| (I) An assault on system security that derives from an intelligent
threat, i.e., an intelligent act that is a deliberate attempt
(especially in the sense of a method or technique) to evade
security services and violate the security policy of a system.
(See: penetration, violation, vulnerability.)
- Active vs. passive: An "active attack" attempts to alter system
resources or affect their operation. A "passive attack"
attempts to learn or make use of information from the system
but does not affect system resources. (E.g., see: wiretapping.)
- Insider vs. outsider: An "inside attack" is an attack initiated
by an entity inside the security perimeter (an "insider"),
i.e., an entity that is authorized to access system resources
but uses them in a way not approved by those who granted the
authorization. An "outside attack" is initiated from outside
the perimeter, by an unauthorized or illegitimate user of the
system (an "outsider"). In the Internet, potential outside
attackers range from amateur pranksters to organized criminals,
international terrorists, and hostile governments.
(C) The term "attack" relates to some other basic security terms
as shown in the following diagram:
+ - - - - - - - - - - - - + + - - - - + + - - - - - - - - - - -+
| An Attack: | |Counter- | | A System Resource: |
| i.e., A Threat Action | | measure | | Target of the Attack |
| +----------+ | | | | +-----------------+ |
| | Attacker |<==================||<========= | |
| | i.e., | Passive | | | | | Vulnerability | |
| | A Threat |<=================>||<========> | |
| | Agent | or Active | | | | +-------|||-------+ |
| +----------+ Attack | | | | VVV |
| | | | | Threat Consequences |
+ - - - - - - - - - - - - + + - - - - + + - - - - - - - - - - -+
|
