Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. Device authenticators include certificates and passwords. Initial authenticator content is the actual content of the authenticator (e.g., the...
The Department of Homeland Security states that web content filtering (WCF) provides protection at the application layer for web traffic by blocking access to suspicious websites, preventing malware from running on systems and networks, and detecting and blocking...
NIST defines perimeter hardening as the monitoring and control of communications at the external boundary of an information system to prevent and detect malicious and other unauthorized communications, using boundary protection devices (e.g. gateways, routers,...
NIST defines patch management as the systematic notification, identification, deployment, installation, and verification of operating system and application software code revisions. These revisions are known as patches, hot fixes, and service packs. (Source) The need...
Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the...
Email filtering is the process of evaluating an organization’s inbound and outbound email traffic and determining what to permit and what to deny. Inbound filtering can scan and then organize messages into different categories before delivery to the user’s...
What is DNS? To access Internet resources by user-friendly domain names rather than IP addresses, users need a system that translates these domain names to IP addresses and back. This translation is the primary task of an engine called the Domain Name Server (DNS)....
NIST describes malware, also known as malicious code, as a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the...
Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish...
