CISSP Practice

The potential for the occurrence of an adverse event if no mitigating action taken (i.e., the potential for any applicable threat to exploit a system vulnerability).

Tracing

An automated procedure performed by software that shows what program instructions have been executed in a computer program and in which sequence they have been executed. Tracing can also be performed manually by following the path of a transaction or an activity from beginning to the end and vice versa.

Tracking cookie

A cookie placed on a user’s computer to track the user’s activity on different websites, creating a detailed profile of the user’s behavior.

Traffic analysis attack

(1) The act of passively monitoring transmissions to identify communication patterns and participants. (2) A form of passive attack in which an intruder observes information about calls (although not necessarily the contents of the messages) and makes inferences from the source and destination numbers or frequency and length of the messages. The goal is to gain intelligence about a system or its users, and may not require the examination of the content of the communications, which may or may not be decipherable. (3) A traffic flow signal from a reader could be used to detect a particular activity occurring in the communications path. (4) An inference attack occurs when a user or intruder is able to deduce information to which he had no privilege from information to which he has privilege. Traffic-flow security protection can be used to counter traffic analysis attacks.

Traffic encryption key (TEK)

A key is used to encrypt plaintext or to super-encrypt previously encrypted text and/or to decrypt ciphertext.

Traffic-flow security

The protection resulting from encrypting the source and destination addresses of valid messages transmitted over a communications circuit. Security is assured due to use of link encryption and because no part of the data is known to an attacker.

Traffic load

The number of messages input to a network during a specific time period.

Traffic padding or flooding

A protection to conceal the presence of valid messages on a communications circuit by causing the circuit to appear busy at all times. Unnecessary data are sent through the circuit to keep it busy and to confuse the intruder. It is a countermeasure against the threat of traffic analysis.

Trans-border data flow

Deals with the movement and storage of data by automatic means across national or federal boundaries. It may require data encryption when data is flowing over some borders.

Transaction

An activity or request to a computer. Purchase orders, changes, additions, and deletions are examples of transactions recorded in a business information environment. A logical unit of work for an end user. Also, used to define a program or a dialog in a computer system.

Transmission control protocol (TCP)

A reliable connection and byte-oriented transport layer protocol within the TCP/IP suite.

Transmission control protocol/Internet protocol (TCP/IP)

TCP/IP is the protocol suite used by the Internet. A protocol suite is the set of message types, their formats, and the rules that control how messages are processed by computers on the network.

Transmission medium

The physical path between transmitters and receivers in a communication network. A mechanism that supports propagation of digital signals. Examples of a transmission medium are cables such as leased lines from common commercial carriers, fiber optic cables, and satellite channels.

Transmittal list

A list, stored and transmitted with particular data items, which identifies the data in that batch and can be used to verify that no data are missing.

Transport layer

Portion of an open system interconnection (OSI) system responsible for reliability and multiplexing of data across network to the level required by the application.

Transport-layer security (TLS)

(1) An authentication and security protocol widely implemented in Web browsers and Web servers. (2) Provides security at the layer responsible for end-to-end communications. (3) Provides privacy and data integrity between two communicating applications. (4) It is designed to encapsulate other protocols, such as HTTP. TLS is new and SSL is old.

Transport mode

IPsec mode that does not create a new IP header for each protected packet.

Tranquility

A property applied to a set of (typically untrusted) controlled entities saying that their security level may not change.

Tranquility principle

A request that changes to an object’s access control attributes are prohibited as long as any subject has access to the object.

Trap