C
CA - certificate authority (An entity (computer/system) responsible for managing digital certificates (public encryption keys) throughout the certificate life cycle.)
CA - continuous auditing (An auditing technique in IT systems auditing involving the monitoring of computer systems on a continuing basis. Allows for real-time testing, data collection and analysis, using tools such as embedded audit modules (specially written audtit software installed on a system) or integrated test facilities.)
C&A - certification and accreditation (Process requirement for federal information systems which requires federal agencies to first evaluate the security protections implemented for a system against its security requirements and then determine if the risk from operating the system is acceptable to the organization.)
CAaaS - Cyber-Attack-as-a-Service (An online software package sold in underground markets and/or forums using a subscription-based model, created by malware authors who develop malicious code, package it as an online dashboard, complete with instructions, allowing for individual modification, and presented for sale or rent. Can come in a variety of forms, depending on the type or method of attack promoted, such as ransomware, promoted as Ransomware-as-a-Service (RaaS), or denial-of-service attacks.)
CAASM - Cyber Asset Attack Surface Management (Field of cybersecurity which deals with identifying vulnerabilities related to system attack surface (number of points of system access), reducing the attack surface, and mitigating or developing defensive mechanisms where the attack surface is exposed.)
CAB - Change Advisory Board (Individuals within an organization responsible for reviewing and either approving or denying proposed changes to IT functions or processes, such as changes to network infrastructure, application software, or database structure.)
CAC - common access card (Term used by government organizations for smart cards, containing circuitry that stores the user's certificate which contains the user's public key for authentication, as well as encryption.)
CAD - Computer-Aided Design (The use of a computer for design work in fields such as engineering or architecture, with the computer's graphics capabilities substituting for work that traditionally would have been done with pencil and paper.)
Caesar Cipher - Ancient encryption cipher (Encryption cipher belonging to a class of ciphers known as substitutions ciphers in which each letter of the plain text is substituted for one letter in the cipher text. One of the oldest recorded ciphers known, said to have been used by Julius Caesar.)
CAESARS - Continuous Asset Evaluation, Situational Awareness and Risk Scoring (Department of Homeland Security (DHS) which provides technical guidance for agencies implementing continuous monitoring programs.)
CAG - Chassis Air Guide design guide (Specification guide for a thermally advantaged chassis (frame that houses the motherboard, power supply, disk drives, adapter cards, and any other physical components in the system), originally published in 2002, which provided specifications for a processor duct and for an additional vent in the side cover for adapter cards such as graphics boards.)
CAI - computer-aided instruction (instruction based in whole or in part on the use of computers to teach in person, remotely, or to promote interaction with students.)
CAM - centralized application management (A method of remotely implementing and administering operating systems as well as applications on a server using a cloud service, which creates a virtual desktop.)
CAM - Common Access Method (Design standard for disk drive pin connectors intended to standardize attachment manufacturing and use.)
CAM - Computer Aided Manufacturing (The use of computers in a manufacturing process, usually involving the storage of a three-dimensional object in memory and the use of computer-controlled automated machinery.)
CAM ATA - Common Access Method Advanced Technology Attachment (Official standard for 40-pin ATA connector and drive interface design.)
CAN bus - Controller Area Network bus (Protocol designed to allow microcontrollers and other embedded devices to communicate with each other on a shared bus. Its most common use is to run automobiles.)
CAP - Carrierless Amplitude/Phase (Digital subscriber line (DSL) transmission method for sending and receiving signals for both high-speed Internet traffic and phone calls. CAP splits a telephone line into three frequency bands, one for voice and the other two for Internet transmissions.)
CAPTCHA - Completely Automated Public Turing test to tell Computers and Humans Apart (A graphical representation of data, normally a skewed graphic which looks like letter characters which a person must re-enter in a field to prove that they are a human and not an automated tool, such as a software robot. CAPTCHA relies on the fact that while computers can use optical character recognition (OCR) to identify many characters, they cannot easily identify or interpret graphics resembling characters as well as humans might.)
CAS - column address strobe latency (A method of measuring speed for PC memory based on the number of clock cycles occurring between the registration of the CAS signal and the resultant output data. A lower number of cycles indicates faster (better) performance.)
CASB - cloud access security broker (A software service or appliance that is deployed between an organization's on-premises infrastructure and a cloud provider's infrastructure.)
CASE - computer-aided software engineering
CATV - cable television
CATV - coaxial cable television
CAV - Constant Angular Velocity (CD drive speed)
CBC - Cipher Block Chaining (Encyrption method in which messgages are encrypted using blocks of bits, instead of encrypting individual bits, and the ciphertext from each encrypted block is incorporated into the next encryption block to produce a random output value, and the encrypted output is incorporated in to the next block, so that the blocks are "chained" together.)
CBC-MAC - Cipher Block Chaining - Message Authentication Code (An encryption method in which the sender encrypts a message using a symmetric block algorithm in block-chaining mode, with the last block used as the MAC. The sender then sends the plaintext message and an appended copy of the encrypted MAC to the receiver who encrypts the plaintext message and compares it to the MAC. If they match the receiver knows the message was not modified and the system from which it came.)
CBF - Critical Business Function (Functions or business activities which must be maintained, or are considered crucial to the survival of a business, without which the business would not survive.)
CBK - Common Body of Knowledge
CBR - constant bit rate
CBT - Computer-Based Training
CC - Common Criteria (An ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standard for computer security certification, consisting of guidelines and specifications for the evaluation of IT security resources to ensure they meet an agreed-upon set of security standards, specifically focusing on government computing and security needs. The Common Criteria for Infomation Technology Security Evaluation has been formalized as an international standard in ISO/IEC 15408.)
C & C - Command and Control
CCB - Change Control Board (Organizational body consisting of various authoritative and qualified individuals within an organization who review proposed changes and approve or deny those changes.)
CCD - charge(d)-coupled device
CCE - Consequence-Driven, Cyber-Informed Engineering (A cyber security risk mitigation methodology to systematically analyze the potential impact of cyber-enabled sabotage by addressing issues related to existing exploits, current and future vulnerabilities, and potential process and organizational weaknesses.)
CCEVS - Common Criteria Evaluation and Validation Scheme for IT Security (An evaluation program based on the ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standard for computer security certification, consisting of guidelines and specifications for the evaluation of IT security resources to ensure they meet an agreed-upon set of security standards, specifically focusing on government computing and security needs. The Common Criteria for Infomation Technology Security Evaluation has been formalized as an international standard in ISO/IEC 15408.)
CCFL - Cold Cathode Fluorescent Lamp
CCFW - Carrier Class Firewall (Type of next generation firewall (NGFW) characterized by extremely high speed analysis and logging capabilities (40 Gbps throughput, 10 million concurrent sessions, 100,000 connections per second and the ability to generate 100,000 logs per second) for intrusion detection, advanced intrusion prevention systems (IPS) capabilities, and incorporating external threat intelligence souces and awareness to anticipate emerging worldwide threats. Carrier-class firewalls offer the most advanced technological capabilities and cyber protection, but are also very expensive, which makes them practically available only to the largest organizations.)
CCIPS - Computer Crime and Intellectual Property Section (Division within the U.S. Department of Justice (DOJ) which deals with cybercrimes, investigating and prosecuting violations of federal laws in the intellectual property area, with a focus on computer laws.)
CCM - Cloud Controls Matrix (A set of security controls created by the Cloud Security Alliance (CSA) that provides fundamental security principles to guide cloud vendors and to assist prospective cloud customers in assessing the overall security risk of a cloud provider.)
CCM (CBC-MAC) - Cipher Block Chaining - Message Authentication Code (An encryption method in which the sender encrypts a message using a symmetric block algorithm in block-chaining mode, with the last block used as the MAC. The sender then sends the plaintext message and an appended copy of the encrypted MAC to the receiver who encrypts the plaintext message and compares it to the MAC. If they match the receiver knows the message was not modified and the system from which it came.)
CCMP - Cipher Block Chaining Message Authentication Code Protocol (Protocol name for an encryption method in which the sender encrypts a message using a symmetric block algorithm in block-chaining mode, with the last block used as the MAC. The sender then sends the plaintext message and an appended copy of the encrypted MAC to the receiver who encrypts the plaintext message and compares it to the MAC. If they match the receiver knows the message was not modified and the system from which it came.)
CCNFW - Carrier-Class Network Firewall (Type of next generation firewall (NGFW) characterized by extremely high speed analysis and logging capabilities (40 Gbps throughput, 10 million concurrent sessions, 100,000 connections per second and the ability to generate 100,000 logs per second) for intrusion detection, advanced intrusion prevention systems (IPS) capabilities, and incorporating external threat intelligence souces and awareness to anticipate emerging worldwide threats. Carrier-class firewalls offer the most advanced technological capabilities and cyber protection, but are also very expensive, which makes them practically available only to the largest organizations.)
CCNSO - Country Code Domain Name Supporting Organization
ccTLDs - country-code Top-Level Domains
CCTV - Closed-Circuit Television system (Monitoring system consisting of cameras, transmitters, receivers, a recording system, and monitors used to view physical areas or facility locations for instruders or suspicious activity.)
CD - compact disc
CD-DA - compact disc - digital audio format
CD-R - compact disc - recordable
CD-ROM - compact disc - read-only memory
CD-ROM XA- compact disc - read-only memory eXtended architecture
CD-RW - compact disc - rewritable
CDC - Control Data Corporation
CDC - Centers for Disease Control and Prevention (federal agency responsible for tracking disease outbreaks, overseeing medical research, and providing guidelines/guidance for health safety procedures)
CDDI - Copper Distributed Data Interface
CDFS - Compact Disc File System
CDI - constrained data items
CDMA - code division multiple access
CDN - content distribution network
CDR - call-detail recording
CEO - chief executive officer (business structure)
CER - crossover error rate or equal error rate (Represents the point, in a biometric system (system which verifies an individual's identity) at which the false rejection rate (FRR) - the rate at which valid subjects are rejected - equals the false acceptance rate (FAA) - the rate at which invalid subjects are accepted. )
CERT - Computer Emergency Response Team (A group or unit of information security specialists within an organization, or hired on a contract basis, responsible for dealing with serious cybersecurity situations, rising to the level of an "emergency," such as cyber attacks resulting in system shutdowns, destruction or loss of large amounts of data, destruction or shutdowns of equipment or power grids, ransomware, or denial-of-service attacks. Depending on the size of an organization or its budget, responsibilities may vary and could involve preventive analysis and preparation or advising on preventive measures.)
CERT - United States Computer Emergency Readiness Team (US CERT) (Agency within the National Cybersecurity and Communications Integration Center (NCCIC) which provides round-the-clock monitoring for emerging cybersecurity threats, and issues alerts about significant cybersecurity issues it has detected. In November 2018, the NCCIC, and US-CERT, became part of the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS), under the Cybersecurity and Infrastructure Security Act of 2018.)
CERT/CC - Computer Emergency Response Team Coordination Center (A division within the Software Engineering Institute (SEI) which originated the concept of the "Computer Emergency Response Team." SEI is a federally-funded research and development center managed by Carnegie Mellon University.)
CF - CompactFlash (Flash memory)
CFB - Cipher Feedback Mode (Method of encrypting messages in which ciphertext (encrypted data) is combined with plaintext (unencrypted data) in order to generate random output within encrypted messages. The goal is to eliminate or reduce patterns within the encrypted message which could allow reverse-engineering of the encryption to uncover the key.)
CFO - chief financial officer (business structure)
CGI - Common Gateway Interface
CGI - computer-generated image
CGM - Computer Graphics Metafile
CHAP - Challenge-Handshake Authentication Protocol (a remote access authentication protocol in which the authenticating system challenges the remote client, which must provide the proper response, which is then compared by the authenticating server to its list of responses - if the server receives the answer it expects, the user is authenticated)
CHS - cylinder head sector
CIA - Central Intelligence Agency (U.S. government agency with responsibility for foreign intelligence activities)
CIA - Confidentiality, Integrity, Availability (also known as the AIC Triad) (The three tenets or principles of information system security: 1) Confidentiality - Confidential information, such as private data about individuals, or information considered confidential by businesses, should be kept confidential and accessible only by those authorized to view it. 2) Integrity - Information cannot be corrupted or changed, unless the change is made by someone authorized to make changes; and 3) Availability - Information should be accessible to authorized users whenever they need or request the information.)
CIA-UAA - Confidentiality, Integrity, Availability of Data, User Accountability, Authentication, and Audit (also known as the AIC Triad) (The three tenets or principles of information system security: 1) Confidentiality - Confidential information, such as private data about individuals, or information considered confidential by businesses, should be kept confidential and accessible only by those authorized to view it. 2) Integrity - Information cannot be corrupted or changed, unless the change is made by someone authorized to make changes; and 3) Availability - Information should be accessible to authorized users whenever they need or request the information. Accountability, Authentication, and Audit )
CI/CD - Continuous Integration/Continuous Deployment (A set of tools often used with DevOps to establish a consistent and automated way to build, package, and test applications. Also referred to as continuous integration/continuous delivery, depending on the target environment (development or production).)
CIDR - classless interdomain routing (Internet Protocol addressing)
CIE - Cyber-Informed Engineering (The concept that modern cybersecurity of industrial control systems (ICS) should consider the cyber implications of an engineering design in all stages of a systems lifecycle, just as much as concerns about reliability and safety.)
CIFS - Common Internet File System
CIO - chief information officer (business structure)
CIR - committed information rate
CIRC - cross-interleave Reed-Solomon code (disk errors)
CIRT - Computer Incident Response Team (A unit or group within an organization responsible for preparing and handling security incidents involving computer systems.)
CIS - Center for Internet Security (nonprofit organization focused on securing IT systems and data and setting standards)
CIS - computer information system
CISA - Cybersecurity and Infrastructure Security Agency (Agency within the Department of Homeland Security (DHS) with responsibility for security issues involving infrastructure and industry sectors considered critical to the economic and social well-being of the US. Included are sectors such as chemicals, communications, manufacturing, defense, healthcare, and energy.)
CISA - Certified Information Systems Auditor (Certification offered by ISACA (Information Systems Audit and Control Association) for individuals with experience and understanding of the standards, principles, methods, guidelines, practices, and techniques involved in planning and conducting audits of IT systems.)
CISA Act of 2015 - Cybersecurity Information Sharing Act of 2015 (Federal law intended to encourage cooperation and information sharing between federal agencies and private organizations in the area of cybersecurity. Provides guidance, policies, and procedures relating to the receipt, use, and sharing of cyber threat information received by federal agencies with businesses and organizations in the private sector, as well as the sharing of information about cyber attacks or threats against private sector businesses and organizatons with federal agencies.)
CISA Act of 2018 - Cybersecurity and Infrastructure Security Agency Act of 2018 (Federal legislation which established the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS) which focuses on and coordinates seurity activities relating to threats to critical infrastructure, both cyber and physical.)
CISC - complex instruction set computer (chip)
CISO - chief information security officer (business structure)
CL - column address strobe latency
CLDAP - Connectionless Lightweight Directory Access Protocol
CLF - Common Log Format
CLV - constant linear velocity
CM - Configuration Management (The process of establishing and maintaining effective system controls, which is also part of operational security.)
CMAC - Cipher-Based Message Authentication Code (Variation of CBC-MAC, but is based on more complex logic and mathematical functions and, as a result, is considered more secure.)
CMMI - Capability Maturity Model Integration
CMMs - capability maturity models
CMOS - Complementary Metal Oxide Semiconductor
CMS - Content Management System
CMS - Conversational Monitor System
CMS - Centers for Medicare and Medicaid Services (Agency within the U.S. Department of Health and Human Services (HHS) which oversees the Medicare and Medicaid programs.)
CMS - Central Management System
CMS - Communications Security Material System (Cryptographic key distribution system used by the U.S. Navy to secure its cryptosystems.)
CMS - Configuration Management System (Software allowing an organization to manage the creation, publication, and updating of a set of web pages and other documents that have multiple authors. (Also known as a Content Management System))
CMYK - Cyan, Magenta, Yellow, Black (colors)
CMVP - cryptographic module validation program
CN - Correspondent Node (mobile)
CNAME - Canonical Name Records
CNCI - Comprehensive National Cybersecurity Initiative
CNSS - Committee on National Security Systems
CNSSI - Committee on National Security Systems Instruction
CNR - Communications and Networking Riser
CO - Central Office
COA - Care of Address (mobile)
COA - Ciphertext-only Attack
COBIT - Control Objectives for Information and Related Technology (ISACA)
COBOL - Common Business-Oriented Language (programming language)
COC - chip on ceramic
codec - coder-decoder
codec - compressor-decompressor
COM - Component Object Model
CONOPS - Concept of Operations (A description of the actions necessary to achieve an end goal. CONOPS can be used to describe an organizational project or any goal-oriented undertaking, such as a cyber attack.)
COO - continuity of operations (U.S. government or public-sector initiative to ensure that federal agencies have planned for and taken steps to ensure that they are able to continue operations after a disaster or disruption. The plan designates senior management and establishes a headquarters after a disaster, outlines roles and authorities, orders of succession, and provides for the assignment of individual role tasks.)
COO - Chief Operating Officer (Officer of a firm, usually the president or an executive vice president, responsible for day-to-day managemeent of operations.)
COOP - continuity of operations (U.S. government or public-sector initiative to ensure that federal agencies have planned for and taken steps to ensure that they are able to continue operations after a disaster or disruption. The plan designates senior management and establishes a headquarters after a disaster, outlines roles and authorities, orders of succession, and provides for the assignment of individual role tasks.)
CORBA - Common Object Request Broker Architecture
COSO - Committee of Sponsoring Organizations of the Treadway Commission (Body formed in 1985 to identify factors that contributed to fraudulent financial reporting. COSO issued guidance on internal controls which provided a framework for internal controls in 1992, and updated in 2013.)
COTS - commercial off-the-shelf (software)
CP - Contingency Plan
CPIC - Capital Planning and Investment Control (Government)
CP/M - control program for microprocessors
CP/M - Control Program for Microcomputers
CPO - chief privacy officer (business structure)
CPP-GMR - current perpendicular-to-the-plane giant magneto-resistive heads
CPTED - crime prevention through environmental design (A discipline or planning process intended to reduce criminal activity by incorporating design features into facilities or surrounding areas which physically limit access to facilities or psychologically inhibit actions, such as providing areas where large groups of people might observe criminal activity.)
CPU - central processing unit (The part of a computer where arithmetic and logical operations are performed and instructions are decoded and executed.)
CRAMM - Central Computing and Telecommunications Agency Risk Analysis and Management Method (UK)
CRC - cyclic redundancy checking
CRL - certificate revocation list
CRLF - carriage return, line feed
CRM - customer relationship management (software)
CRT - cathode ray tube
CS - cable select (pin)
CS - central switch
CSA - Canadian Standards Agency
CSA - Cloud Security Alliance (Nonprofit organization with a mission to promote best practices for using cloud computing security - provides guidelines and standards related to cloud security.)
CSAM - Cyber Security Assessment and Management (Government)
CSIAC - Cybersecurity and Information Systems Information Analysis Center (US Department of Defense (DoD) agency which studies engineering practices related to software development and security, and serves as an educational resource for software security practices.)
CSIRT - Computer Security Incident Response Team
CSMA - Cybersecurity Mesh Architecture
CSP - cloud service provider (A company or organization that offers some component of cloud computing - typically services such as Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS), or Platform-as-a-Service (PaaS) - to other businesses or individuals.)
CSP - Content Security Policy (A set of restrictions imposed on a web resource to deal with cross-site scripting (XSS) vulnerabilities by defining a distinction between instructions and content, to selectively disable or enable script execution based on the script's origin.)
CSDLC - Cloud Secure Development Lifecycle (Cloud variant of the Secure Development Lifecycle (SDLC), which operates in a much more accelerated manner, while still focusing on secure software development concepts, from development through testing and maintenance.)
CSEL - cable select signal
CSMA - carrier sense multiple access (transmission protocol)
CSMA/CA - carrier sense multiple access with collision avoidance (transmission protocol)
CSMA/CD - carrier sense multiple access with collision detection (transmission protocol)
CSO - chief security officer (business structure)
CSRF (XSRF) - cross-site request forgery (Type of attack in which an attacker attempts to steal authentication information from session cookies during the user's current browsing session. The user is usually tricked into visiting a malicious website through redirection or phishing, and the malicious website executes code that attempts to steal authentication information and impersonate the user. This attack requires that the user already be authenticated to the secure site, so that their session credentials are stored in the browser.)
CSS - Cascading Style Sheets (A formatting language used in Web Design which incorporates a set of Hypertext Markup Language (HTML) rules to provide a consistent appearance to Web pages.)
CSS - contact start stop (drive design)
CSS - Content Scramble/Scrambling System (DVD-Video discs)
CSS or (XSS) - Cross-site Scripting (Type of attack in which a victim's computer/browser executes malicious code which has been injected into a vulnerable web page. Usually a victim visits an infected web page and takes some action which allows a malicious script to execute. The most common locations where malicious code will be encountered are online forums, message boards, search boxes, social networking websites, and links embedded in e-mails.)
CSU/DSU - channel service unit/data service unit (digital communications)
CTR - Counter mode (data encryption)
C-UAS - Counter-Unmanned Aircraft System (A system designed to detect, track, and identify unmanned aerial vehicles (UAV), essentially drones, and if a threat, to disrupt or destroy the UAV or the system they are part of.)
CUI - Controlled Unclassified Information (Classification category within the U.S. government classification system for information which does not reach a level sufficiently critical to national security or military security to fall within a "classified" category, but is considered to be of a sensitive or confidential nature such that it should have some restrictions on disclosure, or special protection, or special handling safeguards, or limits on exchange or dissemination.)
CVE - Common Vulnerabilities and Exposures (Dictionary/database, maintained by the Mitre Corporation, of publicly known information about cybersecurity vulnerabilities and exposures.)
CVSS - Common Vulnerability Scoring System (Method of measuring vulnerabilities based on a standardized set of vulnerability characteristics.)
CWE - Common Weakness Enumeration (A list of the most dangerous software and programming issues, created by the Mitre Corporation and SANS Institute.)
CyTRICS - Cybersecurity Testing for Resilience of Industrial Control Systems (ICS) (U.S. Department of Energy (DOE) program for analyzing weaknesses and recovery capabilities in industrial control systems.)