Alyne Glossar

Wichtige Begriffe

2

3

A

    Access Management
    Managing who shall have what kind of access to what objects or systems. Commonly used for describing the managing of access to IT systems.
    Anonymity
    Interacting with a system or data without providing information related to the user of the system or data.
    Application Configuration Management
    Ensuring consistency and integrity of settings of software and underlying infrastructure.
    Application Governance
    Managing an enterprise application from a business and IT perspective from launch to decommissioning.
    Application Release
    Updating the software version of an application.
    Audit Issues
    Formal observations raised in an audit and addressed to the owner for resolution.
    Audit Subjects
    The people or organisational unit that is being audited.
    Authentication
    Proving the identity of a user through knowledge, ownership or biometric based factors.

B

    BA (Business Analyst)
    A common enterprise role representing business requirements and interests while developing new capabilities.
    Backup
    Creating copies of data to be stored in a secondary location for use if the primary location of the data is impacted.
    BAU (Business-as-usual)
    Operating business components without interruption or irregular activity.
    BCM (Business Continuity Management)
    Protecting business components from being impacted by adverse external effects, responding appropriately to a crisis and returning the business to normal operation.
    BIA (Business Impact Assessment)
    Analysing business components to identify potential impacts of likely adverse events.
    Black Box Test
    Testing the functionality or security of a system without prior knowledge of its functioning.
    Blacklisting
    Defining known malicious sources to be blocked from accessing a system or resource.
    Bring Your Own Device
    A policy of allowing members of the organisation to bring their own device for use within the organisation.
    Business Analyst
    A common enterprise role representing business requirements and interests while developing new capabilities.
    Business Integrity
    Operating business elements without interruption and with consistent quality of output.
    Business Process Outsourcing
    Transferring operational responsibility of a business function to an external company.

C

    Capacity Management
    Managing the capacity of performance, storage, space and availability of a resource to meet business needs.
    Cert (Certification)
    Please see UAR.
    Chinese Walls
    The physical, logical or legal separation between business units to ensure independent operation from each other.
    Cloud Service
    Operating a highly scalable IT service on virtualised infrastructure connected through the internet.
    Code
    Machine readable commands in a specific programming language.
    Configuration Hardening
    Secure configuring of software or IT components to prevent weaknesses from being exploited.
    Contingent Workforce
    All members of the organisation including permanent and temporary employees, contractors and service providers.
    CR (Change Request)
    Request to deviate from previously agreed scope, quality or timing.
    Credentials
    Combination of user identification (login) and authentication factor (e.g. password).
    Cryptography
    Transforming information to ensure confidentiality, integrity, availability and authenticity for a defined recipient only.

D

    Data Austerity
    Capturing, processing and storing only the minimal amount of personally identifiable information to successfully execute the business objective.
    Data Integrity
    Ensuring the data has not been changed, deleted or amended in an unauthorised way.
    Data Loss Prevention
    A software system or organisational measures designed to prevent the unwanted disclosure of data to third parties.
    Data Retention
    Ensuring data remains available as required by business need or legal requirement.
    Data Subject
    The natural person identified through personally identifiable information.
    Data at Rest
    Data in the state as it is saved on a physical storage device.
    Data in Motion
    Data as it is being transmitted from one storage medium to another.
    Delta Backup
    Backup of all data parts created or modified since the last backup.
    Digital Certificate
    A digitally signed encryption key that can verify authenticity of a user or device.
    Discounted Cash Flows
    Cash flows discounted to represent the present value of a payment at a later point in time.
    DLP (Data Loss Prevention)
    A software system or organisational measures designed to prevent the unwanted disclosure of data to third parties.
    DPO (Data Privacy Officer)
    Data Privacy Officer.

E

    EDP (External Data Processing)
    A specific kind of external processing of personally identifiable information according to German Privacy Laws.
    EEA (European Economic Area)
    The European Union Member states including Norway and Switzerland.
    Encryption
    Transforming information to ensure confidentiality, integrity, availability and authenticity for a defined recipient only.
    Entitlement
    A granular permission to access a location, information or system in a specific way.
    EU (European Union)
    The European Union Member States.

F

    Federation
    Establishing of trust between identity management systems to enable foreign identities to trust and authenticate towards one another.
    Flash based storage device
    Memory chip based data storage.
    Four Eyes Principle
    Processes that require two different people to complete.

H

    Hacking
    Unauthorised break-in or control circumvention to access an IT system.
    Hardening
    Configuring an application or IT system to prevent exploiting of weaknesses.
    HDD (Hard disk)
    Internal permanent storage in personal computers or servers.
    HR (Human Resources)
    Managing the people lifecycle for an organisation.

I

    IAM (Identity and Access Management)
    Identifying members of the organisation and authenticating them appropriately towards the organisation's systems.
    Identity Federation
    Establishing of trust between identity management systems to enable foreign identities to trust and authenticate towards one another.
    IDS (Intrusion Detection System)
    A system to detect, log and prevent unauthorised external access to IT resources.
    Incident
    An event impacting business operations.
    Incremental Backup
    Backup of all files created or modified since the last backup.
    Information Class
    Grouping of information based on a common protection requirement.
    Information Classification
    Grouping of information based on a common protection requirement.
    Integration Test
    Testing of the interaction of the new components in the target environment.
    Issue
    An identified problem to be resolved within the organisation.
    IT Asset
    Assets operated by the IT department including software, hardware and services.

J

    Jailbreaking
    Circumventing device controls to install a modified operating system and applications on a proprietary system.

K

    Key Backup
    Redundant storage of cryptographic keys to be able to access encrypted data if the primary key is lost.
    Key Distribution
    Providing new cryptographic keys securely to places that require it.
    Key Generation
    Generating cryptographic keys using sufficiently random characters to ensure security.
    Key Storage
    Securing cryptographic keys to prevent misuse.
    KPI (Key Performance Indicator)
    Selected measured values to track performance.

L

    Least Privilege Principle
    Providing only the minimum access required for a person to perform the organisationally assigned task.
    Log File
    Documenting of specific system events relevant to system performance, system errors or security.
    Loss Exposure
    The expected financial, reputational or human loss in the event of a risk occurring.

M

    Malware
    Software that has harmful functions.
    Malware Definition File
    Detection patterns that allow the identification of malware.
    Masking
    Hiding malicious activity.
    Material Business Activities
    Business activities that have a significant influence on the financial wellbeing of the organisation.
    Modelling Language
    A set of graphical and logical elements to consistently describe processes.
    Movers
    People changing their organisational role or position within the organisation.

N

O

    Offsite Backup
    Redundant storage of information physically separated from the location of the original information.
    Opex (Operational expenditure)
    Costs accounted as contributing to operating the organisation.
    Opt Out
    The right to elect not to be contacted for marketing purposes.
    Out of the Box
    Functionality offered by software or hardware without modification.

P

R

    Rack Cages
    Metal, lockable cages encasing racks housing servers or network components.
    Random key generation
    Generating cryptographic keys randomly to decrease probability of unauthorised access.
    RBAC (Role Based Access Control)
    Grouping of permissions required to execute the tasks assigned to a job profile.
    Regression testing
    Retesting of functionality to ensure that related changes did not impact previously correctly performing functionality.
    Release Management
    Managing and coordinating updates to production systems to ensure security and limit interruptions.
    Remote Wiping
    Securely removing all data from a device remotely.
    Residual Risk
    Remaining risk after mitigating actions have been taken.
    Resilience
    The ability to maintain or quickly return to normal operations in face of a disruptive event.
    Retention Period
    The duration through which data must be readily available.
    RfI (Request for Information)
    Buyers asking vendors or service providers for information.
    RfP (Request for Proposal)
    Buyers asking vendors or service providers for a proposal to provide goods or services.
    RfQ (Request for Quotation)
    Buyers asking vendors or service providers for a quote on the cost associated with goods or services.
    Risk Acceptance
    Deliberately accepting risk with understanding of impact and likelihood.
    Risk Appetite
    Defining the amount and type of risk the organisation is willing to accept.
    Risk Events
    A risk with the likelihood of 100%.
    Risk Profile
    The combination of all risks affecting a specific entity including impact and likelihood of these risks.
    Role
    Grouping of permissions required to execute the tasks assigned to a job profile.

S

T

    Technical Accounts
    An account used to authenticate a system rather than a person.
    Technical Analyst
    A common enterprise job profile translating business requirements to technically implementable solutions.
    Test Cycle
    A dedicated phase to test a certain aspect of the solution.
    Time Synchronisation Service
    A service that is used to synchronise system clocks of various systems.
    Toxic Combinations
    A combination of access that allows an individual to circumvent established controls.
    Trojan
    A computer program that has an overt benign function and a covert malicious function.
    Two Factor Authentication
    Using two different methods of authentication to verify a user's identity (e.g. password and token code).

U

V

W

    WACC (Weighted average cost of capital)
    A factor used to define the average return on invested capital to compare with discounted cash flows of an investment project.
    WBS (Work Breakdown Structure)
    Logical and functional grouping of scope blocks.
    Whistleblower
    A member of the organisation reporting wrongdoing or unethical behaviour.
    White Box Test
    Testing of software or hardware with prior knowledge of the functionality of the system.
    Whitelisting
    Definition of permitted applications and deliberate exclusion of all other applications from being executed.
    WiFi (Wireless Fidelity)
    A standard for wireless networking.
    Worm
    A malicious program that can independently spread from one device to another.