D
DAC - discretionary access control (Access to a resource (file or folder) which can be granted or denied, at the discretion of the "owner" of that resource. This model is based on the idea that there is an owner of a resource, such as a file, who has the authority to decide who has access. In the case of an individual, the creator of a file or folder, is considered to be the owner. At the departmental level, the department manager, or business unit manager, can be assigned ownership, with the authority to grant or deny access and at what level. Access can also be restricted in varying degrees, such as permission to add, change, or edit files, or restricted to "view only," which allows a user to view data, such as customer accounts but is not allowed to make changes.)
DAM - Database Activity Monitor (A suite of tools that can be used to support the ability to identify and report on fraudulent, illegal, or other undesirable behavior, with minimal impact on user operations and productivity.)
DAP - dynamic access policies (Security controls that ensure that systms are running and up-to-date, or that antivirus software is current and running.)
DAST - Dynamic Application Security Testing (A process of testing an application or software product in an operating state, i.e., while it is running.)
DBT - Design Basis Threat (Term used in the context of nuclear facilities. A description of the attributes and characteristics of potential insider and/or external adversaries who might attempt unauthorized removal of nuclear material or engage in sabotage. This type of threat serves as the criteria against which physical protection systems are evaluated, even in the design phase.)
DCFW - Data Center Firewall (A firewall - program or dedicated hardware device that inspects network traffic passing through it and denies or permits that traffic based on a set of rules determined at configuration - designed for, or dedicated to, the protection of a data center, possibly with enhanced security measures or levels.)
DDNS - Dynamic Domain Name System (A service or software which monitors the IP address of a device referenced in the Domain Name System (DNS) record, and looks for changes, such as when a device obtains a new IP address from a service provider, in order to update the IP address.)
DDoS - Distributed Denial of Service Attack (A denial of service attack that uses a number of systems or hosts from around the world, or various geographic locations, to flood and overwhelm a network, in order to make a server or system unavailable.)
DDoSaaS - Distributed Denial of Service-as-a-Service (An online software package sold in underground markets and/or forums using a subscription-based model, created by malware authors who develop malicious code, package it as an online dashboard, complete with instructions, allowing for individual modification, and presented for sale or rent. Can come in a variety of forms, depending on the type or method of attack promoted, such as ransomware, promoted as Ransomware-as-a-Service (RaaS), or denial-of-service attacks.)
DEP - Data Execution Prevention (Security feature used in operating systems which limits access to executable code, such as by marking certain memory locations as "off limits." Can be done via hardware (CPU) or software (operating system).)
DES - Data Encryption Standard (Key algorithm used for electronic data encryption developed by IBM in the 1970s. It was found that it could be broken and no longer considered secure.)
3DES - Triple Data Encryption Standard (Variation of Data Encryption Standard (DES) which uses three rounds of DES encryption. DES was no longer considered secure.)
DevOps - Development and Operations (A software engineering culture and practice that aims to unify software development (Dev) and software operations (Ops). The main characteristic of the DevOps movement is to advocate automation and monitoring at all steps of software construction, from integration, testing, and releasing, to deployment and infrastructure management.)
DevSecOps - Development Security Operations (A software engineering culture and practice that incorporates security (Sec) into software development (Dev) and software operations (Ops) and which strives to automate core security tasks by embedding security controls and processes into the DevOps workflow. )
DGA - Dynamically-Generated Algorithm (Type of cyber attack in which attackers generate new command and control (C&C) hosts with seemingly random domain names, which overcome "block" lists (lists of hosts which are to be blocked) since the new names are not already classified or listed by security systems.)
DHCP - Dynamic Host Configuration Protocol (A method to dynamically assign IP addresses to network devices. It can also assign other IP parameters, such as subnet masks or the IP address of a DNS server.)
DHS - Department of Homeland Security (Cabinet-level agency created by the Homeland Security Act of 2002 in November 2002, intended to oversee and coordinate security efforts related to terrorism and threats against the United States. All or portions of 22 federal agencies, such as the Coast Guard, the Customs Service, and Secret Service were merged or transferred into DHS)
DIACAP - Department of Defense Information Assurance Certification and Accreditation Process (Certification process, released in 2007, required by the Department of Defense involving an evaluation of the extent to which the security controls implemented for a system meet the system's security requirements. Replaced DITSCAP, which had been released in 1997.)
DIARMF - Department of Defense Information Assurance Risk Management Framework
DIB - Defense Industrial Base (Manufacturing and production facilities which make up the military production capabilities of a nation.)
DISA - Defense Information Systems Agency (Agency within the U.S. Department of Defense (DoD) which provides intelligence and communications services to the various branches of the U.S. military. Originally established as the Defense Communications Agency (DCA) in 1960, it was renamed the Defense Information Systems Agency (DISA) in 1991. While its role would expand beyond active military operations and conflict to include humanitarian assistance and disaster relief and services to non-military agencies, such as the U.S. State Department, it has narrowed its focus to the technological side of intelligence and communications systems, but with enhanced capabilities in cyber security, along with offensive and defensive capabilities in cyber warfare.)
DITSCAP - Department of Defense Information Technology Security Certification and Accreditation Process (Certification and accreditation process for military security systems, released in 1997. DITSCAP was replaced by the DIACAP (DoD Information Assurance Certification and Accreditation Process) in 2007.)
DLL - Dynamic Link Library (A module that contains functions (called exported functions or exports) that can be used by another program.)
DLP - Data Leak Prevention (Comprises the actions that orginizations take to prevent unauthorized external parties from gaining access to sensitive data. Data Leak Prevention is somewhat different from Data Loss Prevention, which involves measures to prevent the loss or theft of data. Data leak, technically, means that the confidentiality of data has been compromised even if the data is still there, while data loss means that the data is gone or missing.)
DLP - Data Loss Prevention (Comprises the actions that orginizations take to prevent the loss, theft, or destruction of data. Data loss can involve situations where data is totally missing from a system or is still there, but cannot be accessed, such as when it has been destroyed, corrupted, or encrypted. Data Loss Prevention is somewhat different from Data Leak Prevention, which involves measures to prevent unauthorized access, use, or disclosure of data. Data leak, technically, means that the confidentiality of data has been compromised even if the data is still there, while data loss means that the data is gone or missing.)
DLP - Data Loss Protection (A generic term for any actions that orginizations take to protect system data. It can involve both measures to prevent the loss, theft, or destruction of data (data loss) - situations where data is totally missing from a system or is still there, but cannot be accessed, such as when it has been destroyed, corrupted, or encrypted - as well as measures taken to prevent the compromise of data confidentiality (data leak). Data leak, technically, means that the confidentiality of data has been compromised even if the data is still there, while data loss means that the data is gone or missing.)
DMA - direct memory access (Devices which allow access directly to computer memory.)
DMAIC - Define, Measure, Analyze, Improve, and Control (A management model for information security management systems involving the steps incorporated into, or part of, a continuous improvement process.)
DMS - Distributed/Distribution Management System (Term for Distributed Control Systems (DCS) or Industrial Control Systems (ICS) used by utilities or other industrial systems involving geographically dispersed networks of control devices which operate semi-independently but are part of larger network operations systems.)
DMV - Department of Motor Vehicles (State agencies which oversee the regulation of driving and drivers within their state, set standards for driving privileges, issue or revoke driver's licenses, and maintain records of those issued licenses.)
DMZ - Demilitarized Zone (A buffer zone or network segment located between a protected network and unprotected networks, such as the Internet. Prevents outside traffic from the Internet from directly accessing a protected network.)
DNAT - Dynamic Network Address Translation (Form of Network Address Translation (NAT) process where inside local addresses are automatically (dynamically) assigned an inside global address from a pool of available addresses.)
DNS - Domain Name Service (Sometimes referred to as Domain Name System.) (The service and protocol associated with resolving Internet Protocol (IP) addresses (typically written in dotted-decimal notation form - 10.3.2.1 or 12.56.42.34) to human-recognizable domain names - www.website.com)
DNS - Domain Name System (Sometimes referred to as Domain Name Service.) (The service and protocol associated with resolving Internet Protocol (IP) addresses (typically written in dotted-decimal notation form - 10.3.2.1 or 12.56.42.34) to human-recognizable domain names - www.website.com)
DNSBL - Domain Name System Blacklist (System setup which blocks e-mails from listed domain names.)
DNSSEC - Domain Name Service/System Security (Authentication mechanism which validates the origin of a message to ensure that it is not spoofed and potentially malicious using a combination of PKI (Public Key Infrastructure) - a framework of programs, procedures, communication protocols, and public key cryptography that enables a diverse group of individuals to communicat securely - and digital signatures - hash values encrpted with the sender's private key.)
DNSSEC - Domain Name System Security Extensions (Type of secure protocol used to protect DNS (Domain Name System) operations when Internet names are being resolved with IP addresses.)
DO - Dynamic Optimization (The process of moving and reallocating virtual machines and resources within a cluster environment to maintain optimal performance with balanced and distributed resource utilization.)
DoD - U.S. Department of Defense (Cabinet-level department responsible for oversight of all military branches, military preparedness, defense budgets, and military readiness of the various services)
DoDAF - Department of Defense Architecture Framework (Standard used by the U.S. military in the acquisition, development, and modification of technology and weapons systems to ensure that different devices and systems communicate using the same protocol types, software components, and data elements.)
DoDI - Department of Defense Instruction
DoDM - Department of Defense Manual
DOM XSS - Document Object Model Cross-Site Scripting Attack
DoS - Denial-of-Service Attack (A cyber attack on a network/software which overwhelms or degrades the service or resource, making it unavailable to legitimate users.)
DPI - Deep Packet Inspection engine (Device or software which can conduct extensive analysis of data packets.)
DR - disaster recovery (The process of reacting to an incident or disaster and recovering an organization, its personnel, and its systems to a functioning state.)
DRaaS - Disaster-Recovery-as-a-Service (A cloud-based computing service used for data and system recovery in the event of a disaster.)
DRM - Data Reference Model
DRM - Data Rights Management (Data protection area which involves the use of additional controls beyond normal data security protection measures, such as enhanced access control lists (ACL) imposed on data sets requiring additional permissions or conditions in order to access and use data. DRM serves to control the extent of distribution.)
DRM - Digital Rights Management (Technological measures and tools that businesses use to protect their content, such as software access controls used in the entertainment industry to prevent unauthorized copying of copyrighted videos or movies.)
DRP - Disaster Recovery Plan (A plan to recover organizational operations after a disaster hits. Ideally, will involve a written plan involving an inventory of assets, including employees, an identification of priorities and staffing needs, chain of command, delegation of authority, short-term emergency procedures, and steps to taken to restore operations.)
DRP - Disaster Recovery Planning (The process of planning for recovery from disasters, including the development of a plan, budgeting, implementation, and taking steps toward recovery rediness.)
DSA - Digital Signature Algorithm
DSL - Digital Subscriber Line (A group of technologies that provide high-speed data transmission over existing telephone wiring.)
DSS - Digital Signature Standard (A standard for digital signatures (which are hash values encrypted with the sender's private key), requiring the use of a special digital signature algorithm.)
DWDM - dense wavelength division multiplexing (High-speed optical network technology which uses multiple light wavelengths on a single fiber, with each wavelength capable of supporting multiple simultaneous transmissions.)
DynDNS - Dynamic Domain Name System (A service or software which monitors the IP address of a device referenced in the Domain Name System (DNS) record, and looks for changes, such as when a device obtains a new IP address from a service provider, in order to update the IP address.)