Terminology Index

Glossary

2953 terms

Web Assessment Authorization

Web assessment authorization is explicit written permission from an accountable owner to perform named security tests against named web assets during an agreed period.

Web Assessment Evidence Handling

Web assessment evidence handling collects, protects, redacts, transfers, retains, and disposes of the minimum request, response, screenshot, log, and note data needed to reproduce a result.

Web Assessment Methodology

The structured methodology used in web-application security assessments, scoping, recon, mapping, testing categories in order, reporting, that produces repeatable, thorough coverage.

Web Assessment Rules of Engagement

Web assessment rules of engagement specify authorized targets, environments, accounts, source addresses, dates, test rates, permitted techniques, prohibited actions, data handling, contacts, stop conditions, and cleanup.

Web Assessment Scope

Web assessment scope defines the assets, environments, interfaces, identities, data, techniques, time windows, dependencies, and exclusions covered by an authorized web security assessment.

Web Authentication

How web applications authenticate users, password-based, OIDC/social, passkeys, with the session and token mechanisms that maintain login. A foundational defensive-web topic.

Web Client

The software that consumes a web service or page, typically a browser, but also mobile apps, scripts, or bots. Defenders treat all clients as untrusted because anything can speak HTTP.

Web Defense in Depth

Coordinated browser, application, identity, data, network, deployment, detection, and response controls that limit the consequences of any one web-control failure.

Web Server

Software that receives HTTP requests and serves responses, Apache, Nginx, IIS, or an application framework. The server side of the trust boundary in web defense.

Web Test Tool Safety

Web test tool safety configures proxies, browsers, scanners, scripts, API clients, and callback services to stay within scope, request budgets, evidence rules, and stop conditions.

WebAuthn

Web Authentication, the W3C standard that enables phishing-resistant authentication in browsers using public-key cryptography and authenticators (hardware keys, platform biometrics). The basis for passkeys.

Well-Known Port

A transport port in the IANA system range 0-1023 commonly assigned to standardized services, without guaranteeing what application actually uses it.

Well-Known Ports

Standardized TCP/UDP ports (0-1023) reserved for common services, like 22 for SSH, 80 for HTTP, 443 for HTTPS. Foundational networking knowledge defenders use constantly.

Windows Event Log

Windows' built-in event logging system, the primary source of security telemetry for Windows hosts, covering authentication, process creation, services, and many other event categories.

Windows LAPS (Entra ID Integration)

Windows LAPS integration with Microsoft Entra ID lets supported Entra-joined or hybrid-joined Windows devices back up an encrypted managed local administrator password to their Entra device object.

Windows Registry

Windows' hierarchical configuration database storing settings, software keys, autostarts, and more. A primary defender's data source and a major attacker target for persistence.

Windows SID

Security Identifier, the unique value Windows uses to identify a security principal (user, group, computer). Defenders read SIDs to identify subjects in audit logs and ACLs.

Windows Security Telemetry

Windows security telemetry is audit evidence from Windows security, operational, PowerShell, Defender, firewall, and related logs when the relevant policies and collectors are configured.

Wire Fraud

Fraud that uses electronic communications or transfer systems to obtain money or property through deception, with exact legal elements depending on jurisdiction.

Workflow and State Transition Testing

Workflow and state transition testing verifies that required steps cannot be skipped, reordered, replayed, or performed after expiry, revocation, completion, or a conflicting state change.

Workload Containment Tradeoff

A workload containment tradeoff weighs active harm, spread, data and identity exposure, service consequence, evidence volatility, authority, reversibility, orchestration behavior, and recovery readiness.

Workload Detection

Detecting threats inside cloud workloads, VMs, containers, serverless, by combining runtime telemetry with cloud-context signals, a defining cloud-workload-protection capability.

Workload Detection Hypothesis

A workload detection hypothesis states the unwanted behavior, affected workload, expected evidence, benign alternatives, coverage assumptions, and response decision that a detection supports.

Workload IR

Incident response specifically for cloud workloads, VMs, containers, serverless, that uses cloud-context data alongside endpoint techniques to investigate and contain workload-level incidents.

Workload IR specializes incident response for the cloud workload layer: investigate processes and behavior on VMs/containers/functions, pull cloud-context (IAM, metadata service, VPC flow logs) to scope, contain by stopping or isolating workloads while preserving evidence (snapshots), and remediate without breaking dependent services. As a cloud-workload-protection topic, workload IR sits between traditional endpoint IR and cloud IR, drawing from both and adding its own runbooks for cloud-native scenarios.

Introduced in: Cloud Workload Protection

Examples

Investigating a suspected compromise on a VM using runtime and cloud-context data.
Snapshotting a workload before isolating it to preserve evidence.
Containing a workload incident without breaking dependent services.

Workload Onboardingrelates_to Workload Protectionrelates_to Workload Security at Scalerelates_to Cloud Incident Responserelates_to Workload Detectionrelates_to Containmentrelates_to Incident Lifecyclerelates_to VPC Flow Log Analysisrelates_to Workload Detectionrelates_to Workload Identity Federationrelates_to VM Runtime Coveragerelates_to Workload Containment Tradeoffrelates_to Workload Detection Hypothesisrelates_to

Workload Identity

An identity assigned to software or infrastructure so it can access resources without static secrets.

Workload Identity Federation

Letting workloads (VMs, pods, functions) authenticate to cloud services using their own identity (not long-lived credentials), via trust between identity providers and cloud platforms.

Workload Identity and Credential Assessment

Workload identity and credential assessment reviews how compute, containers, serverless, CI/CD, automation, and external workloads obtain, use, rotate, and revoke cloud identity.

Workload Image and Lifecycle Assessment

Workload image and lifecycle assessment links machine and container images to provenance, build, attestation, vulnerabilities, secrets, hardening, supported components, deployed identity, patching, replacement, and rollback.

Workload Onboarding

The process of bringing new cloud workloads under the protection program, agents installed, telemetry connected, posture checked, tagged for ownership, that ensures coverage scales with the estate.

Workload Protection

From a cloud-engineering perspective, protecting cloud workloads holistically, image, configuration, runtime, identity, the practical work of securing what actually runs.

Workload Protection Capability Model

A workload protection capability model defines required outcomes for inventory, configuration, identity, vulnerabilities, artifact trust, admission, runtime detection, data protection, investigation, response, recovery, and governance.

Workload Protection Integration

Workload protection integration routes validated findings and evidence through stable asset identities, deduplication, ownership, case lifecycle, exception state, SIEM correlation, response approval, and closure validation.