A general term covering both privilege attributes and control attributes. The use of security attributes is defined by a security policy [ECMATR46].

1. Of data processing operations, an independent review and examination of system records and activities to (a) determine the adequacy of system controls, (b) ensure compliance with established security policy and operational procedures, (c) detect breaches in security, and (d) recommend any indicated changes in any of the foregoing.
2. An independent review and examination of system records and activities… (Read More →)

A message generated following the occurrence of an auditable security-related event [10181-7].

A single record in a security audit trail corresponding to a single security-related event [10181-7].

1. Set of records that collectively provide documentary evidence of processing used to aid in tracing from original transactions forward to related records and reports, and/or backwards from records and reports to their component source transactions. [TCSEC].
2. Data collected and potentially used to facilitate a security audit [7498-2].

An individual or a process allowed to have access to the security audit trail and to build audit reports [10181-7].

A nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone. [2382-pt.8]

A set of security relevant data which is protected by integrity and data origin authentication from an issuing security authority, and includes an indication of a time period of validity [10181-1].
Note: All certificates are deemed to be security certificates (see the relevant definitions in 7498-2). The term "security certificate" is adopted in order to avoid terminology conflicts with [X.509… (Read More →)

The combination of classification, categories and caveats associated with an object [CESG]. Example: "SECRET CORPORATE UK EYES A"
Note: Used only in the context of, and at the granularity of, a system's ability to distinguish between security classes. See also: Label, Lattice, Single Class, Multi-class.

1. Of information, the process of determining and designating the specific degree of protection against disclosure the information requires.
2. The level (degree) of protection so determined. [After 2382-pt.8]
Note: Examples of security classifications are: "top secret," "secret," and "confidential. "
3. Synonym security label.