The Internet of Things Activities in the U.S. Government by Michael Erbschloe - HTML preview

Glossary

Authentication: Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Availability: Ensuring timely and reliable access to and use of information. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Capacity: The information carrying ability of a telecommunications facility. What the “facility” is determines the measurement (e.g., you might measure a data line’s capacity in bits per second). (Newton’s Telecom Dictionary)

Cloud Computing: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models. (NIST Special Publication [SP] 800-145)

Communications: Modern network is the totality of users, devices, data and applications. (National Security Telecommunications Advisory Committee [NSTAC] Secure Government Communications [SGC] Subcommittee Definition)

Confidentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Continuous Monitoring: The process implemented to maintain a current security status for one or more information systems or for the entire suite of information systems on which the operational mission of the enterprise depends. The process includes: (1) the development of a strategy to regularly evaluate selected IA controls/metrics; ( 2) Recording and evaluating IA relevant events and the effectiveness of the enterprise in dealing with those events; ( 3) recording changes to IA controls, or changes that affect IA risks; and (4) publishing the current security status to enable information-sharing decisions involving the enterprise. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Critical Infrastructure and Key Resources (CIKR): Elements that support the essential functions and services that underpin American society. (DHS.gov) Data Aggregation: Compilation of individual data systems and data that could result in the totality of the information being classified, or classified at a higher level, or of beneficial use to an adversary. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Data Integrity: Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Defense-in-Depth: Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Fair Information Practice Principles: A set of eight principles that form the basis of the Department of Homeland Security’s privacy compliance policies and procedures governing the use of personally identifiable information. (DHS.gov)

Government Emergency Telecommunications Service (GETS): Provides national security and emergency preparedness (NS/EP) personnel a high probability of completion for their phone calls when normal calling methods are unsuccessful. It is designed for periods of severe network congestion or disruption, and works through a series of enhancements to the public switched telephone network. GETS is in a constant state of readiness. Users receive a GETS “calling card” to access the service. This card provides access phone numbers, Personal Identification Number (PIN), and simple dialing instructions. (DHS.gov)

Identity Management: The structured creation, capture, syntactical expression, storage, tagging, maintenance, retrieval, use and destruction of identities by means of diverse arrays of different technical, operational, and legal systems and practices. (International Telecommunications Union Identity Correspondence Group)Identity Validation: Tests enabling an information system to authenticate users or resources. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Industrial Control Systems: An information system used to control industrial processes such as manufacturing, product handling, production, and distribution. Industrial control systems include supervisory control and data acquisition systems used to control geographically dispersed assets, as well as distributed control systems and smaller control systems using programmable logic controllers to control localized processes. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Information Security Architecture: An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise’s security processes, information security systems, personnel and organizational sub-units, showing their alignment with the enterprise’s mission and strategic plans. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Internet Protocol: Part of the Transmission Control Protocol/Internet Control family of protocols describing software that tracks the Internet address of nodes, routes outgoing messages, and recognizes incoming messages; used in gateways to connect networks at Open Systems Interconnection network Level 3 and above. (Newton’s Telecom Dictionary)

Interoperability: The ability of independent systems to exchange meaningful information and initiate actions from each other, in order to operate together for mutual benefit. In particular, it envisages the ability for loosely-coupled independent systems to be able to collaborate and communicate; the possibility for use in services outside the direct control of the issuing assigner. International Organization for Standardization Technical Committee 46/Subcommittee 9)

Long Term Evolution (LTE): The access part of the Evolved Packet System. The main requirements for the new access network are high spectral efficiency, high peak data rates, short round trip time, and frequency flexibility. (3GPP.org) LTE is the standard created and adopted by 3GPP through its Release 8 regarding fourth generation (4G) cellular wireless telecommunications. 4G is based upon an all IP packet switched network that supports mobile broadband access as well as multi-media applications with high data rates and low latencies utilizing spectrum efficiency by smooth handoffs and seamless roaming across multiple networks. LTE has been accepted and adopted by national and international communities as the foundation for future mobile telecommunications. (http://transition.fcc.gov/pshs/docs/LTE_Info_Sheet_09082010.pdf)

Machine-to-Machine (M2M): Technologies that enable computers, embedded processors, smart sensors, actuators and mobile devices to communicate with one another, take measurements and make decisions - often without human intervention. (Machine to Machine Technology in Demand Responsive Commercial Buildings)

Network Priority Services: A National Communications System program to define and deploy priority voice communications in the next generation packet- switched network environment. (DHS.gov)

NS/EP Communications: Primarily those technical capabilities supported by policies and programs that enable the Executive Branch to communicate at all times and under all circumstances to carry out its mission essential functions and to respond to any event or crisis (local, national, or international); to include communicating with itself; the Legislative and Judicial branches; State, territorial, tribal and local governments; private sector entities; as well as the public, allies, and other nations. NS/EP communications also include those systems and capabilities at all levels of government and the private sector that are necessary to ensure national security and to effectively manage incidents and emergencies. (National Security and Emergency Preparedness Communications Executive Committee definition based on Executive Order 13618)

Personally Identifiable Information: Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. (Government Accountability Office Report 08-536)

Reliability: A measure of how dependable a system is once you actually use it. (Newton’s Telecom Dictionary)

Resilience: The ability to adapt to changing conditions and withstand and rapidly recover from disruption due to emergencies. (PPD-8: National Preparedness)

Risk Management: The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision

Security: A way of insuring data on a network is protected from unauthorized use. Network security measures can be software-based where passwords restrict users’ access to certain data files or directories. This kind of security is usually implemented by the network operating system. Audit trails are another software-based security measure, where an ongoing journal of what users did what with what files is maintained. Security can also be hardware-based, using more traditional lock and key. (Newton’s Telecom Dictionary)

Smart Device: A smart device is an electronic device that is cordless (unless while being charged), mobile (easily transportable), always connected (via WiFi, 3G, 4G etc.) and is capable of voice and video communication, internet browsing, geolocation (for search purposes and location-based services) and that can operate to some extent autonomously. (NSTAC SGC Subcommittee Definition)

Spectrum: A continuous range of frequencies, usually wide in extent within which waves have some specific common characteristics. (Newton’s Telecom Dictionary)

Supervisory Control and Data Acquisition (SCADA Systems): A generic name for a computerized system that is capable of gathering and processing data and applying operational controls over long distances. Typical uses include power transmission and distribution and pipeline systems. SCADA was designed for the unique communication challenges (delays, data integrity, etc.) posed by the various media that must be used, such as phone lines, microwave, and satellite. Usually shared rather than dedicated. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Survivability: A property of a system, subsystem, equipment, process, or procedure, that provides a defined degree of assurance that the device or system will continue to work during and after a natural or man-made disturbance (e.g., nuclear attack). This term must be qualified by specifying the range of conditions over which the entity will service, the minimum acceptable level of post-disturbance functionality, and the maximum acceptable outage duration. (Newton’s Telecom Dictionary)

Telecommunications Service Priority (TSP): A regulatory, administrative, and operational system authorizing and providing for priority treatment (i.e., provisioning and restoration) of national security and emergency preparedness (NS/EP) telecommunications services. (DHS.gov)

Vulnerability: Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. (NIST Glossary of Information Security Terms – NISTIR 7298 Revision 2)

Wireless Priority Service (WPS): A priority communications service for improving call completion capabilities for authorized NS/EP cell phone users. In the event of congestion in the wireless network, an emergency call using WPS can queue for the next available channel. All WPS (and GETS) calls will receive priority during access, transport, and egress to a wireless mobile on a WPS carrier, even if the terminating mobile is not subscribed to WPS. WPS calls do not preempt calls in progress or deny the general public’s use of the radio spectrum. (GETS/WPS

Source: https://www.dhs.gov/sites/default/files/publications/IoT%20Final%20Draft%20Report%2011-2014.pdf