takedown – the process of rendering malware ineffective by removing its ability to perform its functions, for example, through decapitation.
technical control – the use of an electronic or digital method to influence or command how it is, or is not, able to be used.
Technical Disaster Recovery Plan – an operational document that describes the exact process, people, information and assets required to put any electronic or digital system back in place within a timeline defined by the business continuity plan. If there are multiple business continuity plans that reference the same technical disaster recovery plan, the restoration time used must meet the shortest time specified in any of the documents.
threat – any source of potential harm to the digital landscape.
threatscape –a term that amalgamates threat and landscape. An umbrella term to describe the overall, expected methods (vectors) and types of cyber attackers, that an organization or individual might expect to be attacked through or by.
three lines of defense – (UK: three lines of defence) – a security assurance model from the (now replaced) UK Financial Services Authority (FSA). The first tier is the business (or operations level) who must own and be responsible for their information, systems and following due process. The second tier is the security management functions who provide the processes, controls, expertise and other framework items to allow the business to operate within acceptable security risk tolerances. The final tier is auditing those who verify that the first two tiers (lines of defense) are operating as they should.
Tor – is a free software for enabling anonymous communication – or is free software for enabling anonymous communication. The name is an acronym derived from the original software project name The Onion Router,however, the correct spelling is “Tor”, capitalizing only the first letter. Tor directs Internet traffic through a free, worldwide, volunteer network consisting of more than seven thousand relays to conceal a user’s location and usage from anyone conducting network surveillance or traffic analysis. Using Tor makes it more difficult for Internet activity to be traced back to the user: this includes “visits to Web sites, online posts, instant messages, and other communication forms”
transmission control protocol (TCP) – the standard method used for networks and the internet to send and receive data error free and in the same order as was originally intended.
transport layer security (TLS) – is a cryptographic protocol (set of rules) for allowing secure communication between two digital locations. It is the successor to the Secure Socket Layer protocol but is often referred to as being an SSL protocol. It is a form of symmetrical encryption.
triple DES – see Data Encryption Standard.
trojan – an application (software program) that appears to be harmless but actually conducts other unseen malicious and unauthorized activities.
trusted network – an area of interconnected digital devices where the security controls and assignment of authorizations and privileges are subject to a known and acceptable level of control. The opposite of an untrusted network
two-factor authentication — The means of proving identity using two authentication factors usually considered stronger than any single factor authentication. A form of multi-factor authentication. Valid factors for authentication include Type 1: Something you know such as passwords and PINs; Type 2: Something you have such as smart cards or OTP (One Time Password) devices; and Type 3: Someone you are such as fingerprints or retina scans (aka biometrics).
two-step authentication — A means of authentication commonly employed on websites as an improvement over single factor authentication but not as robust as two-factor authentication. This form of authentication requires the visitor provide their username (i.e. claim an identity) and password (i.e. the single factor authentication) before performing an additional step. The additional step could be receiving a text message with a code, then typing that code back into the website for confirmation. Alternatives include receiving an e-mail and needing to click on a link in the message for confirmation, or viewing a pre-selected image and statement before typing in another password or PIN. Two-step is not as secure as two-factor because the system provides one of the factors to the user at the time of logon rather than requiring that the user provide both.