ISO/IEC 27039:2015 情報技術—セキュリティ技術—侵入検知および防止システム（IDPS）の選択、展開、および運用 | ページ 5

2.1

attack

attempts to destroy, expose, alter, or disable information systems and/or information within it or otherwise breach the security policy

2.2

attack signature

sequence of computing activities or alterations that are used to execute an attack and which are also used by an IDPS to discover that an attack has occurred and often is determined by the examination of network traffic or host logs

Note 1 to entry: This can also be referred to as an attack pattern.

2.3

attestation

variant of public-key encryption that lets IDPS software programs and devices authenticate their identity to remote parties

Note 1 to entry: See remote attestation (2.23) .

2.4

bridge

network equipment that transparently connects a local area network (LAN) at OSI layer 2 to another LAN that uses the same protocol

2.5

cryptographic hash value

mathematical value that is assigned to a file and used to “test” the file at a later date to verify that the data contained in the file has not been maliciously changed

2.6

denial-of-service

DoS

unauthorized access to a system resource or the delaying of system operations and functions, with resultant loss of availability to authorized users

[SOURCE: ISO/IEC 27033‑1:2009]

2.7

distributed denial-of-service attack

DDoS

unauthorized access to a system resource or the delaying of system operations and functions in the way of compromising multiple systems to flood the bandwidth or resources of the targeted system, with resultant loss of availability to authorized users

2.8

demilitarized zone

DMZ

logical and physical network space between the perimeter router and the exterior firewall

Note 1 to entry: The DMZ can be between networks and under close observation but does not have to be so.

Note 2 to entry: They are generally unsecured areas containing bastion hosts that provide public services.

2.9

exploit

defined way to breach the security of information systems through vulnerability

2.10

firewall

type of barrier placed between network environments — consisting of a dedicated device or a composite of several components and techniques — through which all traffic from one network environment traverses to another, and vice versa, and only authorized traffic as defined by the local security policy is allowed to pass

[SOURCE: ISO/IEC 27033‑1:2009]

2.11

false positive

IDPS alert when there is no attack

2.12

false negative

no IDPS alert when there is an attack

2.13

honeypot

generic term for a decoy system used to deceive, distract, divert, and encourage the attacker to spend time on information that appears to be very valuable, but actually is fabricated and would not be of interest to a legitimate user

2.14

host

addressable system or computer in TCP/IP-based networks like the Internet

2.15

intruder

individual who is conducting, or has conducted, an intrusion or attack against a victim’s host, site, network, or organization

2.16

intrusion

unauthorized access to a network or a network-connected system, that is, deliberate or accidental unauthorized access to information systems, to include malicious activity against information systems, or unauthorized use of resources within information systems

2.17

intrusion detection

formal process of detecting intrusions, generally characterized by gathering knowledge about abnormal usage patterns, as well as what, how, and which vulnerability has been exploited to include how and when it occurred

2.18

intrusion detection system

IDS

information systems used to identify that an intrusion has been attempted, is occurring, or has occurred

2.19

intrusion prevention system

IPS

variant on intrusion detection systems that are specifically designed to provide an active response capability

2.20

intrusion detection and prevention system

IDPS

intrusion detection systems (IDPS) and intrusion prevention systems (IPS) software applications or appliances that monitor systems for malicious activities, where IDS focus is to only alert on the discovery of such activity while IPS have the potent to prevent some intrusions upon detection

Note 1 to entry: IPS is deployed actively in the network if attack prevention is desired. If deployed in passive mode, it will not offer such functionality and effectively function as a regular IDS by providing alerts only.

2.21

penetration

unauthorized act of bypassing the security mechanisms of information systems

2.22

provisioning

process of loading the correct software, security policy, and configuration data for information technology (IT) devices

2.23

remote attestation

processes of using digital certificates to ensure the identity, as well as the hardware and software configuration, of IDPS and to securely transmit this information to a trusted operations centre

2.24

response

incident response or intrusion response

action taken to protect and restore the normal operational conditions of information systems and the information stored in it when an attack or intrusion occurs

2.25

router

network device that is used to establish and control the flow of data between different networks, by selecting paths or routes based upon routing protocol mechanisms and algorithms

Note 1 to entry: The networks can themselves be based on different protocols.

Note 2 to entry: The routing information is kept in a routing table.

[SOURCE: ISO/IEC 27033‑1:2009]

2.26

server

computer system or program that provides services to other computers

2.27

Service Level Agreement

SLA

document that defines the technical support or business performance objectives including measures for performance and consequences for failure the provider of a service can provide its clients

2.28

sensor

component/agent of IDPS which collects event data from information systems or a network under observation

Note 1 to entry: Also referred to as a monitor.

2.29

subnet

segment of a network that shares a common address component

2.30

switch

device which provides connectivity between network connectivity devices by means of internal distribution mechanisms, with the switching technology typically implemented at layer 2 or layer 3 of the OSI reference model

Note 1 to entry: Switches are distinct from other local area network interconnection devices (e.g. a hub) as the technology used in switches sets up connections on a point-to-point basis.

[SOURCE: ISO/IEC 27033‑1:2009]

2.31

test access port

TAP

typically passive devices that do not install any overhead on the network packet but also increase the level of the security as they make the data collection interface invisible to the network, where a switch can still maintain layer 2 information about the port

Note 1 to entry: A TAP also gives the functionality of multiple ports so network issues can be debugged without losing the IDPS capability.

2.32

trojan horse

malicious program that masquerades as a benign application

2.33

virus

type of malware which is software designed with malicious intent containing features or capabilities that can potentially cause harm, directly or indirectly, to the user and/or the user’s system

2.34

virtual private network

VPN

restricted-use logical computer network that is constructed from the system resources of a physical network by using encryption and/or by tunnelling links of the virtual network across the real network

[SOURCE: ISO/IEC 18028‑3:2005]

2.35

vulnerability

weakness of an asset or control that can be exploited by one or more threats

[SOURCE: ISO/IEC 27000:2012]