CISSP Practice

A string of random bits that is used to determine a prime number with the required characteristics.

Principal

An entity whose identity can be authenticated.

Principle of least privilege

The granting of the minimum access authorization necessary for the performance of required tasks.

Privacy

(1) The right of an individual to self-determination as to the degree to which the individual is willing to share with others information about himself that may be compromised by unauthorized exchange of such information among other individuals or organizations. (2) The right of individuals and organizations to control the collection, storage, and dissemination of their information or information about themselves. (3) Restricting access to subscriber or relying party information.

Privacy impact assessment (PIA)

PIA is an analysis of how information is handled (1) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy, (2) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system, and (3) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.

Privacy protection

The establishment of appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of data records to protect both security and confidentiality against any anticipated threats or hazards that could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual about whom such information is maintained.

Private key

(1) The secret part of an asymmetric key pair that is typically used to digitally sign or decrypt data. (2) A cryptographic key, used with a public key cryptographic algorithm that is uniquely associated with an entity and not made public. It is the undisclosed key in a matched key pair—private key and public key—used in public key cryptographic systems. In a symmetric (private) key crypto-system, the key of an entity’s key pair is known only by that entity. In an asymmetric (public) crypto-system, the private key is associated with a public key. Depending on the algorithm, the private key may be used to (a) compute the corresponding public key, (b) compute a digital signature that may be verified by the corresponding public key, (c) decrypt data that was encrypted by the corresponding public key, or (d) compute a piece of common shared data, together with other information. (3) The private key is used to generate a digital signature. (4) The private key is mathematically linked with a corresponding public key.

Privilege management

Privilege management creates, manages, and stores the attributes and policies needed to establish criteria that can be used to decide whether an authenticated entity’s request for access to some resource should be granted.

Privileged accounts

Individuals who have access to set “access rights” for users on a given system. Sometimes referred to as system or network administrative accounts.

Privileged data

Data not subject to usual security rules because of confidentiality imposed by law, such as legal and medical files.

Privileged function

A function executed on an information system involving the control, monitoring, or administration of the system.

Privileged instructions

A set of instructions (e.g., interrupt handling or special computer instructions) to control features (such as storage protection features) generally executable only when a computer system is operating in the executive state.

Privileged process

A process that is afforded (by the kernel) some privileges not afforded normal user processes. A typical privilege is the ability to override the security *.property. Privileged processes are trusted.

Privileged user

An individual who has access to system control, monitoring, or administration functions (e.g., system administrator, information system security officer, system maintainer, and system programmer).

Probative data

Information that reveals the truth of an allegation.

Probe

A device program managed to gather information about an information system or its users.

Problem

Often used interchangeably with anomaly, although problem has a more negative connotation, and implies that an error, fault, failure, or defect does exist.

Problem state

A state in which a computer is executing an application program with faults.

Procedural security

The management constraints; operational, administrative, and accountability procedures; and supplemental controls established to provide protection for sensitive information. Synonymous with administrative security.

Process