CISSP Practice

A process used to generate an unpredictable series of numbers. Each individual value is called random if each of the values in the total population of values has an equal probability of being selected.

Random numbers

Random numbers are used in the generation of cryptographic keys, nonces, and authentication challenges.

Reachability analysis

Reachability analysis is helpful in detecting whether a protocol is correct. An initial state corresponds to a system when it starts running. From the initial state, the other states can be reached by a sequence of transitions. Based on the graph theory, it is possible to determine which states are reachable and which are not.

Read-only memory (ROM)

A place where parts of the operating system programs and language translator programs are permanently stored in microcomputer.

Read/write exploits

Generally, a device connected by FireWire has full access to read-and-write data on a computer memory. The FireWire is used by audio devices, printers, scanners, cameras, and GPS. Potential security risks in using these devices include grabbing and changing the screen contents; searching the memory for login ID and passwords; searching for cryptographic keys and keying material stored in RAM; injecting malicious code into a process; and introducing new processes into the system.

Recipient usage period (crypto-period)

The period of time during the crypto-period of a symmetric key during which the protected information is processed.

Reciprocal agreement

An agreement that allows two organizations to back up each other.

Reciprocity

A mutual agreement among participating organizations to accept each other’s security assessments in order to reuse information system resources and/or to accept each other’s assessed security posture in order to share information.

Record retention

A management policy and procedure to save originals of business documents, records, and transactions for future retrieval and reference. This is a management and preventive control.

Records

The recordings (automated and/or manual) of evidence of activities performed or results achieved (e.g., forms, reports, and test results), which serve as a basis for verifying that the organization and the information system are performing as intended. Also used to refer to units of related data fields (i.e., groups of data fields that can be accessed by a program and that contain the complete set of information on particular items).

Recovery

Process of reconstituting a database to its correct and current state following a partial or complete hardware, software, network, operational, or processing error or failure.

Recovery controls

The actions necessary to restore a system’s computational and processing capability and data files after a system failure or penetration. Recovery controls are related to recovery point objective (RPO) and recovery time objective (RTO).

Recovery point objective (RPO)

The point in time in to which data must be recovered after an outage in order to resume computer processing.

Recovery procedures

Actions necessary to restore data files of an information system and computational capability after a system failure.

Recovery time objective (RTO)

(1) The overall length of time an information system’s components can be in the recovery phase before negatively impacting the organization’s mission or business functions. (2) The maximum acceptable length of time that elapses before the unavailability of the system severely affects the organization.

RED/BLACK concept

A separation of electrical and electronic circuits, components, equipment, and systems that handle unencrypted information (RED) in electrical form from those that handle encrypted information (BLACK) in the same form.

RED concept (encryption)

It is a designation applied to cryptographic systems when data/information or messages that contains sensitive or classified information that is not encrypted.

Red team

(1) A group of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s security posture. The red team’s objective is to improve enterprise information assurance by demonstrating the impacts of successful attacks and by demonstrating what works for the defenders (i.e., the blue team) in an operational environment). (2) A test team that performs penetration security testing using covert methods and without the knowledge and consent of the organization’s IT staff, but with full knowledge and permission of upper management. The old name for the red team is tiger team.

Red team exercise