Cyber Insurance & Security Glossary

Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers.

Includes claims that have been paid and/or have amounts held in reserve for future payment.

An estimated amount set aside by the insurance company to pay claims that may have occurred, but for some reason have not yet been reported to the insurance company.

Mandatory Access Control (MAC) is a security approach that contains the ability of an individual resource owner to grant or deny access to resources or files on the system. Whenever a user tries to access an object, an authorisation rule is enforced by the OS. Kernel examines these security aspects and decides whether the user can access or not. Any operation by any user is typically tested against a set of authorisation rules (aka policy) to determine if the operation is allowed.

Media access control address (MAC address) of a device is a unique identifier assigned to a network interface.

Media access control address (MAC address) of a device is a unique identifier assigned to a network interface.

A Media Access Control address (MAC address) is also known as the physical address and is a unique identifier assigned to the network interface for communication. MAC addresses are generally used as a network address for most IEEE 802 network technologies (including Ethernet and WiFi). MAC addresses are used in the media access control protocol sub-layer of the OSI reference model

Malicious code is any code in any part of a software system or script that is intended to cause undesired effects, security breaches, or damage to a system. Such codes actually gain unauthorised access to system resources or tricks a user into executing other malicious logic. Malicious code describes a broad category of system security terms that includes attack scripts, viruses, worms, Trojan horses, backdoors, and malicious active content

Malware is a contraction of malicious and software. Malware is any piece of software that was written with the intent of doing harm to data, devices or to people. This included viruses, worms, trojans, spyware, and ransomware.

Mandatory Access Control (MAC) is a security approach that contains the ability of an individual resource owner to grant or deny access to resources or files on the system. Whenever a user tries to access an object, an authorisation rule is enforced by the OS. Kernel examines these security aspects and decides whether the user can access or not. Any operation by any user is typically tested against a set of authorisation rules (aka policy) to determine if the operation is allowed.

Provides broad form coverage of personal property of an insured manufacturer including raw material, goods in process, finished goods and goods shipped to customers.

A deposit that an organization is required to maintain with a broker with respect to the Futures Contracts purchased or sold.

Fair value or the price that could be derived from current sale of an asset.

A masquerade attack is any attack that uses a forged identity (such as a network identity) to gain unofficial access to a personal or organisational computer. Masquerade attacks are generally performed by using either stolen passwords and logons, locating gaps in programs, or finding a way around the authentication process. Such attacks are triggered either by someone within the organisation or by an outsider if the organisation is connected to a public network.

The MD5 was designed by Professor Ronald L. Rivest of MIT in 1991. The MD5 message-digest algorithm is the most widely used cryptographic hash function producing a 128-bit (16-byte) hash value, typically expressed in text format as a 32 digit hexadecimal number. It was developed to be used with digital signature applications that require large files to be compressed by a secure method before being encrypted with a secret key, under a public key cryptosystem. MD5 is currently a standard, Internet Engineering Task Force (IETF) Request for Comments (RFC) 1321.

Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers.

The Measures of Effectiveness (MOE) is a probability model based on engineering concepts that allows one to estimate the impact of a given action on an environment. MOE quantifies the results to be obtained by a system and may be expressed as probabilities that the system will perform as required

Multi-factor authentication (MFA) is a method of confirming a user's claimed identity only after presenting at two or more pieces of evidence across three main categories: what you know, what you have and what you are.

An arrangement under which an insurance carrier will, for a fee, handle the administration of claims and insure against large claims for a self-insured group. The employer self-funds a fixed percentage (e.g. 90%) of the estimated monthly claims, and the insurer covers the remainder.

Mobile device security refers to the policies, procedures and tools for securing mobile devices.

Mobile phone malware is malware intended to run on mobile devices, such as smartphones or PDAs.

An annuity that contains a provision that adjusts the value of withdrawn funds based on a formula in the contract. The formula reflects market value adjustments.

The Measures of Effectiveness (MOE) is a probability model based on engineering concepts that allows one to estimate the impact of a given action on an environment. MOE quantifies the results to be obtained by a system and may be expressed as probabilities that the system will perform as required

Monoculture is the case where a large number of users run the same software, and are vulnerable to the same attacks.

Personality characteristics that increase probability of losses. For example not taking proper care to protect insured property because the insured knows the insurance company will replace it if it is damaged or stolen.

The Morris Worm (or Internet worm) program was written by a graduate student at Cornell University, Robert Tappan Morris, and launched on November 2, 1988 from MIT. It was the first computer worm distributed via the Internet and gained significant mainstream media attention.

An IP multi-cast is a method of sending packets of data to a group of receivers in a single transmission. This method is often used to stream media applications on the Internet and private networks.

Multi-factor authentication (MFA) is a method of confirming a user's claimed identity only after presenting at two or more pieces of evidence across three main categories: what you know, what you have and what you are.

Multi-homed is any computer host that has multiple IP addresses to connected networks. A multi-homed host is physically connected to multiple data links that can be on the same or different networks. Multihoming is commonly used in Web management for load balancing, redundancy, and disaster recovery

Personal and business property coverage combining several types of property insurance in one policy.

Multiplexing is a technique by which multiple analog or digital data streams are combined into one signal over a shared medium. Multiplexing originated in telegraphy in the 1870s, and is now widely applied in communications. The multiplexed signal is transmitted over a communication channel, such as a cable. A reverse process, known as demultiplexing, extracts the original channels on the receiver end.

Coverage sold to municipalities to guarantee the principle payment on bonds issued.

Liability coverage for the acts of a municipality.

Any security, or other instrument, including a state lease but not a lease of any other governmental entity, under which a payment obligation is created, issued by or on behalf of a governmental unit to finance a project servicing a substantial public purpose, and 1) Payable from tax revenues, but not tax allocations, within the jurisdiction of such governmental unit; 2) Payable or guaranteed by the United States of America or any agency, department or instrumentality thereof, or by a state housing agency; 3) Payable from rates or charges (but not tolls) levied or collected in respect of a non-nuclear utility project, public transportation facility (other than an airport facility) or public higher education facility; or 4) With respect to lease obligations, payable from future appropriations.

A privately held insurer owned by its policyholders, operated as a non-profit that may or may not be incorporated.

A company organized as a mutual and owning a capital stock insurer or insurers for the benefit of pooling risk for many people, typically those in the same industry.

Network Access Control (NAC) solutions help organizations control access to their networks.

the individual defined as the insured in the policy contract

Insurance for losses explicitly defined in the policy contract.

Network Address Translation (NAT) is an approach that is used to remap a IP address space into another by modifying network address information in IP datagram packet headers while they are in transit. This technique was originally used for rerouting traffic in IP networks without renumbering every host. Typically home or small business networks use NAT to share a single DLS or Cable modem IP address. However, in some cases NAT is used for servers as an additional layer of protection

The U.S. standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia and five U.S. territories. Through the NAIC, state insurance regulators establish standards and best practices, conduct peer review, and coordinate their regulatory oversight. NAIC staff supports these efforts and represents the collective views of state regulators domestically and internationally. NAIC members, together with the central resources of the NAIC, form the national system of state-based insurance regulation in the U.S.

The National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce. NIST’s mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

Refers to rating organizations so designated by the SEC whose status has been confirmed by the Securities Valuation Office. Examples are: Moody's Investors Service, Inc., Standard & Poor's (S&P), A.M. Best Company (A.M. Best) and Fitch Ratings and Dominion Bond Rating Service (DBRS).

Natural disasters are any act of God or natural event caused by environmental factors. Some examples of these disasters include fire, flood, earthquake, lightning, or wind and disables the system, part of it, or a network of systems

failure to exercise reasonable consideration resulting in loss or damage to oneself or others

Total of assets whose values are permitted by state law to be included in the annual statement of the insurer.

Total revenues from an insurer's operations less total expenses and income taxes.

Premiums on property/casualty or health policies that will not have to be returned to the policyholder if the policy is cancelled.

A netmask is a string of 0’s and 1’s that screen out the network part of an IP address so that only the host computer part of the address remains. The binary 1’s at the beginning of the mask turn the network ID part of the IP address into 0’s. The binary 0’s that follow allow the host ID to remain. In a netmask, two bits are always automatically assigned. For example, in 255.255.225.0, “0” is the assigned network address, and in 255.255.255.255, “255” is the assigned broadcast address. The 0 and 255 are always assigned and cannot be used.

Network Access Control (NAC) solutions help organizations control access to their networks.

Network-based Intrusion Detection Systems (NIDS) are placed at a strategic point (or points) to monitor the traffic on the network. It analyses the passing traffic on the entire subnet, and matches the traffic that is passed on the subnets to the library of known attacks. When an attack is identified, or abnormal behaviour is detected, an alert is sent to the administrator. OPNET and NetSim are commonly used tools for simulation network intrusion detection systems.

A mix of hardware and software resources of a network to enable network connectivity, communication, operations, and management of your network.

Network mapping is the study of physical connectivity of networks. It is used to compile an electronic inventory of the systems and the services on any network. With the increase in complexities of networks, automated network mapping has become more popular

A method to split a network into subnetwork into different network segments or zones which provide security benefits.

Network taps are hardware devices that help in accessing the data flow across a computer network. It is also desirable for a third party to monitor the traffic between two points in the network. The network tap has (at least) three ports, an A port, a B port, and a monitor port. Network taps are generally used for network intrusion detection systems, VoIP recording, network probes, RMON probes, packet sniffers, and other monitoring and collection devices and software that require access to a network segment

The National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce. NIST’s mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

Assets having economic value other than those which can be used to fulfill policyholder obligations, or those assets which are unavailable due to encumbrances or other third party interests and should not be recognized on the balance sheet.