LiveSecurity Online Glossary

This glossary contains a list of terms, abbreviations, and acronyms frequently used when discussing networks, firewalls, and WatchGuard products.

10BaseT; 100BaseT
An Ethernet specification that can handle up to 10 mega bits of data per second. 10BaseT Ethernet imposes differing limitations, depending on what type of physical wire is being used and how many stations are attached to the network. For example, the maximum distance a hub can be from a workstation in 10BaseT is 325 feet if using twisted pair cables, but 3,000 feet if using fiber optic cable. Most modern Ethernets are migrating to 100BaseT, which is ten times faster than 10BaseT.

ACL (Access Control List)
A method of keeping in check the Internet traffic that attempts to flow through a given hub, router, firewall, or similar device. Access control is often accomplished by creating a list specifying the IP addresses and/or ports from which permitted traffic can come. The device stops any traffic coming from IP addresses or ports not on the ACL.

active mode FTP (File Transfer Protocol)
One of two ways an FTP data connection is made. In active mode, the FTP server establishes the data connection. In passive mode, the client establishes the connection. In general, FTP user agents use active mode and Web user agents use passive mode.

address learning
A method by which switches and routers determine the unique address number for each device on a network, enabling accurate transmission to and from each node.

address space probe
An intrusion technique in which a hacker sequentially scans IP addresses, generally as the information-gathering prelude to an attack. These probes are usually attempts to map IP address space as the hacker looks for security holes that might be exploited to compromise system security.

agent
A computer program that reports information to another computer or allows another computer access to the local system. Agents can be used for good or evil. Many security programs have agent components that report security information back to a central reporting platform. However, agents can also be remotely controlled programs hackers use to access machines.

AH (authentication header) 
An IPSec header used to verify that the contents of a packet have not been modified while the packet was in transit.

algorithm (encryption)
A set of mathematical rules (logic) for the process of encryption and decryption.

alias
A shortcut that enables a user to identify a group of hosts, networks, or users under one name. Aliases are used to speed user authentication and service configuration. For example, in configuring a Firebox a user can set up the alias "Marketing" to include the IP addresses of every network user in a company's marketing department.

API (Application Programming Interface) 
Programming tools that specify standard ways software programs within a given operating environment should act, so that numerous applications can play well together. These specifications and tools enable a developer to create applications that will interact well with other applications the developer has never seen, because all the developers are working from standardized specifications. For example, the robust APIs in Windows allow many dissimilar software products to interact upon one another (and even look similar) within the Windows environment.

Argument
    See parameter.

ARP (Address Resolution Protocol)
Each device on a network has at least two addresses: a media access control (MAC) address, and an Internet Protocol (IP) address. The MAC address is the address of the physical network interface card inside the device, and never changes for the life of the device; the IP address can change if the machine moves to another part of the network or the network uses DHCP. ARP, one of the IP protocols, is used to match, or resolve, an IP address to its appropriate MAC address (and vice versa). ARP works by broadcasting a packet to all hosts attached to an Ethernet. The packet contains the IP address the sender is interested in communicating with. Most hosts ignore the packet. The target machine, recognizing that the IP address in the packet matches its own, returns an answer.

ARP table
    A table of IP addresses stored on a local computer relating them to their corresponding MAC addresses. See also ARP.

ASN.1 (Abstract Syntax Notation One)  
   International standard that aims at specifying data used in communication protocols. ISO/IEC standard for encoding rules used in ANSI X.509 certificates. Two common types exist: DER (Distinguished Encoding Rules) and BER (Basic Encoding Rules).

asymmetric keys
    A pair of encryption keys, composed of one public key and one private key. Each key is one way, meaning that a key used to encrypt data cannot be used to decrypt the same data. However, information encrypted using the public key can be decrypted using the private key, and vice versa. This technology is commonly applied to e-mails, which are encrypted en route for confidentiality.

ATM (asynchronous transfer mode)
    A networking technology that breaks data into fixed-length cells, enabling high transfer speeds. ATM is widely used for the backbone, or core, of the Internet.

authentication
    1) The process of identifying an individual, usually based on a user name and password. Authentication is usually based on something a person has (such as a key, badge, or token), something a person knows (such as a password, ID number, or mother's maiden name), or something a person is (represented by a photo, fingerprint or retina scan, etc). When authentication requires two of those three things, it is considered strong authentication.
     2) A method of associating a user name with a workstation IP address, allowing the tracking of connections based on name rather than IP address. With authentication, you can track users regardless of which machine a person chooses to work from.

autopartitioning
    A feature on some network devices that isolates a node within the workgroup when the node becomes disabled, so as not to affect the entire network or group.

authorization
    To convey official access or legal power to a person or entity.

backbone
    A term often used to describe the main network connections composing the Internet.

backdoor
    A design fault, planned or accidental, that allows the apparent strength of the design to be easily avoided by those who know the trick.

bandwidth
    The rate at which a network segment can transfer data.

Bandwidth Meter
    A monitoring tool that provides a real-time graphical display of network activities across a Firebox. This comes as a part of the application called Firebox Monitors.

bastion host
    A computer placed outside a firewall to provide public services (such as WWW and FTP) to other Internet sites, hardened to withstand whatever attacks the Internet can throw at it. "Hardening" is accomplished by making the box as single-purpose as possible, removing all unneeded services and potential security vulnerabilities (a complex process). The term is sometimes inaccurately generalized to refer to any host critical to the defense of a local network.

bitmask
    A pattern of bits for an IP address that determines how much of the IP address identifies the host and how much identifies the network. For example, if a bitmask of 24 were applied to the address 10.12.132.208, 10.12.132 identifies the network and the remainder of the address (1-254) can be used to specify individual machines on the 10.12.132 network. To learn more, see IP address and subnet mask. You can find a full discussion of the topic in these LiveSecurity editorials from the Foundations series: "

block cipher 
    A procedure that translates plain text into coded text, operating on blocks of plain text of a fixed size (usually 64 bits). Every block is padded out to be the same size, making the encrypted message harder to guess.

blocked port
    A security measure in which a specific port is disabled, stopping users outside the firewall from gaining access to the network through that port. The ports commonly blocked by network administrators are the ports most commonly used in attacks. See also port.

blocked site
    An IP address outside the firewall explicitly blocked so it cannot connect with hosts behind the firewall. Sites can be blocked manually and permanently, or automatically and temporarily.

Blue Screen of Death (BSoD

BOVPN (Branch Office Virtual Private Network)
    A type of VPN that creates a securely encrypted tunnel over an unsecured public network, either between two networks that are protected by the WatchGuard Firebox System, or between a WatchGuard Firebox and an IPSec-compliant device. BOVPN allows a user to connect two or more locations over the Internet while protecting the resources on the Trusted and Optional networks.

bridge
    A piece of hardware used to connect two local area networks, or segments of a LAN, so that devices on the network can communicate without requiring a router. Bridges can only connect networks running the same protocol. 

broadcast
    A network transmission sent to all nodes on a network.

broadcast address
    A special type of networking address that denotes all machines on a given network segment. 

buffer overflow
    The result of a programming flaw. Some computer programs expect input from the user (for example, a Web page form might accept phone numbers from prospective customers). The program allows some virtual memory for accepting the expected input. If the programmer did not write his program to discard extra input (e.g., if instead of a phone number, someone submitted one thousand characters), the input can overflow the amount of memory allocated for it, and break into the portion of memory where code is executed. A skillful hacker can exploit this flaw to make someone's computer execute the hacker's code. Used interchangeably with the term, "buffer overrun." For more detail, see the LiveSecurity editorial, "Foundations: What Are Buffer Overflows?"

bus topology
    A type of network design used by all Ethernet systems, in which all the devices are connected to a central cable.  

cable segment
    A section of network cable separated by switches, routers, or bridges. 

cascade
    A command that arranges windows so that they are overlapped, with the active window in front.

Category 3 cabling
A cabling specification for 10BaseT networks, which are capable of handling up to  10 mega bits of data per second. See also 10BaseT / 100BaseT.

Category 5 cabling
A cabling specification for 100BaseT networks, which are capable of handling up to  100 mega bits of data per second. See also 10BaseT / 100BaseT.
    

CBC (Cipher Block Chaining)
    A technique commonly used by encryption algorithms like Data Encryption Standard (DES) - CBC, where a plain text message is broken into sequential blocks. The first block is encrypted using a given cipher, creating cipher text. That cipher text is used to encrypt the second block of plain text. This pattern continues, with each subsequent block of plain text being encrypted using the cipher text encrypted just before it.

certificate
    An electronic document attached to someone's public key by a trusted third party, which attests that the public key belongs to a legitimate owner and has not been compromised. Certificates are intended to help you verify that a file or message actually comes from the entity it claims to come from.

certificate authority (CA)
    A trusted third party (TTP) who verifies the identity of a person or entity, then issues digital certificates vouching that various attributes (e. g., name, a given public key) have a valid association with that entity.

certificate revocation list 
   See CRL
    

channel
    1) A communications path between two computers or devices. 2) A category of topics for LiveSecurity broadcasts (e.g., Virus Alerts, Editorials, etc.). You can turn on and off which channels you receive by logging in with your WatchGuard username and password at /archive/preferences.asp.

CHAP (Challenge Handshake Authentication Protocol) 
    A type of authentication where the person logging in uses secret information and some special mathematical operations to come up with a number value. The server he or she is logging into knows the same secret value and performs the same mathematical operations. If the results match, the person is authorized to access the server. One of the numbers in the mathematical operation is changed after every log-in, to protect against an intruder secretly copying a valid authentication session and replaying it later to log in. Often contrasted with PAP. 

CIDR (Classless Inter-Domain Routing)
    Originally, Internet addresses were classified as A, B, or C. The early classification system did not envision the massive popularity of the Internet, and is in danger of running out of new unique addresses. CIDR is an addressing scheme that allows one IP address to designate many IP addresses. A CIDR IP address looks like a normal IP address except that it ends with a slash followed by a number; for example, 192.168.0.0/16. CIDR is described in RFC 1519. For a full discussion of "classful" versus CIDR "classless" routing, see these LiveSecurity editorials from the Foundations series: "Understanding Subnetting (Part 1)," and "Understanding Subnetting (Part 2)."

cipher block chaining
   See CBC.

cipher text
    The result of encrypting either characters or bits using some algorithm. Cipher text is unreadable until it is decrypted.

clear-signed message
    A message that is digitally signed but not encrypted. See digital signature.

clear text
    Characters in a human readable form prior to encryption or after decryption. Also called plain text.

client
    A computer process that requests a service from another computer and accepts the server's responses.

Client/Server
    A network computing system in which individual computers (clients) use a central computer (server) for services such as file storage, printing, and communications. See peer-to-peer.

coax (coaxial) cable
    

collisions
    Conflicts that occur when two packets are sent over the network simultaneously. When packets collide, both packets are rejected. Ethernet automatically resends them at altered timing.

compress
    To compact a file or group of files so that they occupy less disk space. See also

compression function
    A function that takes input and returns a shorter output. One common program that performs this is WinZIP.

Control Center
    WatchGuard's toolkit of applications enabling configuration, management, and monitoring of a network security policy.

Control Panel
    The set of Microsoft Windows programs used to change system hardware, software, and settings.

conventional encryption
    See symmetric algorithm.

cookie
    A text file passed from the Web server to the Web client (a user's browser) that is used to identify a user and could record personal information such as ID and password, mailing address, credit card number, and more. A cookie is what enables your favorite Web site to "recognize" you each time you revisit it.

coprocessor
    A microprocessor designed to assist another microprocessor in specific functions, such as handling complex mathematics or graphics, and to temporarily reduce the workload of the other microprocessor.

CPU (Central Processing Unit)
    The microprocessor chip that interprets and carries out most of the instructions you give your computer. Also, simply, a term for a computer.

cracker
    Another term for someone who attempts to defeat network security measures, with hostile intent. Commonly used in popular media as a synonym for hacker.

cross-certification
    A status where two or more organizations or certificate authorities share some level of trust.

crossover cable
    Ethernet cables have multiple wires inside them. Some are dedicated to sending; some are dedicated to receiving. A crossover cable is a special cable in which the receive and send wires cross so that the sending leads on one device can directly connect to the receiving leads on the other device. When WatchGuard encloses a crossover cable with its products, it is typically color-coded red for easy identification. 

cross-site scripting
    An attack performed through Web browsers, taking advantage of poorly-written Web applications. Cross-site scripting attacks can take many forms. One common form is for an attacker to trick a user into clicking on a specially-crafted, malicious hyperlink. The link appears to lead to an innocent site, but the site is actually the attacker's, and includes embedded scripts. What the script does is up to the attacker; commonly, it collects data the victim might enter, such as a credit card number or password. The malicious link itself might also collect the victim's cookie data. For more details and examples, see the LiveSecurity article, "Anatomy of a Cross-Site Scripting Attack." 

cryptanalysis
    The art or science of transferring cipher text into plain text without initial knowledge of the key used to encrypt the plain text.

CRYPTOCard
    One element in a proprietary authentication system, which uses an offline card containing a large secret key to answer security "challenges" from the network. The large number inside the card, called a key, is like a hard-to-guess password used in encrypting and decrypting. The key is never stored on a computer, which increases its safety against unauthorized discovery.

cryptography
    The art and science of encoding and decoding messages using mathematical algorithms that utilize a secret key. The concept has broadened to include managing messages that have some combination of: privacy (by being unreadable to anyone but the sender and receiver); integrity (not modified while en route), and non-repudiation (digitally signed in such a way that the originator cannot plausibly claim he or she did not originate it).

CSLIP (Compressed Serial Line Internet Protocol)
    A protocol for exchanging IP packets over a serial line, which compresses the headers of many TCP/IP packets.

custom filter rules
    A filter rule is a configuration setting  to either deny or allow specific content types through the Firebox. A custom filter rule is a rule a Firebox user created in WatchGuard Policy Manager, in contrast with the pre-made rules WatchGuard created for the Firebox.

datagram
    A packet of data that contains information, plus origin and destination addresses. Generally used in reference to UDP and ICMP packets when talking about IP protocols.

data transmission speed
    The number of bits that are transmitted can travel per second over a network cable, typically measured in bits per second (bps).

DCE-RPC (Distributed Computing Environment Remote Procedure Call)
    A Microsoft implementation of a portmapping service. A portmapper is a service that runs on a specific port, redirecting clients that send a request to that port. These initial calls typically result in a response from the trusted machine that redirects the client to a new port for the actual service the client wants. See also RPC.

DDoS
    See denial of service attack (DoS).

decompress
    To expand a compressed file or group of files back to their normal size so that the file or files can be opened. See also compress.

decrypt
    To decode data that has been encrypted, turning it back into plain text. See also encrypt.

dedicated server
    A single computer in a network, reserved for serving the needs of the network.

default
    A predefined setting built into a program, used when an alternative setting is not specified.

default gateway
    When individual machines on a network segment send data packets, they check the packet's destination to figure out whether the destination is local (meaning, on the same network segment) or not. If the packet's destination is not local, the machine forwards it to a node on the network serving as the entrance to all other networks. This node is called the default gateway, and could be any routing device, such as a router or a firewall appliance.

default packet handling
    A set of rules that instruct the Firebox on how to process packets when no other rules have been specified. For example, by default the Firebox logs any packet sent to a broadcast address.

DES (Data Encryption Standard)
    A commonly-used encryption algorithm that encrypts data using a key of 56 bits, which is considered fairly weak given the speed and power of modern computers. Until recently it was the US government's encryption standard, but it has largely been replaced by Triple-DES and AES. See also

device
    A generic term for computer equipment such as a hub, switch, router, or printer.

DHCP (Dynamic Host Configuration Protocol)
    A standard proposed in RFC 1541 for transferring network configuration information from a central server to devices as the devices boot up. This data typically includes a machine's IP address, which the server can change and allocate automatically (on the fly) under DHCP.

DHCP server
    A device that automatically assigns IP addresses to networked computers from a defined pool of numbers, returning unused IP addresses to the pool. Using a DHCP server, an administrator normally does not have to get involved with the details of assigning IP addresses to individual clients.

dialog box
    A box that appears when you choose a command from a menu. It offers additional options, and requires your acknowledgement before it goes away.

dial-up connection
    A connection between a remote computer and a server, established using software, a modem, and a telephone line.

dictionary attack
    An attempt to guess a password by systematically trying every word in a dictionary as the password. This attack is usually automated, using a dictionary of the hacker's choosing, which may include both ordinary words and jargon, names, and slang. 

Diffie-Hellman
    A mathematical algorithm that allows two users to exchange a secret key over an insecure medium without any prior secrets. This protocol, named after the inventors who first published it in 1976, is used in Virtual Private Networking (VPN).

digital signature
    An electronic identification of a person or thing, intended to verify to a recipient the integrity of data sent to them, and the identity of the sender. Creating a digital signature involves elaborate mathematical techniques that the sender and recipient can both perform on the transmitted data. Performing identical formulas on identical data should produce identical results at both the sending and receiving end. If the recipient's results do not equal the sender's results, the message may have been tampered with en route. If the message was modified after being sent -- even if all someone did was change the punctuation on a sentence, or added an extra space between two of the words -- you could tell. A digital signature typically depends upon three elements: public key encryption, a Certificate Authority, and a digital certificate.

disarmed
    The state of a Firebox when it is not actively protecting a network.

DLL (Dynamic Link Library)
    In Microsoft Windows, a Dynamic Link Library is a collection of functions that perform very commonly used tasks. This library is intended to be a universal resource that any program can use, reducing the need to have similar snippets of code existing on a computer in multiple places. Windows comes with many DLLs that programs can use to get the recognized "Windows" feel.

DMZ (Demilitarized Zone)
    A partially-protected zone on a network, not exposed to the full fury of the Internet, but not fully behind the firewall. This technique is typically used on parts of the network which must remain open to the public (such as a Web server) but must also access trusted resources (such as a database). The point is to allow the inside firewall component, guarding the trusted resources, to make certain assumptions about the impossibility of outsiders forging DMZ addresses. WatchGuard refers to the DMZ as the Optional network interface.

DNS (Domain Name System)
    A network system of servers that translates numeric IP addresses into readable, hierarchical Internet addresses, and vice versa. This is what allows your computer network to understand that you want to reach the server at 192.168.100.1 (for example) when you type into your browser a domain name such as www.watchguard.com. 

DNS cache poisoning
    A clever technique that tricks your DNS server into believing it has received authentic information when, in reality, it has been lied to. Why would an attacker corrupt your DNS server's cache? So that your DNS server will give out incorrect answers that provide IP addresses of the attacker's choice, instead of the real addresses. Imagine that someone decides to use the Microsoft Update Web site to get the latest Internet Explorer patch. But, the attacker has inserted phony addresses for update.microsoft.com in your DNS server, so instead of being taken to Microsoft's download site, the victim's browser arrives at the attacker's site and downloads the latest worm. For more details, and countermeasures, see the LiveSecurity editorial, "How to Stop DNS Spies."

DNS lookup
    The Domain Name Service act of matching a friendly, readable domain name (such as www.watchguard.com) to its associated IP address.

DNS spoofing
    An attack technique where a hacker intercepts your system's requests to a DNS server in order to issue false responses as though they came from the real DNS server. Using this technique, an attacker can convince your system that an existing Web page does not exist, or respond to requests that should lead to a legitimate Web site, with the IP address of a malicious Web site. This differs from DNS cache poisoning because in DNS spoofing, the attacker does not hack a DNS server; instead, he inserts himself between you and the server and impersonates the server.

domain name hijacking
    An attack technique where the attacker takes over a domain by first blocking access to the victim domain's DNS server, then putting up a malicious server in its place. For example, if a hacker wanted to take over fnark.com, he would have to remove the fnark.com DNS server from operation using a Denial of Service attack to block access to fnark's DNS server. Then, he would put up his own DNS server, advertising it to everyone on the Internet as fnark.com. When an unsuspecting user went to access fnark.com, he would get the attacker's domain instead of the real one. To learn other versions of domain name hijacking, see the LiveSecurity editorial, "Repelling Domain Name Hijackers."

dotted notation
    The notation used to write IP addresses as four decimal numbers separated by dots (periods), sometimes called dotted quad. Example: 123.212.12.4. For a full explanation of IP addresses, see the LiveSecurity article, "Foundations: Understanding IP Addresses and Binary."

driver
    A software program that manipulates a device (such as a printer, keyboard, mouse, or hard drive). The driver accepts generic commands from a program and then translates them into specialized commands for the device.

drop-in mode
    A network configuration in which the Firebox is physically located between the router and the LAN without any of the computers on the Trusted interface being reconfigured. This is a quick and simplified way to get the Firebox into the network, but can only protect a single network that is not subdivided into smaller networks. See also proxy ARP. For a contrasting approach, see routed mode.

drop-in network
    A network being used in drop-in mode. See drop-in mode. 

DSA (Digital Signature Algorithm)
    A public key digital signature algorithm proposed by the National Institute of Standards and Technology..

DSS (Digital Signature Standard)
    A standard for digital signatures proposed by the National Institute of Standards and Technology.

DVCP (Dynamic VPN Configuration Protocol)
    A WatchGuard proprietary protocol that simplifies configuration of VPNs. A DVCP server provides centralized storage of all configured devices under management and builds Virtual Private Networks quickly and interactively for those devices

Dynamic Link Library
    See DLL.

dynamic NAT
    On outgoing requests from your network, the Firebox replaces all private IP addresses of origin with one public address (usually its own). See Network Address Translation, and IP masquerading.

ECC (Elliptic Curve Cryptosystem) 
    A method for creating public key algorithms, which some experts claim provides the highest strength-per-bit of any cryptosystem known today. Its algorithms accept an encryption key but then add extra numbers representing the coordinates of points on an imaginary wiggly curve as it crosses an imaginary line. Its complicated algebraic approach allows shorter keys to produce security equivalent to longer keys in other cryptosystems (such as RSA). Shorter keys mean the encryption and decryption can be performed relatively quickly and with less computer hardware. Numerous experts believe ECC will eventually enjoy widespread use.

elevation of privilege
     Almost every computer program has some notion of "privilege" built in, meaning, permission to do some set of actions on the system. This permission is granted to individuals based on their ability to present proper credentials (for example, a username and password). Privilege has levels -- for example, a guest account typically has fewer privileges than an administrator account. Many network attacks begin with an attacker obtaining limited privileges on a system, then attempting to leverage those privileges into greater privileges that might ultimately lead to controlling the system. Any attempt to gain greater permissions illicitly (typically, by impersonating a privileged user or otherwise bypassing normal authentication) is considered an elevation of privilege. For a lengthier discussion, see the LiveSecurity article, "What We Mean by 'Elevation of Privileges'.'"

encryption
    The process of disguising data to hide its content. As used in a network security context, encryption is usually accomplished by putting the data through any of several established mathematical algorithms developed specifically for this purpose. 

entropy
    In cryptography, a mathematical measurement of the amount of uncertainty or randomness.

ESMTP (Extended Simple Mail Transfer Protocol)
    A protocol that provides extensions to SMTP for sending e-mail that supports graphics, audio, and video files, and text in various foreign languages. These extensions were first described in RFC 1869. To learn about some of the dangers of ESMTP, and how the Firebox handles them, read the LiveSecurity article, "The Mysteries of ESMTP."

ESP (Encapsulating Security Payload)
    An IPSec protocol used in WatchGuard's Branch Office VPN. ESP encrypts all or part of a packet of data in a way that assures confidentiality even though the data travels over the public Internet. It provides data integrity, and offers assurance of the identity of the data's sender (authentication). For details, see RFC 1827.

Ethernet
    One of the least expensive, most widely deployed networking standards, enabling the transmission of data at 10 million bits per second (Mbps), using a specified protocol. A more recent Ethernet standard, called 100BaseTx, enables data to be transmitted and received at 100 Mbps.

Ethernet address
    A unique ID number obtained automatically when an Ethernet adapter is added to a computer. This address identifies the machine as a unique communication item and enables direct communications to and from that particular computer. See also MAC address.

event
    Any network incident that prompts some kind of log entry or other notification.

extension
    See

External interface
    On the Firebox, an Ethernet port intended for connecting to the portion of your network that presents the greatest security risk (typically the Internet and any other switches, routers, or servers connected to, but outside, your network).

External network
    Any network that can connect to yours, with which you have neither a trusted or semi-trusted relationship. For example, a company's employees would typically be trusted on your network, a primary vendor's network might be semi-trusted, but the public Internet would be untrusted -- hence, External.

failover
    A configuration that allows a secondary machine to take over in the event of a stoppage in the first machine, thus allowing normal use to return or continue. See also high availability.

failover logging
    A process in which the Firebox immediately establishes contact with a secondary log host, in the event that the Firebox cannot communicate with the primary log host.

fail-shut mode
    A condition in which a firewall blocks all incoming and outgoing network traffic in the event of a firewall failure. This is the opposite of fail-open mode, in which a firewall crash opens all traffic in both directions. Fail-shut is the default failure mode of the WatchGuard Firebox System.

fast Ethernet
    An Ethernet networking system that transmits data at 100 million bits per second (Mbps), ten times the speed of an earlier Ethernet standard. Derived from the Ethernet 802.3 standard, it is also known as 100Base-T.

file server
    A dedicated network computer that stores data files so that other computers can share access to them. See also client/server.

filtering process
    Deciding whether a packet should be allowed or denied, depending on what is contained in its header or its contents, based on user-defined policies.

fingerprint
    A unique identifier for a key that is obtained by hashing specific portions of the key data. See one-way hash function.

file extension
    Under Windows, a period and up to three characters at the end of a file name. The extension can help identify the type of file, and often helps a computer know what to do with the file.

filters
    Small, fast programs in a firewall that examine packets as they arrive at the firewall, and route or reject the packets based on user-definable rules.

Firebox
    The WatchGuard firewall appliance.

Firebox Monitors 
    A suite of WatchGuard Firebox System observation tools combined into a single user interface accessible from Control Center. Firebox Monitors allows you to keep an eye on bandwidth usage, who has authenticated to the Firebox, what Web sites have been automatically blocked because they sent questionable traffic, and more.

firewall
    Software or hardware components that restrict access between a protected network and the Internet, or between other sets of networks, to block unwanted use or abuse.

flash disk
    An 8-megabyte, on-board flash ROM disk that acts like a hard disk in a Firebox. The word "flash" arises from the fact that it can be erased and reprogrammed rapidly, in blocks instead of one byte at a time.

forward DNS lookup
    See DNS lookup

FQDN (Fully Qualified Domain Name)
   A fully qualified domain name consists of a host and domain name, including a top-level domain such as .com, .net, .gov, .edu, etc. For example, www.watchguard.com is a fully qualified domain name. www is the local host, watchguard is the second-level domain, and .com is the top level domain. 

FTP (File Transfer Protocol)
    The most common protocol for copying files over the Internet. See also

Fully Qualified Domain Name
    See FQDN.

Function
    In programming, a function is part of a program that performs a specific task. Computer programs usually consist of modules of code. Each module consists of a small part of the program written to perform one specific task. These small, special-purpose chunks of code are called functions. When a program runs, it calls different functions to perform certain tasks. For example, a programmer could write a function to alphabetize a list of names. When the program got to the place where it needed to alphabetize a list of names, the program would call the alphabetizing function, and the function would return the list of names in the correct order. If those names then had to be inserted into a database, the program might call a different function to accomplish that. See also parameter and Dynamic Link Libraries.

gateway
    A system that provides access between two or more networks. Gateways are typically used to connect networks that are dissimilar. The Firebox often serves as the gateway between the Internet and your network. 

GUI (Graphical User Interface)
    The visual representation on a computer screen that allows users to view, enter, or change information. It is characterized by icons and commonly utilizes a mouse, in contrast to a Command Line Interface (CLI), which uses strictly text.

handshake
   See TCP handshake

hash code
    A unique, mathematical summary of a document that serves to identify the document and its contents. See message digest.

header
    A series of bytes at the beginning of a communication packet that provides information about the packet such as its computer of origin, the intended recipient, packet size, and destination port number. The header of a packet is like the envelope of a traditionally-mailed letter, in that it conveys "return address" and "intended recipient" information but is not the real content of the message.

hexadecimal
    A base-16 numbering system (from hexadecem, Latin for 16) particularly important in computer programming, since four bits (each consisting of a one or zero) are succinctly expressed using a single hexadecimal digit. Hexadecimal resembles decimal (base-10) numbering with the digits 0 through 9, but the decimal equivalents of 10 - 16 are represented in hexadecimal by the letters A through F. Example: the decimal number 252 is written in hexadecimal as FC. 

hierarchical trust
    A method of organizing "trust" within an organization by allowing one Certificate Authority to delegate a portion of its responsibility to a subordinate Certificate Authority. For example, a business might have a master Certificate Authority, which vouches for a Certificate Authority at the company's Los Angeles office, which vouches for a Certificate Authority at the company's Phoenix office. Commonly used in ANSI X.509 certificates.

High Availability
    High Availability enables the installation of two Fireboxes so that if one fails for any reason, the other takes over immediately. This minimizes data loss while the failed box is replaced or repaired..

Historical Reports
    A WatchGuard Firebox System application that creates HTML reports of Firebox log files, displaying session types, most active hosts, most used services, and other information useful in monitoring and troubleshooting a network.

HMAC (Hashed Message Authentication Code)
    A mechanism for message authentication, using cryptographic one-way hash functions, based upon RFC 2104 and commonly used in VPNs. The end result is that when you receive a data packet, you can know that whoever sent the packet possesses the same secret key that you do. You can combine this with other technologies, such as IKE, to know who sent a given message.

home page
    The first page of a multi-page Web site, used as an entrance into the site.

host
    A network-connected computer.

host route 
    A network configuration where a router sits between the Firebox and an internal host. For the Firebox to be able to send data to the host, it must be informed of the existence of the additional router (and the host behind it). This entry in the Firebox's routing table is the host route. 

HostWatch
    A WatchGuard Control Center application that provides a real-time display of which hosts are connected from behind the Firebox to hosts on the Internet.

HTML (HyperText Markup Language)
    A simple programming language used to format Web pages, including methods to specify text characteristics, graphic placement, and links. HTML files are written in plain text, then read or interpreted by a Web browser.

HTTP (HyperText Transfer Protocol)
    A communications standard designed and used to transfer information and documents between servers or from a server to a client. This standard is what enables your Web browser to fetch pages from the World Wide Web.

HTTPS (Secure HTTP)
    A variation of HTTP enabling the secure transmission of data. Generally used in conjunction with Secure Sockets Layer (SSL), which encrypts the HTTP.

hub
    A device that serves as a common connection point for multiple devices on a network. There are several different types of hubs, but in general each receives and sends signals to all the devices connected to it.

hyperlink
    An object on a Web page such as a graphic or underlined text that represents a link to another location, either on the same Web site or on a different Web site. When  a user clicks on a hyperlink, a page or graphic from the linked location appears in the user's Web browser.

IANA (Internet Assigned Number Authority)
    The central authority charged with assigning parameter values (numbers) to Internet protocols. For example, IANA controls the assignment of well-known TCP/IP port numbers. Currently IANA manages port numbers 1 through 1023.

ICANN (Internet Corporation for Assigned Names and Numbers ) 
     A non-profit, private-sector corporation formed by a broad coalition of the Internet's business, technical, academic, and user communities. ICANN has been recognized by the U.S. and other governments as the global consensus entity to coordinate the technical management of the Internet's domain name system, the allocation of IP address space, the assignment of protocol parameters, and the management of the root server system.

ICMP (Internet Control Message Protocol)
    A protocol used to pass control and error messages back and forth between nodes on the Internet. Perhaps the most used ICMP command is ping. 

identity certificate
    A signed statement that binds a public encryption key to the name of an individual and therefore delegates authority from that individual to the public key. Any message encrypted with that person's public key can then be regarded as being from that person.

IDS (Intrusion Detection System)
    A class of networking products devoted to detecting attacks from hackers. Network-based intrusion detection systems examine the traffic on a network for signs of unauthorized access or attacks in progress, while host-based systems look at processes running on a local machine for activity an administrator has defined as "bad."

IETF (Internet Engineering Task Force)
    A large, open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. IANA is chartered by one of the IETF's working groups.


IKE (Internet Key Exchange)
    A standard proposed in RFC 2409 used with IPSec virtual private networks (VPNs) for automating the process of negotiating encryption keys, changing keys, and determining when to change keys. IKE first mutually authenticates the two endpoints that plan to set up IPSec tunnels between them; then the endpoints can establish mutually agreed-upon security parameters. For more, see IPSec and VPN. 

initialization vector
    A block of arbitrary data that serves as the starting point for a block cipher like Triple-DES. See also cipher block chaining.

initialize
    To prepare (a disk) for information storage.

installation wizard
    A software tool specifically designed to guide a user through the process of installing a new application.

integrity; data integrity
    The concept that you can discern whether data is in the condition its authors or owners intend it to be, and that it has not been modified by unauthorized persons during storage or transmittal.

interface
    A boundary across which two independent systems meet and act on or communicate with each other. The term sometimes refers to the wires, plugs, and sockets that hardware devices use to communicate with each other. Other times, it refers to the style in which a software program receives and responds to user input; for example, command line interface or graphical user interface.

Internet address class
    Historically, to efficiently administer the whole range of possible 32-bit IP addresses, the addresses were separated into three classes that describe networks of varying sizes:
    

Internet Engineering Task Force
   See IETF.
    

intranet
    A self-contained network with a limited number of participants who extend limited trust to one another in order to accomplish an agreed-upon goal. For example, a manufacturer and its key vendors might create an intranet to facilitate managing the process of turning raw materials into finished products. 

Intrusion Detection System
    See IDS.

IP (Internet Protocol)
    A fundamental set of detailed specifications that controls how data packets are formatted and how they move from one networked computer to another.

IP address
    An understanding of IP addresses is foundational for managing a network, so we go into some depth with this definition. 
    In short, an IP address is a numeric identifier that represents a computer or device on a TCP/IP network. The devices on the network rely on the address in order to know where to route data. 
    The format of an IP address is a 32-bit number divided into four 8-bit segments, separated by periods. The four segments, called octets, can be represented in binary notation (ones and zeros, the basic building blocks of all software) like this: 11010000.10001100.00100011.00000010. Because writing so many ones and zeros is inefficient and laborious for humans, IP addresses are usually converted to decimal notation when written out (but remember, the machines always understand them as ones and zeros). For example, the same binary address above, expressed in decimal, is 208.140.35.2. In decimal notation, no octet can have a value greater than 255. This is because binary requires 9 ones and zeros to express a number greater than 255, and the rules for IP addresses only allow 8. 
    Some portion of any IP address designates a network, and the remaining portion of the address designates a specific device on that network. For more information, see network address, Internet address class, and subnet mask. You can also read the LiveSecurity editorial, "Foundations: Understanding IP Addresses and Binary."

IP fragment 
    A formatted portion of data that is part of a larger IP packet. IP fragments are typically used when an IP packet is too large for the physical media that the data must cross. For example, the IP standard for Ethernet limits IP packets to about 1,500 bytes, but the maximum IP packet size is 65,536 bytes. To send packets larger than 1,500 bytes over an Ethernet, IP fragments must be used.

IP options
    Extensions to the Internet Protocol used mainly for debugging and special applications on local networks. In general, there are no legitimate uses of IP options over an Internet connection.

IP options attack
    A method of gaining unauthorized network access by utilizing IP options.

IPSec (Internet Protocol Security)
    An open-standard methodology of exchanging data over the public Internet while protecting the data from prying eyes while it travels from the originator to the recipient. IPSec provides encryption and authentication options to maximize the confidentiality of data transmissions, employing cryptographic protocols in conjunction with

IP spoofing
    The act of inserting a false (but ordinary-seeming) sender IP address into the "From" field of an Internet transmission's header in order to hide the actual origin of the transmission. There are few, if any, legitimate reasons to perform IP spoofing; the technique is usually one aspect of an attack.

ISAKMP (Internet Security Association Key Management Protocol)
    A set of specifications defined in RFC 2408 and used in close conjunction with IPSec. Defines the procedures for authenticating, creating and managing security associations, generating keys, and using digital certificates when establishing VPN connections.

ISO (International Organization for Standardization)
    An international organization composed of national standards bodies from over 75 countries. For example, ANSI (American National Standards Institute) is a member of ISO. ISO has defined a number of important computer standards, the most significant of which is perhaps OSI (Open Systems Interconnection), a standardized architecture for designing networks.

ISP (Internet service provider)
    A business that sells access to the Internet. A government bureau or an educational institution may be the ISP for some organizations.

ITU-T (International Telecommunication Union-Telecommunication)
    Formerly the CCITT (Consultative Committee for International Telegraph and Telephone), a worldwide telecommunications technology standards organization. Just as IETF and ICANN propose and maintain standards for the Internet, ITUT proposes and establishes standards for international telephony.

Java applet
    A small program written in the Java programming language that can be included on an HTML page, much in the same way an image is included. When someone uses a Java-enabled browser to view a page that contains an applet, the applet's code is transferred to that user's system and executed by the browser's Java virtual machine (JVM). For example, if you access a Web page that shows a virtual stock ticker streaming by with live data, that might be enabled by a Java applet.

Kerberos
    A trusted third-party authentication protocol developed at Massachusetts Institute of Technology and used widely in the United States. Unlike other authentication schemes, Kerberos does not use public key technology. Instead, it uses symmetric ciphers and secrets shared between the Kerberos server and each individual user. Each user has a unique password, and the Kerberos server uses this password to encrypt messages sent to that user, so the message can't be read by anyone else.

key
    A secret code, most often expressed as a numeric value, used to encrypt a message, to make the text unreadable to anyone but the intended recipient. If a message encrypted by a key must be decrypted by using the same key, the key is called a symmetric key. If a message encrypted by a key must be decrypted using a different key, the keys are called asymmetric keys, or a key pair. Key pairs (usually comprised of a public key and a private key) form the basis of public key cryptography.

key exchange
    A scheme for two or more nodes to transfer a secret session key across an unsecured channel, such as the Internet.

key fingerprint
    A uniquely identifying string of numbers and characters used to authenticate public keys.

key ID
    A code that uniquely identifies a key pair. Two key pairs can have the same user ID, but they have different key IDs. See also key and key fingerprint.

key length
    The number of bits representing the key size; the longer the key, the stronger it is.

key management
    The process and procedure for safely storing and distributing accurate cryptographic keys; the overall process of generating and distributing cryptographic keys to authorized recipients in a secure manner.

key pair
    Public key cryptography uses a pair of key codes related to each other in this way: if you lock-up data using one key code, you can only unlock it using the other key code. And vice versa. One of the keys is made known publicly, while the other is kept private. The two, together, form a key pair. See also key and keyring.

keyring
    A set of digital codes, or keys, used to encrypt and decrypt messages in asymmetric cryptography. Each user has two types of keyrings: a private keyring and a public one. People who wish to receive encrypted messages typically publish their public keys in directories or make their keys otherwise available. To send them an encrypted message, all you have to do is get a copy of their public key, use the public key to encrypt your message, and send it to them. The only person who can decrypt the message is the person who possesses the matching private key.

key splitting
    The process of dividing a private key into multiple pieces and sharing those pieces among several users. A designated number of users must bring their shares of the key together to use the key.

LAN (local area network)
    A computer network that spans a relatively small area, generally confined to a single building or group of buildings.

LDAP (Lightweight Directory Access Protocol)
    A protocol that helps manage information about authorized users on a network,  such as names, phone numbers, addresses, and what a user is and is not allowed to access. LDAP is vendor- and platform-neutral, working across otherwise incompatible systems.

Linux
    

log host, logging host
    A designated device for receiving and storing a record of events from another device or program (such as a Firebox, SOHO, or ServerLock).

LogViewer 
    A WatchGuard Control Center application for viewing Firebox log files.

loopback interface
    A special type of interface that allows you to make network connections to yourself, using IP. This convention, which all Internet-aware applications expect and utilize, has a variety of purposes, including routing and application testing.

MAC (Machine Authentication Code)
    A way to check the integrity of information transmitted over, or stored on, an unreliable medium, based on a secret key. Typically, MACs are used between two parties who share a secret key, in order to validate the information transmitted between the two parties. key-dependent, one-way hash function, requiring the use of the identical key to verify the hash. See also HMAC.

MAC address (Media Access Control)
One of the two addresses every networked computer has (the other being an IP address), a Media Access Control address is a unique 48-bit identifier usually written as 12 hexadecimal characters grouped in pairs (e. g., 00-00-0c-34-11-4e). This address is usually hard-coded into a Network Interface Card (NIC) by its manufacturer, and does not change. It is the physical address of a data device, and is used as an aid for routers trying to locate machines on large networks. See also ARP and Ethernet address.

mail server
    Refers to both the application and the physical machine tasked with routing incoming and outgoing electronic mail.

Management Station
    The computer on which the WatchGuard Firebox System Control Center and Policy Manager run. In its simplest terms, this is the computer you use to configure and monitor a WatchGuard Firebox.

masquerading
    In the WatchGuard Firebox System, masquerading sets up addressing so that a Firebox presents its IP address to the outside world in lieu of the IP addresses of the hosts protected by the Firebox. See also NAT.

MD2 (Message Digest 2)
    128-bit, one-way hash function that is dependent on a random permutation of bytes. MD2 is considered very secure, but takes a long time to compute, and therefore is rarely used. See also message digest.

MD4 (Message Digest 4)
    A 128-bit, one-way hash function that uses a simple set of bit manipulations on 32-bit operands, developed as a weaker but faster alternative to MD2. See also message digest.

MD5 (Message Digest 5)
    A more secure, more complex version of MD4, but still a 128-bit, one-way hash function. Although now widely used, MD5 contains a few flaws discovered in 1996 making it slightly weaker, so it is gradually falling out of favor in deference to another message digest function known as SHA-1. See also message digest.

message digest
    A mathematical function used in encryption to distill the information contained in a file into a single large number, typically between 128 and 256 bits in length. Message digests are also known as one-way hash functions because they produce results where it is mathematically infeasible to try to calculate the original message by computing backwards from the result. Message digest functions are designed so that a change to a single character in the message will cause the message to result in a very different message digest number. Many different message digest functions have been proposed and are now in use; most are considered highly resistant to attack.

MIME (Multipurpose Internet Mail Extensions)
   A specification for formatting non-ASCII messages so that they can be sent over the Internet. Many e-mail clients now support MIME, which enables them to send and receive graphics, audio, and video files via the Internet mail system. In addition, MIME supports messages in character sets other than ASCII.

modem
    A shortened version of "modulator/demodulator," this is the word for a communications device that sends computer transmissions over a standard telephone line.

motherboard
    The main printed circuit board in a computer, which contains sockets that accept additional boards (daughterboards).

MSDUN
    An abbreviation for Microsoft Dial-Up Networking, required for remote user VPN.

multiple network configuration
    See routed mode.

name resolution
    

NAT (Network Address Translation) 
     A technology where you advertise one IP address for the world to send stuff to (e-mails, HTTP, database traffic, whatever). Then the Firebox translates that request from the outside world and sends it to the appropriate IP address inside your network. In this way, the Firebox can hide from outsiders the IP addresses of machines on your internal network. Various techniques for applying NAT include dynamic NAT, and static NAT. Some people use the term NAT interchangeably with masquerading. For a discussion of NAT as it relates to the Firebox, see the LiveSecurity article, "How and When to Use 1:1 NAT," and the Frequently Asked Questions Web page about Network Address Translation.

National Institute for Standards and Technology 
    See NIST. 

network address
    

network address translation 
     See NAT.

netmask
    See subnet mask.

Network Configuration wizard
    Automated software presenting a series of windows. The various windows and fields prompt you for essential information that helps creates a basic Firebox configuration.

network adaptor, network interface card (NIC)
    A device that sends and receives data between the computer and the network cabling. Every computer attached to a network must have a NIC.

network range
   See subnet mask.

network segment
   A subdivision of a computer network, bounded by a device such as a router, switch, or even a Firebox. Dividing an Ethernet into multiple segments is a common way of increasing available bandwidth on the individual segments. 

NFS (Network File System)
    A popular TCP/IP service for providing shared file systems over a network. NFS allows all network users to access shared files stored on computers of different types. A user can manipulate shared files as if the files were stored locally on the user's own hard disk. NFS is typically found on Unix computers.

NIST (National Institute for Standards and Technology)
    A division of the U.S. Department of Commerce that publishes open interoperability standards called Federal Information Processing Standards (FIPSs). Part of NIST's charter is to distribute complete and accurate information about computer security issues to government and the general public.

node
    A computer or CPU on a network.

non-seed router 
    A router that waits to receive information (the routing maintenance table) from other routers on the network before it begins routing packets.

NTP (Network Time Protocol)
    An Internet service used to synchronize clocks between Internet hosts. Properly configured, NTP can usually keep the clocks of participating hosts within a few milliseconds of each other.

Oakley
    The Oakley Session Key Exchange provides a hybrid Diffie-Hellman session key exchange for use within the ISAKMP framework. Oakley provides the important property of Perfect Forward Secrecy (PFS).

octet
    A byte. Used instead of "byte" in most IP documents because historically many hosts did not use 8-bit bytes. For a full discussion, read the LiveSecurity article, "Foundations: Understanding IP Addresses and Binary."

one-time pad
    A stack of papers bound together, with each paper providing one large, non-repeating set of truly random letters and/or numbers used as an encryption key. Widely used in World War II, the method consisted of using the key on a page exactly once, then tearing off the page and using the key on the next page for the next message. Since the key changes with every message, the enemy does not have a feasible chance to decrypt any given message; thus, one-time pads are considered the only perfect encryption scheme -- as long as the bad guys don't intercept a copy of the pad.

one-way hash function
    A mathematical process performed on data to produce a numeric result called a message digest, which cannot be reversed to produce the original message. See hash and message digest. 

open source software
    A term applied when the source code of a computer program is made available free of charge to the general public. The reason for doing so is that potentially, a larger group of programmers will produce a more useful and bug-free product than a smaller group of programmers, and that more people will use software that is free. The concept relies on peer review to find and eliminate bugs in the program code, which happens at a much quicker rate than with commercial software because the information is shared throughout the open source community instead of through a corporation's smaller, proprietary R & D department. One of the most famous examples of open source software is Linux.

Optional interface
   The Ethernet port on the Firebox provided so you can connect a second secured network. This second network is often referred to as the "demilitarized zone" (DMZ), or the Optional network. 

Optional network
   A network architecture used by an organization that wants to host its own Internet services without allowing unauthorized access to its private network.  Typically, the Optional network contains devices accessible to public Internet traffic, such as Web (HTTP) servers, FTP servers, SMTP (e-mail) servers and DNS servers. Access from the Optional network to the Trusted network can then be appropriately restricted by the firewall. For that reason, some refer to the Optional network as a "semi-public" network.

packet
    A unit of information formatted according to specific protocols that allow precise transmittal of data from one node in a network to another. Also called a datagram or a data packet, it contains two parts: a header and a payload. The header is like an envelope; the payload is the contents.

packet filtering
    Controlling access to a network by analyzing the headers of incoming and outgoing packets, and letting them pass or halting them based on rules created by a network administrator. A packet filter allows or denies packets depending on where they are going, from whom they are sent, or what port they use. Packet filtering is one technique, among many, for implementing security firewalls.

 PAP (Password Authentication Protocol)
    An identity verification method used to send a user name and password over a network to a computer that compares the user name and password to a table listing authorized users. WatchGuard products do not support this authentication method because the user name and password travel as clear text that a hacker could read. See also CHAP.

parameter
   In programming, some value passed to a function. The function either uses the parameter in its task, or performs an operation on the parameter. A parameter can be a value such as a number, a name, or even a file. For instance, a function that alphabetizes might not know what text file to alphabetize unless a file name is passed to the function as a parameter. The function might not know whether to print the alphabetized list, display it on a screen, or save it as a new file unless one of those options is also expressed as a parameter. A parameter can also be referred to as an argument.

passphrase
    An easy-to-remember phrase which offers better security than a single-word password, because it is longer and thus harder to guess or calculate.

password
    A secret sequence of characters or a word that a user submits to a system for purposes of authentication, validation, or verification. WatchGuard recommends the use of passphrases in place of passwords.

password caching
    The temporary storage of a user's username and password by some application.

peer-to-peer
Sometimes abbreviated as P2P, this is a method of distributing files over a network where all computers are treated as equals (in contrast to a client/server architecture). Using P2P client software, a client can receive files from another client. Some P2P file distribution systems require a centralized database of available files (such as Napster), while other distribution systems like Gnutella are decentralized.

perfect forward secrecy (PFS)
    A cryptosystem in which, if one encryption key is compromised, only the data encrypted by that specific key is compromised. Some cryptosystems allow keys to be derived from previous keys, so that if the first key is compromised, an attacker might have enough information to figure out other keys and/or decrypt data encrypted using those keys. RFC 2409 describes PFS in detail.

PGP (Pretty Good Privacy)
     An application and protocol (RFC 1991) for secure e-mail and file encryption. PGP uses a variety of algorithms (like RSA, DSA, MD5, SHA-1) to provide encryption, authentication, message integrity, and key management.

PGP/MIME
    An IETF standard (detailed in RFCs

Phase 1, Phase 2
    Stages in establishing a site-to-site Virtual Private Network (VPN) tunnel.  Designated computers negotiate security parameters to protect the managing of the tunnel itself using IKE (Internet Key Exchange); the result of this negotiation is called the Phase 1, or ISAKMP, security association (SA). The Phase 1 SA is then used to securely negotiate security parameters to protect IP packets; the result of that negotiation is called the Phase 2, or IPSec, SA. The Phase 2 SA is then used to securely tunnel ESP or AH-protected IP packets between these two computers.

ping 
    A utility to determine whether a specific IP address is accessible. It works by sending a packet to the specified address and waiting for a reply; hence, it was named after the sound sonar makes when trying to locate an object.

PKCS (Public Key Crypto Standards )
     A set of standards published by RSA Security, developed in cooperation with an informal consortium (Apple, DEC, Lotus, Microsoft, MIT, and Sun), that includes algorithm-specific and algorithm-independent implementation standards for reliable, secure public key cryptography.

PKI (Public Key Infrastructure)
    A system of digital certificates, Certificate Authorities, and other registration authorities that verify the validity of each party involved in an Internet transaction. The intent is to establish a trusted relationship between the parties. PKI's various mechanisms can provide a foundation for message confidentiality, message integrity, non-repudiation (which means the author of a message cannot later claim he did not write it), and authentication. PKI is necessary and foundational for certificate-based Virtual Private Networks (VPN).

plain text
    Characters in a human readable form prior to encryption or after decryption. Also called clear text.

plug and play
    An ease-of-use ideal in the personal computer market that assures the user that a hardware device (for example, a mouse, a modem, or a scanner) can be installed without resorting to manual hardware configuration of either the device or the PC into which the device is being installed.

Policy Manager
The Windows-based interface used to modify and upload a Firebox configuration file. One component of the WatchGuard Firebox System.

port
   1) A physical hole in a computing device where you plug something in (such as, "this PC communicates with the printer via the serial port"). 
   2) When used in relation to IP services, a made-up, or logical, endpoint for a connection, conceived so that the computer can handle multiple applications over one network connection. Your system figures out how to treat data coming at it partially by looking at what port the data is destined for (for example, HTTP, or Web traffic, by convention uses port 80; SMTP, or e-mail traffic, uses port 25). For a fuller explanation, read the LiveSecurity article, "Foundations: What Is a Port?"

port forwarding
    See NAT.

port space probe
    An intrusion technique whereby a hacker attempts to connect to sequential port numbers. These probes are usually attempts to find security holes which the attacker might exploit. When a listening computer responds to a message sent to a given port, the attacker then knows there really is a computer there, listening on that port.

PPP (Point-to-Point Protocol)
    A method of connecting a computer to the Internet, often used with dial-up modems.

PPPoE (Point-to-Point Protocol over Ethernet)
    A method of transmitting PPP traffic over Ethernet to the Internet through a common broadband medium. Commonly used in Europe. The users have the appearance of "dialing" the Internet, but their computers are in fact always connected.

PPTP (Point-to-Point Tunneling Protocol)
    A VPN tunneling protocol with encryption. It uses one TCP port (for negotiation and authentication of a VPN connection) and one IP protocol (for data transfer) to connect the two nodes in a VPN. Though favored by Microsoft, many experts feel PPTP offers weaker confidentiality of data than a competing standard, IPSec.

Pretty Good Privacy
   See PGP.

primary key (IPSec) 
    An IPSec key responsible for creating a security association. Values can be set in time or data size.

principle of precedence
    Logic followed by the Firebox when deciding which permissions and prohibitions in your security policy override others. As a general guideline, a more specific rule usually overrides a more general rule. For example, if you've established a general a rule that says to let Any Internet traffic enter your network, and you also have a rule that says to block any traffic over port 31337, then port 31337 will be blocked: the specific rule takes precedence over the general. Further reading:

private key
    The "secret" component of an asymmetric key pair, often referred to as the decryption key. In a key pair (composed of a public key and a private key), it is essential that you keep the private key to yourself. See also asymmetric key, key pair, and public key.

private network address
    A private network address is an IP address range that is used only within the confines of a single organization. Private addresses are used for traffic from one location to another within a clearly defined network and at no time are meant to extend beyond the perimeter, or firewall, of the organization. They are not routable on the Internet, and require some sort of address translation (see NAT) to reach the Internet. Private network address ranges are defined by the IANA and

privilege elevation
    See elevation of privilege

probe
    A type of hacking attempt characterized by repetitious, sequential access attempts. For example, a hacker might try to probe a series of ports in search of one that is open, or one might probe a range of IP addresses in search of a responsive computer.

procedure
    See function

protocol
    A set of formal rules describing how to transmit data, especially across a network. The protocol determines issues such as: the type of error checking to be used, data compression method, if any; how the sending device will indicate that it has finished sending a message, and how the receiving device will indicate that it has received a message. Low-level protocols define the electrical and physical standards to be observed, bit- and byte-ordering, and the transmission and error detection and correction of the bit stream. High-level protocols deal with the data formatting, including the syntax of messages, character sets, and sequencing of messages. 

proxy ARP
   Proxy Address Resolution Protocol allows a network to use one network address across two physical interfaces. In typical routing, separate network interfaces on a routing device must connect to different networks with distinct IP addresses (e. g., 192.168.10.n and 192.168.11.n). Thus, adding a firewall appliance that has multiple interfaces could potentially force a network to be subdivided into separate network addresses (because although a firewall appliance is not a router, it performs routing). Proxy ARP is the answer for administrators who do not want to renumber their network. It is a technique that the Firebox uses to handle traffic between hosts that don't expect to encounter a routing device -- those hosts would expect to transmit directly to hosts now placed behind a firewall. Using Proxy ARP, the Firebox responds to ARP requests for hosts on the "other side" of it that can't reply for themselves. The Firebox gives an ARP reply matching the remote IP address with the Firebox's own Ethernet address (in essence, a lie, so that the requesting half of the network can continue acting as if the other half of the network is local). The Firebox then receives packets on behalf of hosts behind it, and forwards them appropriately. Proxy ARP is what allows you to use the same network address across all three Ethernet interfaces of the Firebox, known as drop-in mode.  See also

proxy server
    A server that sits between a client application (such as a browser) and a "real" server. The proxy server intercepts client requests and forwards them to the other server. Its purpose is two-fold: for outgoing traffic, it allows private, non-routable machines to reach a machine which can reach the Internet for them. Secondly, as it receives responses to the client machine requests (for example, Web pages) it can cache them locally so that further client requests can be answered locally and immediately. Use of the Firebox removes the need for a proxy server, unless the proxy server is used for caching files. 

proxy service
A combination of stateful packet filtering with content inspection. Essentially, the Firebox intercepts traffic intended for another destination (for example, a Web server or an e-mail server) and imposes rigid access and routing rules with the defense of the internal networks and servers in mind. Dangerous traffic is discarded, while normal traffic is passed to the intended destination.

pseudo-random number
    A number that results from applying randomizing algorithms to input derived from the computing environment, such as mouse coordinates or the time of day. See also random number.

Public Key Crypto Standards 
   See PKCS.

public key
    The publicly available component of an asymmetric key pair, often referred to as the encryption key. In a key pair (composed of a public key and a private key), you can make your public key well-known, as messages encrypted with it can only be decrypted by your private key. See also asymmetric key, key pair, and private key.

public key cryptography
    Cryptography in which a public and private key pair is used, encrypting the data at the sender's end and decrypting it at the receiver's end. Since the data is encrypted while it travels the public Internet, no additional security is needed -- it can safely use public networks without loss of confidentiality. See also asymmetric key and key pair.

Public Key Infrastructure 
    See PKI.

RADIUS

random number
    A number generated from a large set of numbers, using an algorithm that gives every number an equal probability of occurring. Random numbers are used as an ingredient in encryption keys; thus, a random number generator is a necessary element in creating unique keys that are unpredictable to an adversary. 

RC4 (Rivest Cipher 4)
    One of many symmetric key (meaning that you use the same key both to encrypt and to decrypt message text) algorithms. Once a proprietary algorithm of RSA Data Security, Inc., RC4 creates keys of variable size which are called streaming ciphers; that is, they are used to encrypt a stream of data byte-by-byte as it goes by. 

RC5 (Rivest Cipher 5)
    A cipher that encrypts a block (many bytes) of data at a time. The RC5 algorithm enables the user to specify block size, key length, and how many times the encrypted message should be re-encrypted (referred to as encryption rounds).

related hosts 
    A method for informing the Firebox of the physical location of a particular computer or device. This is most commonly used when the Firebox is utilizing proxy ARP in drop-in mode. Although the Firebox can use proxy ARP to automatically learn the location of hosts on its interfaces, an administrator can specify related hosts in the WatchGuard Firebox Software to make sure the Firebox knows the location of critical machines immediately.

remote user
    Someone you allow to access your office network, who is geographically removed from the office.

repeater
    A network device that regenerates signals so that they can travel farther along a cable without losing or distorting data. A repeater is not as smart as a router, but it can relay messages between subnetworks that use different protocols or cable types.

reverse lookup; reverse DNS lookup
    The opposite of a DNS lookup. DNS works like the phone book: in a DNS lookup, you have a name (such as watchguard.com) but you want the number (an IP address). In a reverse lookup, you have the number (e.g., 64.119.131.128), but you want to find the domain name associated with it (e.g., watchguard.com).

revocation
    This term is most often used in the context of digital certificates. A Certificate Authority assures that all parties in a digital transaction are who they claim to be and that all documents are genuine. The Certificate Authority (CA) vouches for your digital certificate, which is like ID the CA issued you. If the CA subsequently finds out one of the parties misrepresented themselves (as happened in March of 2001, when Verisign issued digital certificates to imposters claiming to represent Microsoft), the CA can revoke the digital certificate. Thus, revocation is the retraction of certification or authorization.

RFC (Request for Comments)
    RFC documents describe standards used or proposed for the Internet. Each RFC is identified by a number, such as RFC 1700. The Internet Engineering Task Force maintains RFCs on the World Wide Web, at http://www.ietf.org/rfc.html.

ring topology
    A basic networking configuration in which all nodes are connected in a circle with no terminated ends on the cable.

route
    1)  The sequence of computerized devices through which information travels to reach its target machine. Each device the information travels through delineates one stage of the route, referred to as a "hop." 
    2) An entry stored on a computer, telling it how to reach other devices or networks. These entries can be automatically generated when you set up your network and can also be entered manually. They are stored in your local host's routing table. 

routed mode
    A Firebox configuration where each of the Firebox's three Ethernet interfaces must use IP addresses in different subnets. This type of configuration is intended for situations in which the Firebox is put in place with separate logical networks on its interfaces. For a contrasting approach, see drop-in mode.

router
    A device, connected to at least two networks, that receives and sends data packets between those networks. Routers refer to packet headers and a forwarding table to decide where to forward packets to. 

routine
    See function

RPC (Remote Procedure Call)
     A protocol that allows a computer to ask some other computer to perform a task or service and return the result. The computer making the request is often referred to as a client, and the computer doing the task is called the server. The client computer does not need to know how to perform the task itself, it just sends an RPC request to a server and gets some result.

RUVPN (Remote User Virtual Private Networking)
    RUVPN establishes a secure connection over the Internet between a remote computer and your protected network.

salt
    A tiny bit of near-random data inserted where too much predictability would be undesirable. In cryptography, salt is a random string that is added onto passwords (or random numbers) before an algorithm is performed on the password. The extra data effectively lengthens and obscures the password, making the cipher text less susceptible to dictionary attacks.

scalable architecture
    Software and/or hardware constructed so that it can grow efficiently.

SCSI (Small Computer System Interface)
    A processor-independent standard for system-level interfacing between a computer and intelligent devices including hard disks, floppy disks, CD-ROM, printers, and scanners. Pronounced "scuzzy."

secondary network
    A network on the same physical wire as a Firebox interface having a different IP network address. This technique allows you to add as many subnets as you want to a single Ethernet interface on a Firebox.

secret key
    The encryption key used in symmetric algorithms.

secure channel
    A means of conveying information from one entity to another using a method that does not offer an intruder the ability to reorder, delete, insert, or read information.

SecurID token 
    A hardware-based authentication method owned by RSA. The user enters his PIN into the token, which resembles a small hand-held calculator. The token combines the user's PIN with numbers inside itself to create a number that RSA calls a "passcode." The user then logs in with his username on a PC, entering the passcode number. The PC sends it to an authentication server. If the passcode matches what the server expects, the user is authorized. This method is known as "response only" because the server did not issue a challenge. For more information on this topic, see the LiveSecurity editorial, "Security Tokens: Why Aren't You Using Them?"

security association (SA)
    In Internet Protocol Security (IPSec), settings that establish policy and encryption keys used to protect communications between two end points in a Virtual Private Network (VPN). Security associations are negotiated between two computers during the first phase of establishing an Internet Key Exchange (IKE) connection. See also Phase 1, Phase 2.

segment
    A section of a network. Typically, a segment is thought of as ending where it reaches a router or a routing device (such as the Firebox).

self-extracting file
    A compressed file that automatically decompresses when double-clicked.

server
    A computer that provides shared resources to network users. The network users are often referred to as "clients" of that server. See also

server-based network
    A network in which all client computers use a dedicated central server computer for network functions such as storage, security, and other resources. See also server.

Services Arena
    WatchGuard's term for the area in WatchGuard Firebox System's Policy Manager that displays icons representing the services (such as proxies and packet filters) configured for a Firebox.

ServiceWatch
    A graphical monitor providing a real-time display that graphs how many connections exist, by service. This comes as part of an application called Firebox Monitors.

session hijacking
    An intrusion technique whereby a hacker sends a command to an already existing connection between two machines, in order to wrest control of the connection away from the machine that initiated it. The hacker's goal is to gain access to a server while bypassing normal authentication measures.

session key
    The secret (symmetric) key used to encrypt each set of data on a transaction basis. A different session key is used for each communication session. See also asymmetric key and key pair.

session stealing
    See session hijacking.

setup keys (IKE)
    Internet Key Exchange keys responsible for creating a security association.

SHA-1 (Secure Hash Algorithm)
    A message digest function (also called a one-way hash) used in encryption. The 1994 revision to SHA, developed by NIST. SHA-1 is a mathematical process used to change the contents of a file into a 160-bit number, similar to MD4. See also message digest.

shared secret
    In IPSec usage, a passphrase or password that exists on two devices to be connected by VPN. In order to begin the security negotiations that result in a VPN tunnel, both devices must know the pre-existing secret, which is used by each party to authenticate the other. 

sign
    To apply a digital signature which, in the USA, is as legally binding as a handwritten signature..

signature
    A digital code created with a private key. See digital signature.

single sign-on
    A log-in routine in which one logon provides access to all resources on the network.

slash notation
    A concise decimal format for expressing a binary subnet mask. For example: 192.168.44.0/24 indicates that in the 32-bit IP address, the first 24 bits (192.168.44) are the address of a network. The remaining 8 bits can be used to indicate the addresses of specific devices on that network. For more, see IP address and subnet mask.; for a full discussion, see the LiveSecurity articles, "Foundations: Understanding Subnetting (Part 1)" and "Part 2."

SLIP (Serial Line Internet Protocol)
    A protocol for exchanging IP packets over a serial line (for example, a modem connection).

S/MIME (Secure Multipurpose Mail Extension)
    A proposed standard for encrypting and authenticating MIME data, which is used primarily for Internet e-mail. See MIME.

SMS (Security Management System)
    The former name of the GUI used to configure a Firebox. Now known as the WatchGuard Policy Manager.

SMTP (Simple Mail Transfer Protocol)
    A protocol for sending electronic mail between servers.

social engineering attack
    An attack that does not depend on technology as much as it depends upon tricking or persuading an individual to divulge privileged information (usually unknowingly) to the attacker. For example, an attacker might phone a company's internal help desk, posing as an employee, and say, "This is Fred in Accounting. I was on vacation for five weeks and forgot my network password. Could you look it up for me?" If the gullible help desk technician reveals the password to the attacker, the attacker "socially engineered" it out of him.

SOCKS
    A protocol for handling TCP traffic through a proxy server. It can be used with virtually any TCP application, including Web browsers and FTP clients. It provides a simple firewall because it checks incoming and outgoing packets and hides the IP addresses of client applications. SOCKS is an IETF standard, documented in RFCs 1928, 1929 and 1961. WatchGuard's SOHO uses a SOCKSv5 proxy.

SOHO
    An abbreviation for businesses categorized as Small Office/Home Office. Also the name of the WatchGuard firewall devices designed for businesses of this size.

spam
    Unsolicited commercial e-mail sent to many recipients, much like an electronic version of junk mail.

spoofing
    Altering data packets to falsely identify the originating computer. Spoofing is generally used when a hacker wants to make it difficult to trace where the attacks are coming from.

SSL (Secure Sockets Layer)
    A protocol for transmitting private documents over the Internet, often used by e-commerce sites (among others). SSL works by using a private key to encrypt data transferred over an SSL connection.

stance
    The policy of a firewall regarding the default handling of IP packets. Stance dictates what the firewall will do with any given packet in the absence of explicit instructions. The WatchGuard default stance is to discard all packets that are not explicitly allowed, often stated as "That which is not explicitly allowed is denied."

star topology
    A networking setup used with 10BASE-T Ethernet cabling and a hub. Each node on the network is connected to the hub, like points of a star.

stateful packet filtering
    "Packet filtering" means using a firewall to examine where each packet comes from (by IP source address), where it's going (IP destination), and what port it's using. This information helps the firewall determine whether to allow or deny the packet's passage through your network. In stateful inspection, the firewall also examines more of the packet's delivery information and its conditions, including what port the packet is using, and maintains a sense of context. For example, a packet might arrive looking like a valid Reply packet, but if you never issued a Request, through dynamic packet filtering the firewall can sense that this is a spurious packet, and deny it.

static NAT (Network Address Translation) 
    The ability to have the Firebox forward all traffic received on a given port and a given public IP, to a private IP behind the firewall. See also NAT. 

stream cypher
    A class of symmetric key encryption that encrypts each byte of data as it is received, instead of gathering the data into large blocks before encrypting. Useful for equipment that has little memory for buffering data.

subnet
    A subdivision of a network that uses a sequential range of IP addresses (i.e. 10.45.32.1 to 10.45.32.128). Administrators divide large networks into subnets for many reasons. One reason: subnets are typically easier to troubleshoot than a large network because the administrator is dealing with fewer machines at a time.

subnet mask
    This is a difficult concept to express succinctly. If it is new to you, please begin by reading the entry for IP address. 
    A subnet mask is a numeric value that helps a networked host or router understand how to interpret the destination IP address on packets the machine receives. When a computer receives a data packet, it tries to figure out if the IP address the packet is destined for is local (meaning, on the same network segment as the machine), or non-local. This matters to the machine because if the destination is local, the machine can deliver the packet (using ARP). If the address is not local, the machine does not know how to deliver the packet. Figuratively, it says, "I give up!" and forwards the packet to the default gateway (another machine, often a router, which handles everything non-local).
    In trying to decide whether a destination IP address is local or not, the machine must discern how much of the IP address designates the destination network, and how much of the address designates the destination host. If the destination address is 192.168.14.10, what part of that address specifies the destination network? 192? Or 192.168? Or perhaps 192.168.14? 
    The subnet mask, which is specified on each networked machine in a routing table, provides the answer. Like an IP address, a subnet mask is a 32-bit value. The machine combines it mathematically with the destination IP address, using an operation called a "Boolean AND." The nature of the subnet mask plus the Boolean AND guarantee a result that will tell the machine, in binary values, how much of the IP address is the network range and how much is the host address. The machine then understands how to properly forward the packet. See also CIDR and

subroutine
    See function

substitution cipher
    An encoding method in which plain text characters are replaced with other characters to form coded text. For example, the most elementary substitution cipher might say A = 1, B = 2, C = 3, etc. to encrypt the word "DOG" as "4-15-7." Real substitution ciphers, of course, are much more complex.

switch
    A device that filters and forwards packets between LAN segments. A typical switch has numerous physical ports, each acting as a connection point for a network segment. Larger networks utilize switches to break the network into smaller, more manageable chunks, which are easier to secure. With the traffic on the entire network broken into smaller units, packets encounter fewer collisions, enhancing network performance.

symmetric algorithm
    An encryption method where the same key is used both to encrypt and decrypt messages. Also called conventional, secret key, and single key algorithm. See also asymmetric keys.

SYN flood attack
    A method of denying service to legitimate users of a network resource (such as a Web server) by intentionally overloading a network with illegitimate TCP connection requests. SYN is short for "synchronize," the first packet sent when one computer tries to connect to another using TCP. In a normal TCP connection, or handshake:
    1) Computer A sends a SYN packet; 
    2) Computer B acknowledges the connection attempt and sends back its own SYN packet (thus, a SYN/ACK packet), and 
    3) Computer A acknowledges Computer B's response. 
    In a SYN flood attack, Computer A never acknowledges Computer B (in other words, Step 3 never happens). This forces Computer B to wait for A's acknowledgment until B times out and drops the connection. Flooding Computer B with a huge number of such incomplete requests keeps B tied up uselessly. 

syslog
    An industry-standard protocol used for sending and receiving log information for devices on a network. Syslog support is included in Unix-based and Linux-based systems.

TCP (Transmission Control Protocol)
    A set of rules that enables a broad spectrum of different kinds of computers to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent, so it is considered "reliable." Most long-haul traffic on the Internet uses TCP.

TCP handshake
    A three-step process computers go through when negotiating a connection with one another. Simplistically described, in a normal TCP handshake:
    1) Computer A sends a SYN packet (for "synchronize"); 
    2) Computer B acknowledges the connection attempt and sends back its own SYN packet (thus, a SYN/ACK packet), and 
    3) Computer A acknowledges Computer B's response. 
Once both computers are synchronized and acknowledged, they can begin passing data back and forth. To learn how attackers might exploit this, see SYN flood attack.

TCP/IP (Transmission Control Protocol/Internet Protocol)
    A common networking standard with the ability to connect a diverse array of systems. This is one of the underlying protocols of the Internet. For others, see ICMP, IP, TCP, and UDP.

TCP session hijacking
    See session hijacking.

Telnet
    A remote control program typically found on Unix systems in TCP/IP networks. A telnet client runs on your PC and connects it to a remote server on a network. You can then enter commands through the Telnet program and they will be executed as if you were entering them directly on the server console. This enables you to control the server and communicate with other servers on that remote network. 

timestamping
    Recording the time when an event happens (typically in a log) or when a piece of information is created or modified..

TLS (Transport Layer Security)
    A general-purpose protocol for encrypting Web, e-mail, and other stream-oriented information sent over the Internet. TLS is a relatively recent (first published in 1999) derivative of the Secure Sockets Layer (SSL) version 3.0 protocol, and is described in RFCs 2246, 2712, 2817, and 2818.

token
    Also called a security token or an authentication token. Something a person has that evidences validity, or identity. It is usually a hardware device that resembles a hand-held calculator, since it often has some sort of display and perhaps a keypad for entering numbers. Tokens achieve the goal of "two-factor authentication," considered a strong standard of security when validating who a user is, because accessing a network that  uses tokens requires two factors: something the person knows (a password) and something the person has (the token). For more, see the LiveSecurity article, "Security Tokens: Why Aren't You Using Them?"

tooltip
    A name or phrase that appears when the mouse pointer pauses over a button or icon.

topology
    A wiring configuration used for a network. Also referred to as a network's architecture.

transposition cipher
    A cipher in which the plain text remains the same but the order of the characters is  scrambled. Thus, the word "DOG" might become "OGD." Transposition is sometimes used as one step in the midst of several mathematical operations that, together, make up a cryptographic algorithm.

Triple-DES (3DES) 
    A cryptographic algorithm using three keys (rather than one or two). Triple DES is simply another mode of DES operation, where the DES algorithm is applied three times on the data to be encrypted, using a different key each time. 3DES is currently one of two US federal government standards for encrypting non-classified data.

trust
    Confidence in the honesty, integrity, or reliability of a person, company, or other entity. The concept also extends to believing that an unseen remote party is who he or she claims to be.

Trusted interface
    The Ethernet port on the Firebox that connects it to your internal network. See Trusted network and Optional interface.

Trusted network
    The private network which you intend your firewall to primarily protect. The Trusted network is usually where your most sensitive corporate resources reside or where home office employees do their work. This contrasts with the semi-public Optional network. 

tunnel
    In Virtual Private Networks (VPN), an encrypted connection between sites. Only the originator and the receiver of the message see it in its clear state. Any hacker trying to intercept the message en route gets nothing but a scrambled mess. Because the path of a VPN message has "light" (clear text) at each end but "darkness" (obscurity) at all the between-points, it is called, metaphorically, a VPN tunnel. 
    On a technical level, a tunnel is a means of exchanging encapsulated data packets between two parties. Though some tunneling protocols forward cleartext packets, WatchGuard utilizes tunneling protocols such as PPTP and IPSec

twisted-pair cable
    A cable used for both network and telephone communications. Also known as UTP (unshielded twisted pair) and 10BASE-T/100BASE-T cable.

UDP (User Datagram Protocol)
     A set of standards for transmitting data over networks. Some technicians have nicknamed it the "Unreliable Darn Protocol" because when sending data, UDP does not verify that it has established a connection at the receiving end; it simply blasts away until the message has been sent. Thus, UDP is termed a "connectionless" protocol. Because it doesn't perform the checks and verifications of TCP, UDP is simpler to implement and is used where a small amount of packet loss is acceptable. On the Internet, UDP is often used for streaming video and audio.

URL (Universal Resource Locator)
    The user-friendly address that identifies the location of a Web site, such as http:// www.watchguard.com.

validation
    The act of examining information provided by a person (or a system) to ascertain what rights, privileges, or permissions they may (or may not) have to perform some action. For example, when you attempt to charge a purchase at a retail store to a credit card, the cashier validates your identity by examining your identification and comparing your signature on the receipt with the signature on the credit card.

verification
    In cryptography, the act of testing the authenticity of a digital signature by performing special mathematical operations on data provided by a sender, to see if it matches an expected result. If the information provided by the sender yields the expected result, the signature is valid, because the proper answer requires secret data known only by the sender. Verification proves that the information was actually sent by the signer and that the message has not been subsequently altered by anyone else. See also asymmetric key and digital signature.

VPN (Virtual Private Network)
    A means of having the security benefits of a private, dedicated, leased-line network, without the cost of actually owning one. VPN uses cryptography to scramble data so it's unreadable while traveling over the Internet, thus providing privacy over public lines. Companies with branch offices commonly use VPNs to connect multiple locations. For more information, see WatchGuard's white paper, "Straight Talk about VPN," or read the LiveSecurity article, "

WAN (Wide Area Network)
    A computer network that spans a relatively large geographical area. Typically, a WAN consists of two or more local area networks (LANs) connected by a high-speed line.

WatchGuard LiveSecurity Service
    Part of the WatchGuard Firebox Security System offering, separate from the software and the Firebox, which keeps network defenses current. The LiveSecurity Service includes software updates, technical support, timely broadcasts of security intelligence, and a resource-rich Web site containing FAQs, archived articles, online training, a moderated user forum, and the latest software.

WatchGuard Security Event Processor (WSEP) 
    WatchGuard's proprietary log server software. It provides critical timing services for the Firebox and includes its own Graphical User Interface (GUI). See server and client/server.

WebBlocker
    An optional WatchGuard software module that prevents users behind the Firebox from accessing undesirable Web sites. It works based on a regularly updated database of sites that could be objectionable, categorized by content type (e.g., pornography, gambling, or racist hatred sites).

Web browser
   Software used to view the World Wide Web, a graphically rich presentation of information on the Internet. The most popular Web browser is Microsoft's Internet Explorer, but other browsers such as Netscape Navigator and Opera are available. To find specific sites on the Web, you enter a URL in your Web browser.

Web of Trust 
    A term describing a relationship-based extension of the concept of trust, popularized in PGP. For example, if you trust Bob and Bob says Rachel is a good auto mechanic, you'll trust Rachel to fix your car even if you have not previously met Rachel. A similar concept is used to validate encryption keys in PGP. If you know and trust Bob, and Bob gives you a text block and says it is Rachel's public key, you'll accept the text block as Rachel's key even if you don't know Rachel. If Rachel later sends a message encrypted with or signed by her private key, you'll be ready to decrypt it or verify the signature because you have her public key. You can then pass Rachel's public key to someone who trusts you, thus extending the Web of Trust by another node. 

Web page
    A single HTML-formatted file posted where it can be accessed via the World Wide Web.

Web site
    A collection of affiliated Web pages.

WEP (Wired Equivalent Privacy)
.   The security aspects of 802.11b, a standard that enables wireless devices such as PDAs and laptop computers to access a network via radio frequencies instead of physical wiring. WEP has three tasks: 1) to authenticate clients to access points; 2) to encrypt the data exchanged between the clients and access points; and 3) to include an integrity check with every packet exchanged. The initial implementation of WEP provides weak security. While it is not completely useless, it is best used as another layer of security in conjunction with stronger measures. To learn more, refer to the WatchGuard Web page, "Learn About Wireless Security."

WFS (WatchGuard Firebox System)
    Software used for managing WatchGuard's Firebox model firewalls. WFS consists of multiple components, some used on a PC you designate as a Management Station, and some loaded into the Firebox's memory. WFS enables such features as configuring the policies of the Firebox, setting up and customizing services, logging, monitoring, and reporting. The latest version of WFS is available for download to LiveSecurity subscribers on the "Latest Software" Web page. 

WINS (Windows Internet Name Service)
    WINS provides name resolution for computers running Windows NT, Windows 98, and earlier versions of Microsoft operating systems. With name resolution, users access servers by name rather than needing to use IP addresses.

World Wide Web Consortium (W3C)
    An international industry consortium founded in 1994 to develop common protocols for the evolution of the World Wide Web.

worm
    A self-replicating program that seeks access into other computers by exploiting security flaws. After a worm penetrates another computer, it continues seeking access to other areas. Worms often steal or vandalize computer data. Many viruses are more accurately termed worms, and use e-mail or database systems to propagate themselves to their victims.

XOR
    Shorthand for "Exclusive-or," a mathematical operation used to represent the differences between two values.

X.509v3
    An ITU-T digital certificate that is an internationally recognized electronic document used to prove identity and public key ownership over a communication network. It contains the issuer's name, the user's identifying information, and the issuer's digital signature.