7. Notes

This document is structured on MIL-STD-498, described at A forgotten military standard that saves weeks of work (by providing free project management templates), by Kristof Kovacs. Specifically, this document is modeled on STP.html.

7.1. Glossary of Terms

Agile
A programming methodology based on short cycles of feature-specific changes and rapid delivery, as opposed to the “Waterfall” model of system development with long requirements definition, specification, design, build, test, acceptance, delivery sequences of steps.
Botnets System
The name given to the re-implementation of Einstein 1 technology. See http://web.archive.org/web/20131115180654/http://www.botnets.org/
cron
A Unix/Linux service daemon that is responsible for running background tasks on a scheduled basis.
Git
A source code version management system in widespread use.
CIFglue
“Simple rails app to quickly add indicators to the Collective Intelligence Framework”
Cryptographic Hash
Cryptographic Hashing Algorithm
A mathematical method of uniquely representing a stream of bits with a fixed-length numeric value in a numeric space sufficiently large so as to be infeasible to predictably generate the same hash value for two different files. (Used as an integrity checking mechanism). Commonly used algorithms are MD5, SHA1, SHA224, SHA256, RIPEMD-128. (See also http://en.wikipedia.org/wiki/Cryptographic_hash_function).
Einstein 1
A network flow based behavioral and watchlist based detection system developed by University of Michigan and Merit Networks, Inc. for use by US-CERT. The re-implementation is known as the Botnets System.
Fusion Center
Entities created by DHS to integrate federal law enforcement and intelligence resources with state and local law enforcement for greater collaboration and information sharing across levels of SLTT governments.
GZIP
Gnu ZIP (file compression program)
MUTEX
Mutual Exclusion (object or lock, used to synchronize execution of independent threads or processes that must share a common resource in an exclusive manner, or to ensure only one copy of a program is running at a time)
NetFlow
Record format developed by Cisco for logging and storing Network Flow information (see also SiLKTools).
NoSQL
The term for database that does not use the typical table-based relational schema as Relational Database Management Systems (RDBMS)
Ops-Trust (ops-t)
Operational Security Trust organization (see http://ops-trust.net/)
Redis
A “NoSQL” database system used to store files in a key/value pair model via a RESTful HTTP/HTTPS interface.
SiLKTools
A network flow logging and archiving format and tool set developed by Carnegie Mellon’s Software Engineering Institute (in support of CERT/CC).
Team Cymru
(Pronounced “COME-ree”) – “Team Cymru Research NFP is a specialized Internet security research firm and 501(c)3 non-profit dedicated to making the Internet more secure. Team Cymru helps organizations identify and eradicate problems in their networks, providing insight that improves lives.”
Tupelo
A host-based forensic system (client and server) developed at the University of Washington, based on the Honeynet Project “Manuka” system.

7.2. List of Acronyms

AAA
Authentication, Authorization, and Accounting
AMQP
Advanced Message Queuing Protocol
AS
Autonomous System
ASN
Autonomous System Number
CI
Critical Infrastructure
CIDR
Classless Internet Domain Routing
CIF
Collective Intelligence Framework
CIP
Critical Infrastructure Protection
CISO
Chief Information and Security Officer
COA
Course of Action (steps to Respond and Recover)
CONOPS
Concept of Operations
CRADA
Cooperative Research and Development Agreement
CSC
Computer Software Component
CSCI
Computer Software Configuration Item
CSIRT
Computer Security Incident Response Team
CSV
Comma-separated Value (a semi-structured file format)
DIMS
Distributed Incident Management System
DNS
Domain Name System
DoS
Denial of Service
DDoS
Distributed Denial of Service
EO
Executive Order
FQT
Formal Qualification Test/Tests/Testing
HSPD
Homeland Security Presidential Directive
ICT
Information and Communication Technology
IOC
Indicators of Compromise
IP
Internet Protocol (TCP and UDP are examples of Internet Protocols)
IRC
Internet Relay Chat (an instant messaging system)
JSON
JavaScript Object Notation
MAPP
Microsoft Active Protections Program
MNS
Mission Needs Statement
NCFTA
National Cyber-Forensics & Training Alliance
NTP
Network Time Protocol (a service exploited to perform reflected/amplified DDoS attacks by spoofing the source address of requests, where the much larger responses flood the victim)
OODA
Observe, Orient, Decide, and Act (also known as the “Boyd Cycle”)
PPD
Presidential Policy Directive
PRISEM
Public Regional Information Security Event Management
RBAC
Role Based Access Control
RESTful
Representational State Transfer web service API
RPC
Remote Procedure Call
SCADA
Supervisory Control and Data Acquisition
SIEM
Security Information Event Management (sometimes referred to as Security Event Information Management, Security Event Monitoring, causing some to pronounce it as “sim-sem”.)
SLTT
State, Local, Territorial, and Tribal (classification of non-federal government entities)
SOC
Security Operations Center
SoD
Security on Demand (PRISEM project support vendor)
SSH
Secure Shell
STIX
Structure Threat Information Expression. A standard for information exchange developed by MITRE in support of DHS US-CERT.
TAXII
Trusted Automated Exchange of Indicator Information
TCP
Transmission Control Protocol (one of the Internet Protocols)
TLP
Traffic Light Protocol
TTP
Tools, Tactics, and Procedures
UC
Use Case
UDP
Unreliable Datagram Protocol (one of the Internet Protocols)
WCX
Western Cyber Exchange