Terminology Index

Glossary

2953 terms

Web Assessment Authorization

Web assessment authorization is explicit written permission from an accountable owner to perform named security tests against named web assets during an agreed period.

Web Assessment Evidence Handling

Web assessment evidence handling collects, protects, redacts, transfers, retains, and disposes of the minimum request, response, screenshot, log, and note data needed to reproduce a result.

Web Assessment Methodology

The structured methodology used in web-application security assessments, scoping, recon, mapping, testing categories in order, reporting, that produces repeatable, thorough coverage.

Web Assessment Rules of Engagement

Web assessment rules of engagement specify authorized targets, environments, accounts, source addresses, dates, test rates, permitted techniques, prohibited actions, data handling, contacts, stop conditions, and cleanup.

Web Assessment Scope

Web assessment scope defines the assets, environments, interfaces, identities, data, techniques, time windows, dependencies, and exclusions covered by an authorized web security assessment.

Web Authentication

How web applications authenticate users, password-based, OIDC/social, passkeys, with the session and token mechanisms that maintain login. A foundational defensive-web topic.

Web Client

The software that consumes a web service or page, typically a browser, but also mobile apps, scripts, or bots. Defenders treat all clients as untrusted because anything can speak HTTP.

Web Defense in Depth

Coordinated browser, application, identity, data, network, deployment, detection, and response controls that limit the consequences of any one web-control failure.

Web Server

Software that receives HTTP requests and serves responses, Apache, Nginx, IIS, or an application framework. The server side of the trust boundary in web defense.

Web Test Tool Safety

Web test tool safety configures proxies, browsers, scanners, scripts, API clients, and callback services to stay within scope, request budgets, evidence rules, and stop conditions.

WebAuthn

Web Authentication, the W3C standard that enables phishing-resistant authentication in browsers using public-key cryptography and authenticators (hardware keys, platform biometrics). The basis for passkeys.

Well-Known Port

A transport port in the IANA system range 0-1023 commonly assigned to standardized services, without guaranteeing what application actually uses it.

Well-Known Ports

Standardized TCP/UDP ports (0-1023) reserved for common services, like 22 for SSH, 80 for HTTP, 443 for HTTPS. Foundational networking knowledge defenders use constantly.

Windows Event Log

Windows' built-in event logging system, the primary source of security telemetry for Windows hosts, covering authentication, process creation, services, and many other event categories.

Windows LAPS (Entra ID Integration)

Windows LAPS integration with Microsoft Entra ID lets supported Entra-joined or hybrid-joined Windows devices back up an encrypted managed local administrator password to their Entra device object.

Windows Registry

Windows' hierarchical configuration database storing settings, software keys, autostarts, and more. A primary defender's data source and a major attacker target for persistence.

Windows SID

Security Identifier, the unique value Windows uses to identify a security principal (user, group, computer). Defenders read SIDs to identify subjects in audit logs and ACLs.

Windows Security Telemetry

Windows security telemetry is audit evidence from Windows security, operational, PowerShell, Defender, firewall, and related logs when the relevant policies and collectors are configured.

Wire Fraud

Fraud that uses electronic communications or transfer systems to obtain money or property through deception, with exact legal elements depending on jurisdiction.

Workflow and State Transition Testing

Workflow and state transition testing verifies that required steps cannot be skipped, reordered, replayed, or performed after expiry, revocation, completion, or a conflicting state change.

Workload Containment Tradeoff

A workload containment tradeoff weighs active harm, spread, data and identity exposure, service consequence, evidence volatility, authority, reversibility, orchestration behavior, and recovery readiness.

Workload Detection

Detecting threats inside cloud workloads, VMs, containers, serverless, by combining runtime telemetry with cloud-context signals, a defining cloud-workload-protection capability.

Workload detection runs across the mix of cloud workload types: process and syscall patterns on VMs, container runtime behavior, function-execution context for serverless. It combines endpoint-style telemetry with cloud-context signals (which IAM role ran this, did metadata service get hit) to produce detections meaningful at cloud scale. As a cloud-workload-protection topic, workload detection is one of the key delivery capabilities of CWPP and CNAPP platforms, alongside posture and image scanning.

Introduced in: Cloud Workload Protection

Examples

Detecting suspicious process patterns on VMs and containers.
Combining runtime signals with cloud-context like IAM role usage.
Producing workload detections meaningful at cloud scale.

Workload Identity Federationrelates_to Workload IRrelates_to Workload Onboardingrelates_to Workload Protectionrelates_to Workload Security at Scalerelates_to VM Detection Patternsrelates_to Container Runtime Securityrelates_to Runtime Securityrelates_to VM Drift and Patch Strategyrelates_to VM Image Promotion Gaterelates_to VM Image Provenancerelates_to Workload IRrelates_to Workload Protectionrelates_to

Workload Detection Hypothesis

A workload detection hypothesis states the unwanted behavior, affected workload, expected evidence, benign alternatives, coverage assumptions, and response decision that a detection supports.

Workload IR

Incident response specifically for cloud workloads, VMs, containers, serverless, that uses cloud-context data alongside endpoint techniques to investigate and contain workload-level incidents.

Workload Identity

An identity assigned to software or infrastructure so it can access resources without static secrets.

Workload Identity Federation

Letting workloads (VMs, pods, functions) authenticate to cloud services using their own identity (not long-lived credentials), via trust between identity providers and cloud platforms.

Workload Identity and Credential Assessment

Workload identity and credential assessment reviews how compute, containers, serverless, CI/CD, automation, and external workloads obtain, use, rotate, and revoke cloud identity.

Workload Image and Lifecycle Assessment

Workload image and lifecycle assessment links machine and container images to provenance, build, attestation, vulnerabilities, secrets, hardening, supported components, deployed identity, patching, replacement, and rollback.

Workload Onboarding

The process of bringing new cloud workloads under the protection program, agents installed, telemetry connected, posture checked, tagged for ownership, that ensures coverage scales with the estate.

Workload Protection

From a cloud-engineering perspective, protecting cloud workloads holistically, image, configuration, runtime, identity, the practical work of securing what actually runs.

Workload Protection Capability Model

A workload protection capability model defines required outcomes for inventory, configuration, identity, vulnerabilities, artifact trust, admission, runtime detection, data protection, investigation, response, recovery, and governance.

Workload Protection Integration

Workload protection integration routes validated findings and evidence through stable asset identities, deduplication, ownership, case lifecycle, exception state, SIEM correlation, response approval, and closure validation.