Glossary of Security Terms

A  |  B  |  C  |  D  |  E  |  F  |  G  |  H  |  I  |  K  |  L  |  M  |  N  |  O  |  P  |  Q  |  R  |  S  |  T  |  U  |  V  |  W |  X

A

access
the ability to view or modify a file (webpage, document, etc.)

access control
The mechanisms for limiting access to certain information based on a user's identity and membership in various predefined groups. Access control can be mandatory, discretionary, or role-based. See also access control list and access control entry.

access control entry (ACE)
In Windows-based systems, an entry in an access control list containing the security identifier for a user or group and an access mask that specifies which operations by the user or group are allowed, denied, or audited.

access control list (ACL)
In Windows-based systems, a list of access control entries that apply to an entire object, a set of the object's properties, or an individual property of an object, and that define the access granted to one or more security principals.

access mask
In Windows-based systems, a value that specifies the permissions that are allowed or denied in an access control entry of an access control list. The access mask is also used in an access request to specify the access permissions that the subject requires when accessing an object.

access token
A data structure that contains authorization information for a user or group. A system uses an access token to control access to securable objects and to control the ability of a user to perform various system-related operations on a local computer.

ACE
See access control entry.

ACL
See access control list.

administrative vulnerability
Failure to observe administrative best practices, such as using a weak password or logging on to an account that has more user rights than the user requires to perform a specific task.

adware
Advertising that is integrated into software. Adware is often combined with a host application that is provided at no charge as long as the user agrees to accept the adware.

anonymity
A condition in which an individual's true identity is unknown.

antivirus software (AV)
A computer program designed to detect and respond to malicious software, such as viruses and worms. Responses may include blocking user access to infected files, cleaning infected files or systems, or informing the user that an infected program was detected.

attack
A deliberate attempt to compromise the security of a computer system or deprive others of the use of the system.

authentication
The process of validating the credentials of a person, computer process, or device. Authentication requires that the person, process, or device making the request provide a credential that proves it is what or who it says it is. Common forms of credentials are digital signatures, smart cards, biometric data, and a combination of user names and passwords.

authorization
The process of granting a person, computer process, or device access to certain information, services, or functionality. Authorization is derived from the identity of the person, computer process, or device requesting access, which is verified through authentication.

AV
See antivirus software.

availability
The property of a system or a system resource that ensures it is accessible and usable upon demand by an authorized system user. Availability is one of the core characteristics of a secure system.

B

back door
A hardware or software-based hidden entrance to a computer system that can be used to bypass the system's security policies.

BBBOnLine
A privacy seal program established by the Better Business Bureau which certifies that certain Web sites conform to baseline privacy standards. Microsoft is a sponsor of BBBOnLine.

buddy fix
See private fix.

buffer
A region of memory reserved for use as an intermediate repository in which data is temporarily held before it is transferred between two locations or devices.

buffer overrun
A condition that results from adding more information to a buffer than it was designed to hold. An attacker may exploit this vulnerability to take over a system.

C

certificate
An encrypted file containing user or server identification information, which is used to verify identity and to help establish a security-enhanced link.

change management
The practice of administering changes with the help of tested methods and techniques in order to avoid new errors and minimize the impact of changes.

Children's Online Privacy Protection Act (COPPA)
A U.S. law that took effect on April 21, 2000, and requires parental consent for certain Web sites to knowingly collect personally identifiable information on children under the age of 13.

choice
An individual's ability to determine whether and how personally identifiable information collected from him or her may be used, especially for purposes beyond those for which the information was originally provided. Choice is an element of the Fair Information Practices.

cipher
The method used to transform a readable message (called plaintext or cleartext) into an unreadable, scrambled or hidden message (called ciphertext).

ciphertext
Data that has been encrypted. Ciphertext is the output of the encryption process and can be transformed back into a readable form plaintext with the appropriate decryption key.

cleartext
See plaintext.

clickstream data
Information that users generate as they move from page to page and click on items within a Web site, usually stored in log files. Web site designers can use clickstream data to improve users' experiences with a site.

computer security
The protection of information assets through the use of technology, processes, and training.

Content Advisor
A tool in Microsoft Internet Explorer that lets you control which sites users on your computer can visit. This is particularly helpful for parents who want to control the content their children view on the Web.

cookie
A small data file that is stored on a user's local computer for record-keeping purposes and which contains information about the user that is pertinent to a Web site, such as user preferences.

COPPA
See Children's Online Privacy Protection Act.

credentials
Information that includes identification and proof of identification that is used to gain access to local and network resources. Examples of credentials are user names and passwords, smart cards, and certificates.

critical update
A broadly released fix for a specific problem addressing a critical, non-security-related bug.

cryptography
The study or analysis of codes and encoding methods used to secure information. Cryptographic techniques can be used to enable and ensure confidentiality, data integrity, authentication (entity and data origin), and nonrepudiation.

D

data transfer
As a key principle of privacy, the movement of personally identifiable information between entities, such as a customer list being shared between two different companies.

DDoS
See distributed denial of service.

deceptive trade practices
Misleading or misrepresenting products or services to consumers and customers. In the United States, these practices are regulated by the Federal Trade Commission at the national level and typically by the Attorney General's Office of Consumer Protection at the state level.

decryption
The process of converting encrypted content back into its original form, often the process of converting ciphertext to plaintext. Decryption is the opposite of encryption.

denial of service attack (DoS)
An attempt by a malicious (or unwitting) user, process, or system to prevent legitimate users from accessing a resource (usually a network service) by exploiting a weakness or design limitation in an information system. Examples of DoS attacks include flooding network connections, filling disk storage, disabling ports, or removing power.

digital certificate
A digitally signed statement that binds the identifying information of a user, computer, or service to a public/private key pair. A digital certificate is commonly used in the process of authentication and for securing information on networks.

digital rights management (DRM)
Any technology used to protect the interests of owners of content and services (such as copyright owners). Typically, authorized recipients or users must acquire a license in order to consume the protected material—files, music, movies—according to the rights or business rules set by the content owner.

digital signature
Data that binds a sender's identity to the information being sent. A digital signature may be bundled with any message, file, or other digitally encoded information, or transmitted separately. Digital signatures are used in public key environments and provide nonrepudiation and integrity services.

disclosure
A component of the notice principle, wherein a company should make available its data handling practices, including notices on how it collects, uses, and shares personally identifiable information.

distributed denial of service (DDoS)
A type of denial of service attack in which an attacker uses malicious code installed on various computers to attack a single target. An attacker may use this method to have a greater effect on the target than is possible with a single attacking machine.

DoS
See denial of service attack.

download
To transfer a copy of a file from a remote computer to a requesting computer by means of a modem or network.

DRM
See digital rights management.

E

EFS
See Encrypting File System.

elevation of privilege
The process by which a user obtains a higher level of privilege than that for which he has been authorized. A malicious user may use elevation of privilege as a means to compromise or destroy a system, or to access unauthorized information.

e-mail bomb
A denial of service attack in which an excessive amount of e-mail data is sent to an e-mail address in an attempt to disrupt the e-mail service, or to prevent the recipient from receiving legitimate messages.

encrypted data
Data that has been converted from plaintext into ciphertext.

Encrypting File System (EFS)
A technology used in Windows 2000 and later versions that enables users to encrypt files and folders on NTFS volumes. EFS protects the confidentiality of data by ensuring that only the original user has access to them.

encryption
The process of converting data into a coded form (ciphertext) to prevent it from being read and understood by an unauthorized party.

enforcement
A privacy principle which provides mechanisms for assuring compliance with the Fair Information Practices, recourse for individuals affected by noncompliance, and consequences for noncompliant organizations. Methods for enforcement include a review by independent third parties, such as BBBOnLine.

EU Data Protection Directive
A European Union (EU) law stating that personal data from EU countries can only be transferred to non-EU countries that provide an acceptable level of privacy protection. An organization must inform individuals why information about them is collected, how to contact the organization with inquiries and complaints, the types of third parties to which the organization will disclose, and the options an organization provides to limit the disclosure of certain information. Proper notice and choice must be offered to allow an individual to opt in or opt out of providing specific information the organization plans on tracking. See also Safe Harbor Agreement.

extranet
An extension of an organization's intranet used to facilitate communication with the organization's trusted partners. An extranet allows such trusted partners to gain limited access to the organization's internal business data.

F

Fair Information Practices
The basis for privacy best practices, both online and offline. The Practices originated in the Privacy Act of 1974, the legislation that protects personal information collected and maintained by the U.S. government. In 1980, these principles were adopted by the Organization for Economic Cooperation and Development and incorporated in its Guidelines for the Protection of Personal Data and Transborder Data Flows. They were adopted later in the EU Data Protection Directive of 1995, with modifications. The Fair Information Practices include notice, choice, access, onward transfer, security, data integrity, and remedy.

filter
A pattern or mask through which data is passed to separate specified items. For instance, a filter used in e-mail or in retrieving newsgroup messages can allow users to automatically discard messages from designated users.

Financial Modernization Act of 1999
See Graham-Leach-Bliley Act.

firewall
A security solution which segregates one portion of a network from another portion, allowing only authorized network traffic to pass through according to traffic filtering rules.

full file replacement
A technology used in hotfixes that replaces the currently installed files with new files. Compare patching.

G

GLB
See Graham-Leach-Bliley Act.

globally unique identifier (GUID)
A 16-byte value generated from the unique identifier on a device, the current date and time, and a sequence number. A GUID is used to identify a particular device, component, user, or session.

Graham-Leach-Bliley Act (GLB)
A U.S. law containing provisions that require all financial institutions to disclose to consumers and customers their policies and practices for protecting the privacy of nonpublic personal information. Nonpublic personal information includes any personally identifiable information provided by a customer, resulting from transactions with the financial institution or obtained by a financial institution through providing products or services. Also known as the Financial Modernization Act of 1999.

(GUID)
See globally unique identifier.

H

Health Insurance Portability and Accountability Act (HIPAA)
A U.S. regulation that gives patients greater access to their own medical records and more control over how their personally identifiable health information is used. The regulation also addresses the obligations of healthcare providers and health plans to protect health information. In general, covered entities such as health plans, healthcare clearinghouses, and healthcare providers which conduct certain financial and administrative transactions electronically had until April 14, 2003, to comply.

HFNETCHK
A command-line tool that enables an administrator to check the update status of all Windows NT 4.0, Windows 2000, and Windows XP computers on a network from a central location.

high priority update
A classification used on the Windows Update Web site and by the Windows Update Service to recommend Microsoft software updates and drivers that help protect against the latest publicly known security threats and reliability issues. All software updates and drivers that can be installed by turning on Automatic Updates on your computer are classified as high priority. These can also be installed by visiting the Windows Update Web site.

HIPAA
See Health Insurance Portability and Accountability Act.

hotfix
A single cumulative package composed of one or more files used to address a problem in a product. Hotfixes address a specific customer situation and may not be distributed outside the customer organization. The terms QFE, patch, and update have been used in the past as synonyms for hotfix.

I

ICRA
See Internet Content Rating Association.

impersonation
The ability of an operating system process or thread to run temporarily in the security context of a specific caller and gain authorized access to resources using that identity.

implicit profiling
An information collection process in which the actions and behaviors of a user visiting a Web site are recorded as the user moves around in and interacts with the Web site.

implicit targeting
An information delivery process in which existing user data is used to deliver tailored content to users who browse a Web site.

information disclosure
The exposure of information to individuals who normally would not have access to it.

interactive logon
The process of logging on to a local computer using a keyboard. Compare network logon.

Internet Content Rating Association (ICRA)
An international nonprofit group that has developed a content advisory service for the Internet. ICRA's aim is to protect children from potentially harmful material on the Internet.

K

KB article
A technical document in the Microsoft Knowledge Base accessible through Microsoft.com.

key
In encryption and digital signatures, a value used in combination with an algorithm to encrypt or decrypt data.

Kids Passport
A .NET Passport service that helps participating sites and services obtain parental consent to collect, use, and disclose a child's personal information. This service is used to support legal requirements such as the Children's Online Privacy Protection Act or Korean Kids.

L

least privilege administration
A recommended security practice in which every user is provided with only the minimum privileges needed to accomplish the tasks they are authorized to perform.

local attack
An attack that targets the computer to which the attacker is interactively logged on.

M

MAC
See Message Authentication Code.

mail bomb
See e-mail bomb.

mail relaying
A practice in which an attacker sends e-mail messages from another system's e-mail server in order to use its resources and/or make it appear that the messages originated from the other system.

malicious code
Software that fulfills the deliberately harmful intent of an attacker when run. For example, viruses, worms, and Trojan horses are malicious code.

malicious user
A user who intentionally accesses a system with the intent to cause harm to the system or to use it in an unauthorized manner.

Message Authentication Code (MAC)
An algorithm that allows a receiver to ensure that a block of data has retained its integrity from the time it was sent until the time it was received.

Microsoft Download Center
A Microsoft Web site that provides security and technology updates for Microsoft software.

Microsoft .NET Passport
A Web-based service that is designed to make signing in to Web sites fast and easy. .NET Passport enables participating sites to authenticate a user with a single set of sign-in credentials, alleviating the need for users to remember numerous passwords and user names.

Microsoft security bulletin
A document that describes a specific security issue in Microsoft software and directs the reader to a downloadable file that resolves the issue.

Microsoft virus alert
An announcement that describes a specific virus, the impact of potential attacks on Microsoft software, and suggestions for preventing or recovering from such attacks.

N

network logon
The process of logging on to a computer by means of a network. Typically, a user first interactively logs on to a local computer, then provides logon credentials to another computer on the network, such as a server, that he or she is authorized to use. Compare interactive logon.

nonrepudiation
A technique used to ensure that someone performing an action on a computer cannot falsely deny that they performed that action. Nonrepudiation provides undeniable proof that a user took a specific action such as transferring money, authorizing a purchase, or sending a message.

notice
A privacy principle that requires reasonable disclosure to a consumer of an entity's personally identifiable information collection and use practices. This disclosure information is typically conveyed in a privacy notice or privacy policy. Notice is addressed in Fair Information Practices.

O

Office Update
A Microsoft Web site maintained by the Microsoft Office product group for the purpose of providing critical updates, add-ins, converters, and viewers that increase the performance and stability of currently released Office programs.

onward transfer
The transfer of personally identifiable information by the recipient of the original data to a second recipient. For example, the transfer of personally identifiable information from an entity in Germany to an entity in the United States constitutes onward transfer of that data. Onward transfer is addressed in Fair Information Practices.

opt in To explicitly consent to participate. Typically used in marketing programs and offerings, whereby an action (such as the use of personal information beyond the original, primary purpose for which it was collected) is not undertaken unless an individual explicitly consents. An element of choice.

opt out
To explicitly decline to participate. Typically used in marketing programs and offerings, whereby an action (such as the use of personal information beyond the original, primary purpose for which it was collected) is undertaken unless an individual explicitly declines. An element of choice.

P

P3P
See Platform for Privacy Preferences Project.

password
A string of characters entered by a user to verify his or her identity to a network or to a local computer. See also strong password and weak password.

password propagation
A process that coordinates each user's password changes across multiple computers, devices, folders, or networks in password synchronization.

password synchronization
A service that replicates users' passwords between multiple computers, devices, folders, or networks, resulting in users having the same password in each environment.

patch
See security update.

patching
A method of updating a file that replaces only the parts being changed, rather than the entire file. Compare full file replacement.

permissions
Authorization to perform operations associated with a specific shared resource, such as a file, directory, or printer. Permissions must be granted by the system administrator to individual user accounts or administrative groups.

personal data
See personally identifiable information.

personal identification number (PIN)
A secret identification code similar to a password that is assigned to an authorized user. A PIN is used in combination with an ATM card or smart card, for example, to unlock an authorized functionality such as access to a bank account.

personally identifiable information (PII)
Any information relating to an identified or identifiable individual. Such information may include name, country, street address, e-mail address, credit card number, Social Security number, government ID number, IP address, or any unique identifier that is associated with PII in another system. Also known as personal information or personal data.

personal information
See personally identifiable information.

phisher
A malicious user or Web site that deceives people into revealing personal information, such as account passwords and credit card numbers. A phisher typically uses deceptive e-mail messages or online advertisements as bait to lure unsuspecting users to fraudulent Web sites, where the users are then tricked into providing personal information.

physical vulnerability
Failure to provide physical security for a computer, such as leaving an unlocked workstation running in a workspace that is accessible to unauthorized users.

PII
See personally identifiable information.

PIN
See personal identification number.

PKI
See public key infrastructure.

plaintext
Data in its unencrypted or decrypted form.

Platform for Privacy Preferences Project (P3P)
An open privacy specification developed and administered by the World Wide Web Consortium (W3C) that, when implemented, enables people to make informed decisions about how they want to share personal information with Web sites.

pooling
See throttling.

principal
See security principal.

privacy
The control customers have over the collection, use, and distribution of their personal information.

privacy compromise
A scenario in which an unauthorized individual is able to gain access to personal or confidential information about another user.

privacy policy
An organization's requirements for complying with privacy regulations and directives. The policy is expressed in a privacy statement.

privacy statement
A document describing a company's position on privacy, detailing what information its Web site collects, with whom the data is shared, and how users can control the use of their personal data.

Privacy Wizard
A software tool developed by Microsoft that helps businesses craft privacy policies based on widely accepted privacy principles. Currently, the Privacy Wizard is being updated to include support for the Platform for Privacy Preferences Project..

private fix
An unofficial hotfix which may not be fully tested or packaged. It is released to the customer to verify that it solves the problem before final testing and packaging.

private key
One of two keys in public key encryption. The user keeps the private key secret and typically uses it to digitally sign data, or to decrypt data that has been encrypted with the corresponding public key.

privileges
See user rights.

proxy server
A firewall component that manages Internet traffic to and from a local area network (LAN) and can provide other functions, such as document caching and access control.

public key
One of two keys in public key encryption. The user releases this key to the public, who can use it to encrypt messages to be sent to the user and to verify the user's digital signature. Compare with private key.

public key encryption
A method of encryption that uses a pair of mathematically related keys: a public key and a corresponding private key. Either key can be used to encrypt data, but the corresponding key must be used to decrypt it. Also called asymmetric encryption.

public key infrastructure (PKI)
A framework encompassing the laws, policies, standards, hardware, and software to provide and manage the use of public key cryptography on public networks such as the Internet.

Q

QFE
See Quick Fix Engineering.

QoS
See Quality of Service.

Quality of Service (QoS)
A set of quality assurance standards and mechanisms for data transmission.

quick fix engineering (QFE)
A team within Microsoft that produces hotfixes. Most of these teams now refer to themselves as Sustained Engineering teams.

R

race condition
A condition caused by the timing of events within or among software components. Race conditions typically are associated with synchronization errors that provide a window of opportunity during which one process can interfere with another, possibly introducing a security vulnerability.

remote attack
An attack that targets a computer other than the one that the attacker is interactively logged on to. For example, an attacker can log on to a workstation and attack a server on the same network or on an entirely different one.

remote procedure call (RPC)
A communication mechanism that allows computers to communicate with one another over a network. An RPC consists of a procedure identifier, parameters passed to the procedure, and a value returned to the caller (client computer) after the procedure has executed on the remote system (server computer).

repudiation
The ability of a user to deny having performed an action that other parties cannot prove otherwise. For example, a user who deleted a file can successfully deny doing so if no mechanism (such as audit files) can contradict that claim.

Request for Collaboration (RFC)
A request for development engagement where Product Support Services (PSS) is technically blocked; also used to formalize and track support statement requests and to review proposed action plans. The request process was introduced to help reduce the time it takes to provide a solution to a customer. An RFC may become a DCR, CDCR, or hotfix request.

RFC
See Request for Collaboration.

rights
See user rights.

role-based authorization
A type of authorization that uses roles to determine access rights and privileges. A role is a symbolic category of users that share the same security privilege.

rollup
See update rollup.

RPC
See remote procedure call.

S

Safe Harbor Agreement
An agreement between the United States and the European Union (EU) regarding the transfer of personally identifiable information from the EU to the United States, which is consistent with Fair Information Practices. Companies that register for Safe Harbor with the U.S. Department of Commerce and abide by the agreement are deemed by the EU to provide adequate data protection for personally identifiable information transferred from the EU to the United States.

Safe Harbor Principles
Seven principles agreed to by the United States and the European Union (EU) for the transfer of personally identifiable information from the EU to the United States to which a company must adhere if it registers for Safe Harbor. The seven principles are categorized into the following subjects: notice; choice; access; onward transfer; security; data integrity; and enforcement. See also Safe Harbor Agreement.

safeguard
A technology, policy, or procedure that counters a threat or protects assets.

sandbox
A security mechanism used to constrain the actions a program can take. A sandbox restricts a program to a defined set of privileges and actions that reduce the likelihood that the program may damage the system hosting the program.

secondary data uses
Uses of personal information for purposes other than those for which the information was collected. The Fair Information Practices state that a person can provide personal information for a specific purpose without the fear that it may later be used for an unrelated purpose without that person's knowledge or consent.

Secure Sockets Layer (SSL)
A protocol that provides secure data communication through data encryption. This protocol enables authentication, integrity, and data privacy over networks through a combination of digital certificates, public-key cryptography, and bulk data encryption. This protocol does not provide authorization or nonrepudiation.

security
See computer security.

security alert
Documentation for developers that describes specific security risks and how to avoid them when implementing Microsoft software.

security identifier (SID)
In Windows-based systems, a unique value that identifies a user, group, or computer account within an enterprise. Every account is issued a SID when it is created.

security principal
In Windows-based systems, a user, group, or computer that is automatically assigned a security identifier to control access to resources.

security update
A broadly released fix for a product-specific, security-related vulnerability. Security vulnerabilities are rated based on their severity, which is indicated in the Microsoft security bulletin as critical, important, moderate, or low.

security vulnerability
A vulnerability in software that is addressed by a Microsoft security update and security bulletin or a service pack.

sensitive data
From the European Union perspective, personally identifiable information regarding race or ethnic origin, political opinions, religious or philosophical beliefs, sexual preference, or trade union membership. Within the United States, sensitive information also includes information about health, finances, and children.

service pack
A tested, cumulative set of all hotfixes, security updates, critical updates, and updates created and fixes for defects found internally since the release of the software. Service packs may also contain a limited number of customer-requested design changes or features.

Service Release
See service pack.

script kiddies
A kind of hacker who only uses code created by others.

SID
See security identifier.

signatures (definitions) : telltale characteristics -- the fingerprints or DNA of viruses and other malware Signature files are frequently updated, as often as once a day.

smart card
A credit card–sized device with an embedded microprocessor and a small amount of storage that is used, with an access code, to enable certificate-based authentication. Smart cards securely store certificates, public and private keys, passwords, and other types of personal information.

software update
Any update, update rollup, service pack, feature pack, critical update, security update, or hotfix used to improve or fix software released by Microsoft.

software upgrade
See upgrade.

SP
See service pack.

spam
Unsolicited commercial e-mail. Also known as junk e-mail.

spoof
Emails sent with bogus "From", "To" and "Reply To" addresses in email messages. It makes an email appear to come from a user other than the user who actually sent it. It's a common part a hacker or virus's actions. It's also easy to set up a fake Web site that mimics a real company's website, or create links in email messages or on Web sites that don't take you where it looks like they will. All this is spoofing.

SSL
See Secure Sockets Layer (SSL).

strong password
A password that provides an effective defense against unauthorized access to a resource. A strong password is at least six characters long, does not contain all or part of the user's account name, and contains at least three of the four following categories of characters: uppercase letters, lowercase letters, base 10 digits, and symbols found on the keyboard, such as !, @, and #.

T

tamper
To maliciously modify data.

third-party seal
An online seal of approval certifying that a Web site's privacy statement has been examined and tested by an organization such as BBBOnLine or TRUSTe, in accordance with the Fair Information Practices.

throttling
A method of preventing a denial of service attack by limiting the number of requests that can be made to a system. Also called pooling.

TLS
See Transport Layer Security.

token
See access token.

transcryption gateway
A virtual, software-based translation mechanism on the PC that converts one content protection scheme or format to another, while retaining the license and rights in the license from the original content protection format.

transparency
A standard that requires that the structure for processing personal information be in a fashion that is open and understandable to the individual whose data is being processed. It is a goal of the Fair Information Practices, which requires a company to inform users what personal information the company collects and how the data is used.

Transport Layer Security (TLS)
A protocol that provides communications privacy and security between two applications communicating over a network. TLS provides a secure channel by encrypting communications and enables clients to authenticate servers or, optionally, servers to authenticate clients.

Trojan horse
A program that appears to be useful or harmless but that contains hidden code designed to exploit or damage the system on which it is run. Trojan horse programs are most commonly delivered to users through e-mail messages that misrepresent the program's purpose and function. Also called Trojan code.

TRUSTe
An organization offering an online privacy seal program that certifies eligible Web sites and holds Web sites to a baseline privacy standard. This key privacy watchdog organization plays an important enforcement role in the dispute and resolution of privacy issues.

U

update
A broadly released fix for a specific problem addressing a noncritical, non-security-related bug.

update
To make a system or data file more current.

update rollup
A tested, cumulative set of hotfixes, security updates, critical updates, and updates packaged together for easy deployment. A rollup generally targets a specific area, such as security, or component of a product, such as Microsoft Internet Information Services (IIS).

upgrade
A software package that replaces an installed version with a newer version of the same software. The upgrade process typically leaves existing customer data and preferences intact while replacing the existing software with the newer version.

upgrade
To change to a newer, usually more powerful or sophisticated version.

user profile
Settings that define customization preferences for a particular user, such as desktop settings, persistent network connections, personally identifiable information, Web site use, or other behaviors and demographics data.

user rights
Tasks that a user is permitted to perform on a Windows-based computer or domain. There are two types of user rights: privileges and logon rights. An example of a privilege is the right to shut down the system. An example of a logon right is the right to log on to a computer interactively. Both types are assigned by administrators to individual users or groups as part of the security settings for the computer.

V

virtual private network (VPN)
The extension of a private network that provides encapsulated, encrypted, and authenticated logical (not physical) links across shared or public networks. VPN connections typically provide remote access and router-to-router connections to private networks over the Internet.

virus
Code written with the express intention of replicating itself. A virus attempts to spread from computer to computer by attaching itself to a host program. It may damage hardware, software, or data. Compare worm. See also the definition provided by the Virus Info Alliance (f-secure.com).

VPN
See virtual private network.

vulnerability
Any product flaw, administrative process or act, or physical exposure that makes a computer susceptible to exploit by a threat.

W

weak password
A password that does not provide an effective defense against unauthorized access to a resource. A weak password might be less than six characters long, contain all or part of a user's account name, or contain less than three of the four following categories of characters: uppercase letters, lowercase letters, base 10 digits, and symbols found on the keyboard, such as !, @, and #.

Windows Update
1. A Microsoft Web site maintained by the Windows product group for the purpose of providing updates for core Windows components. 2. An application in Windows that enables a user to download files from the Internet that are necessary to keep a computer up to date.

worm
Self-propagating malicious code that can automatically distribute itself from one computer to another through network connections. A worm can take harmful action, such as consuming network or local system resources, possibly causing a denial of service attack. Compare virus.

X

X.400
The International Telecommunication Union standard that defines message access tokens.