Ebook: A Process for Developing a Common Vocabulary in the Information Security Area

Over the last years there have been tendencies of growing numbers of cyber attacks and a growth of the scale of casualties. Cyber attacks against critically important segments of informational infrastructure, including the systems controlling of transport and hazardous industry are becoming more frequent. Since the attacks are made using the global informational infrastructure they can be organized from any part of the planet. That means that we can only resist them with the help of international cooperation.

Nowadays, the international strategies of counteraction of cyber crime and cyber terrorism are considered at the political level by the leaders of law-enforcement agencies. The scientific part of such strategies must have an adjustable terminology and the conception apparatus. Every scientific investigation, when it involves specialists from different countries, has to start with agreement upon the terminology. There is a need to harmonize different languages in which specialists speak about guaranteeing the information security. These are the languages of the lawyers, insurers, brokers, creators, technicians, law-enforcement structures and standardizations.

There are some dozens of different dictionaries and glossaries in the field of informational security. However even in the use of the basic terms there are disagreements; for example terms like “information security” and “information assurance” are explained in different ways in different countries and no one understands the correlation of the concepts of “cyber terrorism” and “cyber crime”. Misunderstanding in explaining the basic concepts influences the second level of the understanding of the terms. Differences in understanding concepts of informational security can exist not only between different countries but between different institutions and organizations in a same country.

This paper gives the main definitions relating to dependability, a generic concept including as special case such attributes as reliability, availability, safety, integrity, maintainability, etc. Security brings in concerns for confidentiality, in addition to availability and integrity. Basic definitions are given first. They are then commented upon, and supplemented by additional definitions, which address the threats to dependability and security (faults, errors, failures), their attributes, and the means for their achievement (fault prevention, fault tolerance, fault removal, fault forecasting). The aim is to explicate a set of general concepts, of relevance across a wide range of situations and, therefore, helping communication and cooperation among a number of scientific and technical communities, including ones that are concentrating on particular types of system, of system failures, or of causes of system failures.

Close coordination among law enforcement agencies, researchers, and intelligence agencies is required to solve the problem of computer crime. There are several barriers to this cooperation including asymmetric laws, national interests, and poor communication mechanisms. Computers have not only led to new types of crimes, but have provided additional avenues for existing crimes. Laws for traditional crimes have not evolved quickly enough to accommodate technology developments. To foster increased cooperation, it is necessary to have a common vocabulary, which will avoid confusion in interpretation of laws, security policies, data, and research due to differences in language, vocabulary, and semantics. The basic premise of the paper is that security policies are the key instrument of security that will help in tacking international cybercrime and a shared vision of security would be achieved through common security policies. This paper presents recommendations and results from the creation of an initial security glossary compiled from public sources on the Internet as a part of research in developing metrics for information security policies. The large variation in terminology and definitions underscores the necessity of standardization of nomenclature in security.

This report analyzes the phenomenon of cyberterrorism, as well as linguistic, semantic and technical notions in the field of hi-tech terrorism and counteraction to it. Some of these notions and definitions can be included in the multilingual glossary on information security.