Glossary

Web App Incident Response

Incident response for web applications, identifying the attack vector (injection, broken auth, supply chain), scoping impact, containing without destroying evidence, with web-specific demands.

Web Application

A program delivered over HTTP/HTTPS that runs in browsers (client) and on servers, the dominant application form on the internet and the primary attack surface for defensive-web work.

Web Application Assessment

A security assessment focused on a web application, covering its inputs, authentication, authorization, business logic, and dependencies, following an established methodology like OWASP WSTG.

Web Application Firewall

A control that inspects web traffic and can block common attack patterns.

Web Assessment Methodology

The structured methodology used in web-application security assessments, scoping, recon, mapping, testing categories in order, reporting, that produces repeatable, thorough coverage.

Web Authentication

How web applications authenticate users, password-based, OIDC/social, passkeys, with the session and token mechanisms that maintain login. A foundational defensive-web topic.

Web Client

The software that consumes a web service or page, typically a browser, but also mobile apps, scripts, or bots. Defenders treat all clients as untrusted because anything can speak HTTP.

WebAuthn

Web Authentication, the W3C standard that enables phishing-resistant authentication in browsers using public-key cryptography and authenticators (hardware keys, platform biometrics). The basis for passkeys.

Well-Known Ports

Standardized TCP/UDP ports (0-1023) reserved for common services, like 22 for SSH, 80 for HTTP, 443 for HTTPS. Foundational networking knowledge defenders use constantly.

Windows Event Log

Windows' built-in event logging system, the primary source of security telemetry for Windows hosts, covering authentication, process creation, services, and many other event categories.

Windows Registry

Windows' hierarchical configuration database storing settings, software keys, autostarts, and more. A primary defender's data source and a major attacker target for persistence.

Windows SID

Security Identifier, the unique value Windows uses to identify a security principal (user, group, computer). Defenders read SIDs to identify subjects in audit logs and ACLs.

Workload Detection

Detecting threats inside cloud workloads, VMs, containers, serverless, by combining runtime telemetry with cloud-context signals, a defining cloud-workload-protection capability.

Workload IR

Incident response specifically for cloud workloads, VMs, containers, serverless, that uses cloud-context data alongside endpoint techniques to investigate and contain workload-level incidents.

Workload Identity

An identity assigned to software or infrastructure so it can access resources without static secrets.

Workload Identity Federation

Letting workloads (VMs, pods, functions) authenticate to cloud services using their own identity (not long-lived credentials), via trust between identity providers and cloud platforms.

Workload Onboarding

The process of bringing new cloud workloads under the protection program, agents installed, telemetry connected, posture checked, tagged for ownership, that ensures coverage scales with the estate.

Workload Protection

From a cloud-engineering perspective, protecting cloud workloads holistically, image, configuration, runtime, identity, the practical work of securing what actually runs.

Workload Security at Scale

Operating workload protection across many cloud workloads sustainably, automation, standardization, self-service, that distinguishes a working program from one that breaks under growth.

Writable Paths

Filesystem paths an account or process can write to, which on Windows and Linux can become privilege-escalation paths if the contents are later executed or read by something more privileged.

X-Frame-Options

An HTTP response header that controls whether a page may be embedded in a frame, defending against clickjacking by preventing other sites from iframing the page.

XSS

Cross-Site Scripting: a class of vulnerability where attacker-controlled content is rendered as code by the victim's browser, enabling theft, account takeover, or other client-side attacks.

XSS Testing

Testing a web application for cross-site scripting vulnerabilities by probing inputs with crafted payloads to find where untrusted content reaches the browser as code.

Yara Rules

Pattern-matching rules for identifying malware and files of interest by content, strings, byte patterns, conditions, used widely in malware analysis, hunting, and incident response.

Yara String Selection

The craft of choosing strings for YARA rules that are distinctive, durable, and unlikely to false-positive, the difference between a rule that catches a family and one that catches noise.

ZTA Assessment Process

From a security-architecture-review lens, the process of assessing a system or program for zero-trust posture, identifying gaps against ZTA principles and providing concrete recommendations.

ZTA Logical Components

The logical building blocks of a zero-trust architecture as defined by NIST SP 800-207, Policy Engine, Policy Administrator, Policy Enforcement Point, that describe how access decisions and enforcement work together.

ZTA Maturity Assessment

An assessment of how mature an organization's zero-trust implementation is, often using CISA's Zero Trust Maturity Model with stages from traditional to optimal across identity, device, network, applications, data.

ZTA Maturity Model

A model describing stages of zero-trust adoption, typically CISA's traditional / initial / advanced / optimal across pillars, that gives organizations a structured way to assess progress and plan next steps.

ZTA Migration Pitfalls

The common traps organizations hit while moving to zero-trust, treating ZTA as a product, breaking productivity with overzealous controls, neglecting identity foundations, that derail ZTA programs.

ZTA Privilege Escalation Controls

Zero-trust controls that limit privilege escalation, just-in-time elevation, strong MFA at elevation, device-trust requirements for admin actions, scoped tokens, that reduce what an attacker can do with a foothold.