seen as an alternative to the ‘waterfall’ method.”
Bring Your Own (BYO) Policy: “policy associated with mobile devices that allows employees to use their own devices for work [related activities].”
Cloud computing: “using Internet-based resources (e.g., applications, servers, etc.) as opposed to buying and installing in-house.”