Annexes The following annexes include definitions to help explain the concepts and terminology found in the Guidelines for audiences that may not be familiar with the terms. The definitions do not form a complete glossary, nor are they the authoritative definitions on these subjects. They are intended to provide a simple introduction to the terms. Annex I: Internet and Security-Related Terms a. Attacks and Attack Vectors • Attackers may use a variety of tools, scripts, and programs to launch attacks against networks and network devices, and to deceive or otherwise compromise staff or vendors with access to the network – whether on-site or remotely. Typically, the network devices under attack are the endpoints, such as servers and desktop computers. A cyberattack occurs if an attacker successfully breaches security controls. • An attack vector is a means by which an attacker can gain access to a network in order to deliver a payload with malware. Attack vectors enable attackers to exploit system vulnerabilities. The major attack vectors are botnets, DNS attacks, phishing (including targeted or “spear phishing”), and routing table poisoning attacks. b. Best Practices • A method or practice which is generally accepted as the preferred way to achieve the desired outcome. c. Breaches of Personal Data • In the context of networks, “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision” 18 of an electronic communications service. d. Collaborative Security Approach • The collaborative security approach to Internet security recognizes that people are what ultimately hold the Internet together. The Internet’s development has been based on voluntary cooperation and collaboration. Cooperation and collaboration remain the essential factors for its prosperity and potential. The approach emphasizes five principles: preserving opportunities and building confidence; collective responsibility; security solutions fully integrated with rights and the open Internet; security solutions grounded in experience, developed by consensus and evolutionary in outlook; and targeting the point of maximum impact – think globally, act locally.19 e. Computer Security Incident Response Team (CSIRT) • An organization or community of experts that receives, reviews, and responds to computer security incidents. They may be geographically or sector specific, and led by the public and/or private sector. CSIRTs provide a critical knowledge sharing function to ensure security. 18 19 See https://ico.org.uk/for-organisations/guide-to-pecr/communications-networks-and-services/security-breaches/. See http://www.internetsociety.org/collaborativesecurity internetsociety.org Internet Infrastructure Security Guidelines for Africa 27