Glossary

Tuning Documentation

Recording detection-tuning changes, what was changed, why, by whom, when, so the program has institutional memory and can audit, review, or undo decisions later.

Tuning Methodology

A disciplined approach to reducing false positives without losing real detections, by analyzing root causes, choosing targeted refinements, measuring impact, and documenting decisions.

Twelve-Factor Implications

The security implications of building apps along the twelve-factor methodology, externalized config, stateless processes, log streams, that shape how cloud-native security applies to those apps.

UAC

Windows User Account Control, which separates standard and elevated administrator tokens and mediates elevation; it is a security boundary only in the ways Microsoft documents.

UAC Bypass

Techniques that subvert Windows User Account Control to elevate privilege without prompting the user, exploiting auto-elevation paths, misconfigurations, or trust assumptions in elevated processes.

UDP

UDP is a transport protocol that sends messages without setting up a reliable connection first.

UID

User Identifier: a numeric ID Unix systems use internally to identify users. UID 0 is root, and tracking UIDs is foundational to understanding Unix permissions and audit logs.

URL

Uniform Resource Locator: the structured address identifying a resource on the web. Reading URLs precisely (scheme, host, path, query) is foundational to web defense and threat investigation.

USB Control

Restricting how USB devices can be used on endpoints, blocking unknown storage, limiting device classes, requiring approval, to defend against data exfiltration and malicious device threats.

Uncertainty Communication

Uncertainty communication separates confirmed facts, working hypotheses, missing evidence, confidence, assumptions, and the next reassessment point.

Unencrypted Storage

Cloud storage left without encryption (or with default keys only), a common cloud-foundational issue that exposes data to anyone who gains access to the storage layer or its backups.

Unified Control Framework

A unified control framework is an organization-specific set of control objectives and activities mapped to the external and internal sources they support.

Unit Testing

Writing automated tests for individual detection rules to verify they fire on expected inputs and don't fire on safe ones, the smallest-grain check in a detection-as-code testing strategy.

Unit Testing (Detection)

Automated testing of detection logic against expected-positive, expected-negative, malformed, boundary, and field-variation cases using controlled records.

Unmanaged Device Policy

Zero-trust policy that limits or denies access from devices the organization doesn't manage, BYO, contractor, personal, since unmanaged devices can't be trusted to enforce security baselines.

Unquoted Service Path

A Windows misconfiguration where a service's executable path isn't enclosed in quotes, letting an attacker who can write to certain directories hijack the service for privilege escalation.

Untrusted Pull Request Security

Untrusted pull request security tests contributor-controlled code without exposing secrets, write tokens, protected runners, or production deployment authority.

Usage Evidence Limitations

Usage evidence limitations explain why last-used fields and activity counts may omit API, inherited, indirect, rare, or out-of-retention use and may not identify the true subject.

User Account Control

A Windows feature that prompts users before allowing actions requiring administrative privilege, separating most user activity from elevated activity to reduce silent misuse of admin rights.

User Communication

How analysts communicate with affected users during investigations or incidents, clear, calm, appropriately scoped, that builds trust and gets accurate information without spreading panic.

User Context

The set of attributes tied to a logged-in user (account, group memberships, tokens, privileges) that processes operate under on a Windows or Linux system. Defenders read user context constantly.

User Space

The portion of memory and execution where non-kernel programs run, contrasted with kernel space. Most software, including malware, lives in user space, with privilege boundaries enforced at the kernel boundary.

VLAN

A logical Layer 2 broadcast domain identified by switching configuration and commonly an IEEE 802.1Q tag; it provides segmentation only when related routing and policy enforce it.

VLANs

Virtual LANs: logical segmentation of a physical network into separate broadcast domains, used to isolate traffic and enforce segmentation without separate physical infrastructure.

VM Backlog Cohorts

VM backlog cohorts group open and closed work by time, vulnerability, owner, service, priority, technology, recurrence, or target status to reveal exposure behavior and root causes.

VM Configuration Management

Managing the configuration of cloud VMs at scale, baselines, drift detection, automated remediation, so workloads stay aligned to expected state instead of diverging silently.

VM Coverage Confidence

VM coverage confidence describes how strongly the program can support a coverage claim based on population completeness, successful observations, method quality, freshness, exclusions, and identity reconciliation.

VM Coverage Metrics

VM coverage metrics compare a defined eligible asset or component population with successful, fresh assessments and disclose method, evidence quality, exclusions, unsupported assets, and reconciliation gaps.

VM Drift and Patch Strategy

A VM drift and patch strategy defines which instances are replaced or patched in place, how state is measured, how emergency fixes and reboots work, and how failures, exceptions, and rollback are handled.

VM Exception Management

Managing exceptions in vulnerability management, the cases where a vulnerability can't be remediated in the normal window, with documented rationale, compensating controls, and expiration.

VM Exposure-Age Metrics

VM exposure-age metrics measure elapsed time from a clearly named event, such as reliable detection, confirmed affectedness, publication, or KEV addition, to remediation or the reporting date.