CISSP Practice

The protocol used to assign Internet Protocol (IP) addresses to all nodes on the network. DHCP allows network administrators to automate and control from a central position the assignment of IP address configurations. The DHCP server is required to log host-names or message authentication code addresses for all clients. DHCP cannot handle manual configurations where a portion of the network IP addresses needs to be excluded or reserved for severs, routers, firewalls, and administrator workstations. Therefore, the DHCP server should be timed to prevent unauthorized configurations.

Dynamic HTML

A collection of dynamic HTML technologies for generating the Web page contents on-the-fly. It uses the server-side scripts (e.g., CGI, ASP, JSP, PHP, and Perl) as well as the client-side scripts (e.g., JavaScript, JavaApplets, and Active- X controls).

Dynamic separation of duty (DSOD)

Separation of duties can be enforced dynamically (i.e., at access time), and the decision to grant access refers to the past access history (e.g., a cashier and an accountant are the same person but play only one role at a time). One type of DSOD is a two-person rule, which states that the first user to execute a two-person operation can be any authorized user, whereas the second user can be any authorized user different from the first. Another type of DSOD is a history-based separation of duty, which states that the same subject (role) cannot access the same object for variable number of times. Popular DSOD policies are the Workflow and Chinese wall policies.

Dynamic subsystem

A subsystem that is not continually present during the execution phase of an information system. Service-oriented architectures and cloud computing architectures are examples of architectures that employ dynamic subsystems.

Dynamic Web documents

Dynamic Web documents (pages) are written in CGI, PHP, JSP, ASP, JavaScript, and Active-X Controls.

E

E2E

Exchange-to-exchange (E2E) is an e-commerce model in which electronic exchanges formally connect to one another for the purpose of exchanging information (e.g., stockbrokers/dealers with stock markets and vice versa).

Easter egg

An Easter egg is hidden functionality within an application program, which becomes activated when an undocumented, and often convoluted, set of commands and keystrokes are entered. Easter eggs are typically used to display the credits given for the application development team and are intended to be nonthreatening.

Eavesdropping

(1) Passively monitoring network communications for data and authentication credentials. (2) The unauthorized interception of information-bearing emanations through the use of methods other than wiretapping. (3) A passive attack in which an attacker listens to a private communication. The best way to thwart this attack is by making it very difficult for the attacker to make any sense of the communication by encrypting all messages. Also known as packet snarfing.

E-business patterns

Patterns for e-business are a group of proven reusable assets that can be used to increase the speed of developing and deploying net-centric applications, like Web-based applications.

Education (information security)

Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge and strives to produce IT security specialists and professionals capable of vision and proactive response.

Egress filtering

(1) Filtering of outgoing network traffic. (2) Blocking outgoing packets that should not exit a network. (3) The process of blocking outgoing packets that use obviously false Internet Protocol (IP) addresses, such as source addresses from internal networks.

El Gamal algorithm

A signature scheme derived from a modification of exponentiation ciphers. Exponentiation is a mathematical process where one number is raised to some power.

Electromagnetic emanation attack

An intelligence-bearing signal, which, if intercepted and analyzed, potentially discloses the information that is transmitted, received, handled, or otherwise processed by any information-processing equipment.

Electromagnetic emanations (EME)

Signals transmitted as radiation through the air and through conductors.

Electromagnetic interference

An electromagnetic disturbance that interrupts, obstructs, or otherwise degrades or limits the effective performance of electronic or electrical equipment.

Electronic auction (e-auction)