OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Wall, Kevin (Kevin.Wallqwest.com)
Date: Thu Oct 04 2001 - 11:54:04 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Dennis Groves writes...

    > This is copyrighted material we can not use it. That said, I feel
    > it is an important part of the education process to define terms for
    > those who do not yet speak the language - the language in this case is
    > security.

    I agree that this is important, esp for newbies. The only alternative
    is to explain the term in the context where it is being used which could
    lead to inconsistent definitions.

    > What I had in mind was this, that anytime a "security word" appears in
    > documents that we produce as a part of this project that a
    > person can click on that "security word" and the definition will pop
    > up in a little window much the way that the bio's do now.
    >
    > Any thoughts from the group?

    I have two thoughts on this. One option is that we do our own glossary.
    I think that's the best long term approach, but not the best short term
    one--simply because of the time that it takes.

    The other option is that we (with permission, of course) just link to
    terms in someone else's online glossary. I find all of the following
    useful to varying degrees:

            NSA Glossary
                    http://www.sans.org/newlook/resources/glossary.htm
            The Internet Society's Internet Security Glossary
                    http://www.ietf.org/rfc/rfc2828.txt (unfortunately not
                            searchable as-is, but the copyright is pretty
    liberal)
            Lynn Wheeler's Taxonomy and Glossary
                    http://www.garlic.com/~lynn/secure.htm
            SetSolutions Security Glossary of Terms
                    http://www.setsolutions.com/security.htm
            Mitre's Security Glossary
            
    http://www.mitre.org/resources/centers/infosec/publications/sec-glossary/sg.
    html
            Government of Newfoundland and Labrador's (?)
                    "Complete Security Glossary"
    http://www.edu.gov.nf.ca/curriculum/teched/resources/glossarysecurity.html
                            (also not really searchable, as-is, unless you count
                            using Ctrl-F from your browser window ;-)

    If we use the first option (constructing own glossary rather than
    linking to others--and not necessarilly the same one for every term),
    then I think the link should be to the exact term with a larger
    glossary page. This larger glossary page should have navigation links
    and a search for terms. This has the advantage that subsequent checks
    ought to find the page in the browser cache. The alternative would be
    to dynamically generate a small pop-up window with just that single term.
    Either way, there should be links between terms.

    Also, to distinguish glossary terms from other links, I'd suggest putting
    them in italics or some different color than the rest of the text so that
    it is evident that these a glossary terms.

    Perhaps if we define a glossary, we should use XML (anyone know of a
    standard
    DTS or schema for a glossary / dictionary?). That would give a lot of
    flexibility, including formating different ways with XSLTs.

    -kevin

    ---
    Kevin W. Wall		Qwest Communications International, Inc.
    Kevin.Wallqwest.com	Phone: 614.932.5542
    "We want to ship a _lean_ operating system." --Tom Pilla, Microsoft
    spokesman citing the one reason that the company dropped the Java
    Virtual Machine from the upcoming Windows XP (as quoted in
    eweek, July 23, 2001).