C
CA - certificate authority (An entity (computer/system) responsible for managing digital certificates (public encryption keys) throughout the certificate life cycle.)
CA - continuous auditing (An auditing technique in IT systems auditing involving the monitoring of computer systems on a continuing basis. Allows for real-time testing, data collection and analysis, using tools such as embedded audit modules (specially written audtit software installed on a system) or integrated test facilities.)
C&A - certification and accreditation (Process requirement for federal information systems which requires federal agencies to first evaluate the security protections implemented for a system against its security requirements and then determine if the risk from operating the system is acceptable to the organization.)
CAaaS - Cyber-Attack-as-a-Service (An online software package sold in underground markets and/or forums using a subscription-based model, created by malware authors who develop malicious code, package it as an online dashboard, complete with instructions, allowing for individual modification, and presented for sale or rent. Can come in a variety of forms, depending on the type or method of attack promoted, such as ransomware, promoted as Ransomware-as-a-Service (RaaS), or denial-of-service attacks.)
CAASM - Cyber Asset Attack Surface Management (Field of cybersecurity which deals with identifying vulnerabilities related to system attack surface (number of points of system access), reducing the attack surface, and mitigating or developing defensive mechanisms where the attack surface is exposed.)
CAB - Change Advisory Board (Individuals within an organization responsible for reviewing and either approving or denying proposed changes to IT functions or processes, such as changes to network infrastructure, application software, or database structure.)
CAC - common access card (Term used by government organizations for smart cards, containing circuitry that stores the user's certificate which contains the user's public key for authentication, as well as encryption.)
CAESARS - Continuous Asset Evaluation, Situational Awareness and Risk Scoring (Department of Homeland Security (DHS) which provides technical guidance for agencies implementing continuous monitoring programs.)
Caesar Cipher - Ancient encryption cipher (Encryption cipher belonging to a class of ciphers known as substitutions ciphers in which each letter of the plain text is substituted for one letter in the cipher text. One of the oldest recorded ciphers known, said to have been used by Julius Caesar.)
CAM - centralized application management (A method of remotely implementing and administering operating systems as well as applications on a server using a cloud service, which creates a virtual desktop.)
CAPTCHA - Completely Automated Public Turing test to tell Computers and Humans Apart (A graphical representation of data, normally a skewed graphic which looks like letter characters which a person must re-enter in a field to prove that they are a human and not an automated tool, such as a software robot. CAPTCHA relies on the fact that while computers can use optical character recognition (OCR) to identify many characters, they cannot easily identify or interpret graphics resembling characters as well as humans might.)
CASB - cloud access security broker (A software service or appliance that is deployed between an organization's on-premises infrastructure and a cloud provider's infrastructure.)
CBC - Cipher Block Chaining (Encyrption method in which messgages are encrypted using blocks of bits, instead of encrypting individual bits, and the ciphertext from each encrypted block is incorporated into the next encryption block to produce a random output value, and the encrypted output is incorporated in to the next block, so that the blocks are "chained" together.)
CBC-MAC - Cipher Block Chaining - Message Authentication Code (An encryption method in which the sender encrypts a message using a symmetric block algorithm in block-chaining mode, with the last block used as the MAC. The sender then sends the plaintext message and an appended copy of the encrypted MAC to the receiver who encrypts the plaintext message and compares it to the MAC. If they match the receiver knows the message was not modified and the system from which it came.)
CBF - Critical Business Function (Functions or business activities which must be maintained, or are considered crucial to the survival of a business, without which the business would not survive.)
CC - Common Criteria (An ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standard for computer security certification, consisting of guidelines and specifications for the evaluation of IT security resources to ensure they meet an agreed-upon set of security standards, specifically focusing on government computing and security needs. The Common Criteria for Infomation Technology Security Evaluation has been formalized as an international standard in ISO/IEC 15408.)
CCB - Change Control Board (Organizational body consisting of various authoritative and qualified individuals within an organization who review proposed changes and approve or deny those changes.)
CCE - Consequence-Driven, Cyber-Informed Engineering (A cyber security risk mitigation methodology to systematically analyze the potential impact of cyber-enabled sabotage by addressing issues related to existing exploits, current and future vulnerabilities, and potential process and organizational weaknesses.)
CCEVS - Common Criteria Evaluation and Validation Scheme for IT Security (An evaluation program based on the ISO/IEC (International Organization for Standardization/International Electrotechnical Commission) standard for computer security certification, consisting of guidelines and specifications for the evaluation of IT security resources to ensure they meet an agreed-upon set of security standards, specifically focusing on government computing and security needs. The Common Criteria for Infomation Technology Security Evaluation has been formalized as an international standard in ISO/IEC 15408.)
CCFW - Carrier Class Firewall (Type of next generation firewall (NGFW) characterized by extremely high speed analysis and logging capabilities (40 Gbps throughput, 10 million concurrent sessions, 100,000 connections per second and the ability to generate 100,000 logs per second) for intrusion detection, advanced intrusion prevention systems (IPS) capabilities, and incorporating external threat intelligence souces and awareness to anticipate emerging worldwide threats. Carrier-class firewalls offer the most advanced technological capabilities and cyber protection, but are also very expensive, which makes them practically available only to the largest organizations.)
CCIPS - Computer Crime and Intellectual Property Section (Division within the U.S. Department of Justice (DOJ) which deals with cybercrimes, investigating and prosecuting violations of federal laws in the intellectual property area, with a focus on computer laws.)
CCM - Cloud Controls Matrix (A set of security controls created by the Cloud Security Alliance (CSA) that provides fundamental security principles to guide cloud vendors and to assist prospective cloud customers in assessing the overall security risk of a cloud provider.)
CCM (CBC-MAC) - Cipher Block Chaining - Message Authentication Code (An encryption method in which the sender encrypts a message using a symmetric block algorithm in block-chaining mode, with the last block used as the MAC. The sender then sends the plaintext message and an appended copy of the encrypted MAC to the receiver who encrypts the plaintext message and compares it to the MAC. If they match the receiver knows the message was not modified and the system from which it came.)
CCMP - Cipher Block Chaining Message Authentication Code Protocol (Protocol name for an encryption method in which the sender encrypts a message using a symmetric block algorithm in block-chaining mode, with the last block used as the MAC. The sender then sends the plaintext message and an appended copy of the encrypted MAC to the receiver who encrypts the plaintext message and compares it to the MAC. If they match the receiver knows the message was not modified and the system from which it came.)
CCNFW - Carrier-Class Network Firewall (Type of next generation firewall (NGFW) characterized by extremely high speed analysis and logging capabilities (40 Gbps throughput, 10 million concurrent sessions, 100,000 connections per second and the ability to generate 100,000 logs per second) for intrusion detection, advanced intrusion prevention systems (IPS) capabilities, and incorporating external threat intelligence souces and awareness to anticipate emerging worldwide threats. Carrier-class firewalls offer the most advanced technological capabilities and cyber protection, but are also very expensive, which makes them practically available only to the largest organizations.)
CCTV - Closed-Circuit Television system (Monitoring system consisting of cameras, transmitters, receivers, a recording system, and monitors used to view physical areas or facility locations for instruders or suspicious activity.)
CDS - Cyber Deception Services (Cybersecurity defense services employing deception technology (DT), which can be offered as software or on a contract basis. Deception technology is designed to act as a decoy mechanism which will attract cyber criminals away from a company's real systems and data. Detection technology can involve functions such as honey pots, honey nets, honey tokens, or virtual shadow or fake systems.)
CDS - Cyber Deception System (Cybersecurity defense system which employs deception technology (DT) designed to act as a decoy mechanism which will attract cyber criminals away from a company's real systems and data. CDS can involve functions such as honey pots, honey nets, honey tokens, or virtual shadow or fake systems.)
CER - crossover error rate or equal error rate (Represents the point, in a biometric system (system which verifies an individual's identity) at which the false rejection rate (FRR) - the rate at which valid subjects are rejected - equals the false acceptance rate (FAA) - the rate at which invalid subjects are accepted. )
CERT - Computer Emergency Response Team (A group or unit of information security specialists within an organization, or hired on a contract basis, responsible for dealing with serious cybersecurity situations, rising to the level of an "emergency," such as cyber attacks resulting in system shutdowns, destruction or loss of large amounts of data, destruction or shutdowns of equipment or power grids, ransomware, or denial-of-service attacks. Depending on the size of an organization or its budget, responsibilities may vary and could involve preventive analysis and preparation or advising on preventive measures.)
CERT - United States Computer Emergency Readiness Team (US CERT) (Agency within the National Cybersecurity and Communications Integration Center (NCCIC) which provides round-the-clock monitoring for emerging cybersecurity threats, and issues alerts about significant cybersecurity issues it has detected. In November 2018, the NCCIC, and US-CERT, became part of the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS), under the Cybersecurity and Infrastructure Security Act of 2018.)
CERT/CC - Computer Emergency Response Team Coordination Center (A division within the Software Engineering Institute (SEI) which originated the concept of the "Computer Emergency Response Team." SEI is a federally-funded research and development center managed by Carnegie Mellon University.)
CFB - Cipher Feedback Mode (Method of encrypting messages in which ciphertext (encrypted data) is combined with plaintext (unencrypted data) in order to generate random output within encrypted messages. The goal is to eliminate or reduce patterns within the encrypted message which could allow reverse-engineering of the encryption to uncover the key.)
CHAP - Challenge-Handshake Authentication Protocol (a remote access authentication protocol in which the authenticating system challenges the remote client, which must provide the proper respone, which is then compared by the authenticating server to its list of responses - if the server receives the answer it expects, the user is authenticated)
CIA - Central Intelligence Agency (U.S. government agency with responsibility for foreign intelligence activities.)
CIA - Confidentiality, Integrity, Availability (also known as the AIC Triad) (The three tenets or principles of information system security: 1) Confidentiality - Confidential information, such as private data about individuals, or information considered confidential by businesses, should be kept confidential and accessible only by those authorized to view it. 2) Integrity - Information cannot be corrupted or changed, unless the change is made by someone authorized to make changes; and 3) Availability - Information should be accessible to authorized users whenever they need or request the information.)
CIA-UAA - Confidentiality, Integrity, Availability of Data, User Accountability, Authentication, and Audit (also known as the AIC Triad) (The three tenets or principles of information system security: 1) Confidentiality - Confidential information, such as private data about individuals, or information considered confidential by businesses, should be kept confidential and accessible only by those authorized to view it. 2) Integrity - Information cannot be corrupted or changed, unless the change is made by someone authorized to make changes; and 3) Availability - Information should be accessible to authorized users whenever they need or request the information. Accountability, Authentication, and Audit )
CI/CD - Continuous Integration/Continuous Deployment (A set of tools often used with DevOps to establish a consistent and automated way to build, package, and test applications. Also referred to as continuous integration/continuous delivery, depending on the target environment (development or production).)
CIE - Cyber-Informed Engineering (The concept that modern cybersecurity of industrial control systems (ICS) should consider the cyber implications of an engineering design in all stages of a systems lifecycle, just as much as concerns about reliability and safety.)
CII - Critical Information Infrastructure (The information technology component, such as hardware, software, and data, of essential services, such as telecommunications, finance/banking, food production, transport and logistics, energy and utilities, as well as critical government services.)
CIIP - Critical Information Infrastructure Protection (Protection focusing on the information systems and technology component of Critical Infrastructure Protection (CIP). CIIP requires that critical functions, such as signalling for trains, or gas transmission monitoring for utilities, run separately from the administrative network system used for corporate e-mails.)
CI/KR - critical infrastructure and key resource (Economic classification for infrastructure systems used by the North American Electric Reliability Corporation (NERC) deemed essential enough that they deserve higher priority and special attention when it comes to system hardening. Infrastructure systems, such as power, telephone, and financial grids, fall under this category and must be protected against risks from natural disasters and terrorism.)
CIP - Critical Infrastructure Protection (A family of standards from the North American Electric Reliability Corporation (NERC) which promote the hardening of infrastructure systems, such as power, telephone, and financial grids against risks from natural disasters and terrorism.)
CIRT - Computer Incident Response Team (A unit or group within an organization responsible for preparing and handling security incidents involving computer systems.)
CIS - Center for Internet Security (nonprofit organization focused on securing IT systems and data and setting standards)
CISA - Cybersecurity and Infrastructure Security Agency (Agency within the Department of Homeland Security (DHS) with responsibility for security issues involving infrastructure and industry sectors considered critical to the economic and social well-being of the US. Included are sectors such as chemicals, communications, manufacturing, defense, healthcare, and energy.)
CISA - Certified Information Systems Auditor (Certification offered by ISACA (Information Systems Audit and Control Association) for individuals with experience and understanding of the standards, principles, methods, guidelines, practices, and techniques involved in planning and conducting audits of IT systems.)
CISA Act of 2015 - Cybersecurity Information Sharing Act of 2015 (Federal law intended to encourage cooperation and information sharing between federal agencies and private organizations in the area of cybersecurity. Provides guidance, policies, and procedures relating to the receipt, use, and sharing of cyber threat information received by federal agencies with businesses and organizations in the private sector, as well as the sharing of information about cyber attacks or threats against private sector businesses and organizatons with federal agencies.)
CISA Act of 2018 - Cybersecurity and Infrastructure Security Agency Act of 2018 (Federal legislation which established the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS) which focuses on and coordinates seurity activities relating to threats to critical infrastructure, both cyber and physical.)
CJA - Crown Jewels Analysis (A process for identifying those cyber assets that are most critical to the accomplishment of an organization's mission.)
CLDAP - Connectionless Lightweight Directory Access Protocol (A reflective denial-of-service flood attack which produces a large volume of requests. A CLDAP attack involves a malformed request to a vulnerable Lightweight Directory Access Protocol (LDAP) server which has difficulty processing the request and wastes resources in the attempt. LDAP allows users to request information about a resources and also allows applications to request information about a user.)
CLI - command-line interface (User interface in which the user types in commands or instructions to locate information or provide command instructions for the system to carry out.)
CM - Configuration Management (The process of establishing and maintaining effective system controls, which is also part of operational security.)
CMAC - Cipher-Based Message Authentication Code (Variation of CBC-MAC, but is based on more complex logic and mathematical functions and, as a result, is considered more secure.)
CMS - Centers for Medicare and Medicaid Services (Agency within the U.S. Department of Health and Human Services (HHS) which oversees the Medicare and Medicaid programs.)
CMS - Central Management System (A software or contract-based service which provides centralized management capabilities for managing other software, services, systems, or devices.)
CMS - Communications Security Material System (Cryptographic key distribution system used by the U.S. Navy to secure its cryptosystems.)
CMS - Configuration Management System (Software allowing an organization to manage the creation, publication, and updating of a set of web pages and other documents that have multiple authors. (Also known as a Content Management System))
CMS - Content Management System (Software allowing an organization to manage the creation, publication, and updating of a set of web pages and other documents that have multiple authors. (Also known as a Configuration Management System))
CMS - Conversational Monitor System (The interactive part of IBM's VM/SP operating system for mainframe computers.)
CMVP - Cryptologic Module Validation Program (Publicly available inventory of validated technologies maintained by the National Institute of Standards and Technology (NIST) which serves as a source of information to confirm whether products or technologies comply with federal security standards.)
CNA - Computer Network Attack (Generic term for cyber attacks involving hacking of computer networks or the development of mechanisms to attack systems.)
CNCI - Comprehensive National Cybersecurity Initiative (Program initiated by President Bush in 2008 intended to create or enhance awareness of cyber network vulnerabilities and threats, enhance counterintelligence capabilities, and expand educations and research in cyberspace.)
CND - Computer Network Defense (Measures taken to set up or enhance network systems to defend against cyber attacks.)
CNE - Computer Network Exploitation (Hacking computer systems and networks to siphon data and intelligence.)
CNSS - Committee on National Security Systems (Body created to study and advise federal agencies on standards to be used for national security systems.)
CNSSI - Committee on National Security Systems Instruction (Set of guidelines for system security for federal agencies within the national security system.)
CO - Central Office (Term for a communications center used in the U.S. phone system which controlled or managed phone service communications within a region.)
COA - Ciphertext-only Attack (A cyber attack in which the attacker sends an encrypted message, after having guessed or discovered, or thinking they discovered the encryption algorithm from analyzing encrypted messages.)
COBIT - Control Objectives for Information and Related Technology (Set of generally accepted measures, guidelines, standards, and best practices to be followed by managers for information system governance and control, created by the Information Systems Audit and Control Association (ISACA).)
CONOPS - Concept of Operations (A description of the actions necessary to achieve an end goal. CONOPS can be used to describe an organizational project or any goal-oriented undertaking, such as a cyber attack.)
COO - continuity of operations (U.S. government or public-sector initiative to ensure that federal agencies have planned for and taken steps to ensure that they are able to continue operations after a disaster or disruption. The plan designates senior management and establishes a headquarters after a disaster, outlines roles and authorities, orders of succession, and provides for the assignment of individual role tasks.)
COO - Chief Operating Officer (Officer of a firm, usually the president or an executive vice president, responsible for day-to-day managemeent of operations.)
COOP - continuity of operations (U.S. government or public-sector initiative to ensure that federal agencies have planned for and taken steps to ensure that they are able to continue operations after a disaster or disruption. The plan designates senior management and establishes a headquarters after a disaster, outlines roles and authorities, orders of succession, and provides for the assignment of individual role tasks.)
COSO - Committee of Sponsoring Organizations of the Treadway Commission (Body formed in 1985 to identify factors that contributed to fraudulent financial reporting. COSO issued guidance on internal controls which provided a framework for internal controls in 1992, and updated in 2013.)
CP - Contingency Plan
CPIC - Capital Planning and Investment Control (Government)
CPTED - crime prevention through environmental design (A discipline or planning process intended to reduce criminal activity by incorporating design features into facilities or surrounding areas which physically limit access to facilities or psychologically inhibit actions, such as providing areas where large groups of people might observe criminal activity.)
CRAMM - Central Computing & Telecommunications Agency Risk Analysis & Management Method (British/UK)
CSA - Cloud Security Alliance (Nonprofit organization with a mission to promote best practices for using cloud computing security - provides guidelines and standards related to cloud security.)
CSAM - Cyber Security Assessment and Management (Government)
CSIAC - Cybersecurity and Information Systems Information Analysis Center (US Department of Defense (DoD) agency which studies engineering practices related to software development and security, and serves as an educational resource for software security practices.)
CSIRT - Computer Security Incident Response Team
CSP - cloud service provider (A company or organization that offers some component of cloud computing - typically services such as Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS), or Platform-as-a-Service (PaaS) - to other businesses or individuals.)
CSP - Content Security Policy (A set of restrictions imposed on a web resource to deal with cross-site scripting (XSS) vulnerabilities by defining a distinction between instructions and content, to selectively disable or enable script execution based on the script's origin.)
CSDLC - Cloud Secure Development Lifecycle (Cloud variant of the Secure Development Lifecycle (SDLC), which operates in a much more accelerated manner, while still focusing on secure software development concepts, from development through testing and maintenance.)
CSMA - Cybersecurity Mesh Architecture
CSRF (XSRF) - cross-site request forgery (Type of attack in which an attacker attempts to steal authentication information from session cookies during the user's current browsing session. The user is usually tricked into visiting a malicious website through redirection or phishing, and the malicious website executes code that attempts to steal authentication information and impersonate the user. This attack requires that the user already be authenticated to the secure site, so that their session credentials are stored in the browser.)
CSS - Cascading Style Sheets (A formatting language used in Web Design which incorporate a set of Hypertext Markup Language (HTML) rules to provide a consistent appearance to Web pages.)
CSS or (XSS) - Cross-site Scripting (Type of attack in which a victim's computer/browser executes malicious code which has been injected into a vulnerable web page. Usually a victim visits an infected web page and takes some action which allows a malicious script to execute. The most common locations where malicious code will be encountered are online forums, message boards, search boxes, social networking websites, and links embedded in e-mails.)
C-UAS - Counter-Unmanned Aircraft System (A system designed to detect, track, and identify unmanned aerial vehicles (UAV), essentially drones, and if a threat, to disrupt or destroy the UAV or the system they are part of.)
CUI - Controlled Unclassified Information (Classification category within the U.S. government classification system for information which does not reach a level sufficiently critical to national security or military security to fall within a "classified" category, but is considered to be of a sensitive or confidential nature such that it should have some restrictions on disclosure, or special protection, or special handling safeguards, or limits on exchange or dissemination.)
CVE - Common Vulnerabilities and Exposures (Dictionary/database, maintained by the Mitre Corporation, of publicly known information about cybersecurity vulnerabilities and exposures.)
CVSS - Common Vulnerability Scoring System (Method of measuring vulnerabilities based on a standardized set of vulnerability characteristics.)
CWE - Common Weakness Enumeration (A list of the most dangerous software and programming issues, created by the Mitre Corporation and SANS Institute.)
CyTRICS - Cybersecurity Testing for Resilience of Industrial Control Systems (ICS) (U.S. Department of Energy (DOE) program for analyzing weaknesses and recovery capabilities in industrial control systems.)